File xen.27751d89248c8c5eef6d8b56eb8f7d2084145080.patch of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File xen.27751d89248c8c5eef6d8b56eb8f7d2084145080.patch of Package xen (Revision 3b077056294bcb49994ea3227248b4ad)

Currently displaying revision 3b077056294bcb49994ea3227248b4ad , Show latest

From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?=
 <marmarek@invisiblethingslab.com>
Date: Thu, 5 Apr 2018 03:50:50 +0200
Subject: 27751d89248c8c5eef6d8b56eb8f7d2084145080
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tools/misc: fix hypothetical buffer overflow in xen-lowmemd

gcc-8 complains:

xen-lowmemd.c: In function 'handle_low_mem':
    xen-lowmemd.c:80:55: error: '%s' directive output may be truncated writing up to 511 bytes into a region of size 489 [-Werror=format-truncation=]
             snprintf(error, BUFSZ,"Failed to write target %s to xenstore", data);
                                                           ^~               ~~~~
    xen-lowmemd.c:80:9: note: 'snprintf' output between 36 and 547 bytes into a destination of size 512
             snprintf(error, BUFSZ,"Failed to write target %s to xenstore", data);
             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In practice it wouldn't happen, because 'data' contains string
representation of 64-bit unsigned number (20 characters at most).
But place a limit to mute gcc warning.

Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
Release-Acked-by: Juergen Gross <jgross@suse.com>
---
 tools/misc/xen-lowmemd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/tools/misc/xen-lowmemd.c
+++ b/tools/misc/xen-lowmemd.c
@@ -67,25 +67,25 @@ void handle_low_mem(void)
     printf("Dom0 pages: 0x%llx:%llu\n", dom0_pages, dom0_pages);
     dom0_target = dom0_pages - diff;
     if (dom0_target <= DOM0_FLOOR_PG)
         return;
 
     printf("Shooting for dom0 target 0x%llx:%llu\n", 
             dom0_target, dom0_target);
 
     snprintf(data, BUFSZ, "%llu", dom0_target);
     if (!xs_write(xs_handle, XBT_NULL, 
             "/local/domain/0/memory/target", data, strlen(data)))
     {
-        snprintf(error, BUFSZ,"Failed to write target %s to xenstore", data);
+        snprintf(error, BUFSZ,"Failed to write target %.24s to xenstore", data);
         perror(error);
     }
 }
 
 int main(int argc, char *argv[])
 {
     int rc;
 
     atexit(cleanup);
 
 	xch = xc_interface_open(NULL, NULL, 0);
 	if (xch == NULL)

Places

File xen.27751d89248c8c5eef6d8b56eb8f7d2084145080.patch of Package xen (Revision 3b077056294bcb49994ea3227248b4ad)

Places