File 25587-param-parse-limit.patch of Package xen.854

# HG changeset patch
# User Andrew Cooper <andrew.cooper3@citrix.com>
# Date 1341319099 -3600
# Node ID 2cffb7bf6e5738af59d52446155d49aaeadac540
# Parent  1b3198c8f140918574ccfe6baba92ef214d69c1a
xen: Fix off-by-one error when parsing command line arguments

As Xen currently stands, it will attempt to interpret the first few
bytes of the initcall section as a struct kernel_param.

The reason that this not caused problems is because in the overflow
case, param->name is actually a function pointer to the first
initcall, and intepreting it as string is very unlikely to match an
ASCII command line parameter name.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Committed-by: Keir Fraser <keir@xen.org>

--- a/xen/common/kernel.c
+++ b/xen/common/kernel.c
@@ -68,7 +68,7 @@ void cmdline_parse(char *cmdline)
         if ( !bool_assert )
             optkey += 3;
 
-        for ( param = &__setup_start; param <= &__setup_end; param++ )
+        for ( param = &__setup_start; param < &__setup_end; param++ )
         {
             if ( strcmp(param->name, optkey) )
                 continue;