diff options
| author | Ian Campbell <ian.campbell@citrix.com> | 2012-07-23 13:09:38 +0100 |
|---|---|---|
| committer | Ian Campbell <ian.campbell@citrix.com> | 2012-07-23 13:09:38 +0100 |
| commit | c8c7017f064d03623c02a61fa35be6720591be90 (patch) | |
| tree | c9357d2f671a50c7a391b43d5f4d235cb5fa542b /tools/libxc | |
| parent | c8e1f2f26584d4ef2767fa82fb54dc2c98bc6813 (diff) | |
| download | xen-c8c7017f064d03623c02a61fa35be6720591be90.tar.gz xen-c8c7017f064d03623c02a61fa35be6720591be90.tar.bz2 xen-c8c7017f064d03623c02a61fa35be6720591be90.zip | |
libxc: restore: bounds check for start_info.{store_mfn,console.domU.mfn}
These fields are canonicalised by the guest on suspend and therefore must be
valid pfns during restore.
Reported-by: Jonathan Ludlam <Jonathan.Ludlam@eu.citrix.com>
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Campbell <ian.campbell@citrix.com>
Diffstat (limited to 'tools/libxc')
| -rw-r--r-- | tools/libxc/xc_domain_restore.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/tools/libxc/xc_domain_restore.c b/tools/libxc/xc_domain_restore.c index 6227d43ffd..3fe2b12373 100644 --- a/tools/libxc/xc_domain_restore.c +++ b/tools/libxc/xc_domain_restore.c @@ -1912,9 +1912,21 @@ int xc_domain_restore(xc_interface *xch, int io_fd, uint32_t dom, SET_FIELD(start_info, nr_pages, dinfo->p2m_size); SET_FIELD(start_info, shared_info, shared_info_frame<<PAGE_SHIFT); SET_FIELD(start_info, flags, 0); + if ( GET_FIELD(start_info, store_mfn) > dinfo->p2m_size ) + { + ERROR("Suspend record xenstore frame number is bad"); + munmap(start_info, PAGE_SIZE); + goto out; + } *store_mfn = ctx->p2m[GET_FIELD(start_info, store_mfn)]; SET_FIELD(start_info, store_mfn, *store_mfn); SET_FIELD(start_info, store_evtchn, store_evtchn); + if ( GET_FIELD(start_info, console.domU.mfn) > dinfo->p2m_size ) + { + ERROR("Suspend record console frame number is bad"); + munmap(start_info, PAGE_SIZE); + goto out; + } *console_mfn = ctx->p2m[GET_FIELD(start_info, console.domU.mfn)]; SET_FIELD(start_info, console.domU.mfn, *console_mfn); SET_FIELD(start_info, console.domU.evtchn, console_evtchn); |