File 23405-xentrace_fix_type_of_offset_to_avoid_ouf-... of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File 23405-xentrace_fix_type_of_offset_to_avoid_ouf-of-bounds_access.patch of Package xen (Revision 43b25d1f7f5589dd235134f645453186)

Currently displaying revision 43b25d1f7f5589dd235134f645453186 , Show latest

changeset:   23405:3057b531d905
user:        Olaf Hering <olaf@aepfle.de>
date:        Thu May 26 12:35:30 2011 +0100
files:       xen/common/trace.c
description:
xentrace: fix type of offset to avoid ouf-of-bounds access

Update the type of the local offset variable to match the type where
this variable is stored. Also update the type of t_info_first_offset
because it has also a limited range.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: George Dunlap <george.dunlap@eu.citrix.com>

---
 xen/common/trace.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

Index: xen-4.1.2-testing/xen/common/trace.c
===================================================================
--- xen-4.1.2-testing.orig/xen/common/trace.c
+++ xen-4.1.2-testing/xen/common/trace.c
@@ -106,7 +106,7 @@ static uint32_t calc_tinfo_first_offset(
  * The t_info layout is fixed and cant be changed without breaking xentrace.
  * Initialize t_info_pages based on number of trace pages.
  */
-static int calculate_tbuf_size(unsigned int pages, uint32_t t_info_first_offset)
+static int calculate_tbuf_size(unsigned int pages, uint16_t t_info_first_offset)
 {
     struct t_buf dummy_size;
     typeof(dummy_size.prod) max_size;
@@ -170,8 +170,8 @@ static int alloc_trace_bufs(unsigned int
     int i, cpu, order;
     /* Start after a fixed-size array of NR_CPUS */
     uint32_t *t_info_mfn_list;
-    uint32_t t_info_first_offset;
-    int offset;
+    uint16_t t_info_first_offset;
+    uint16_t offset;
 
     if ( t_info )
         return -EBUSY;
@@ -179,7 +179,7 @@ static int alloc_trace_bufs(unsigned int
     if ( pages == 0 )
         return -EINVAL;
 
-    /* Calculate offset in u32 of first mfn */
+    /* Calculate offset in units of u32 of first mfn */
     t_info_first_offset = calc_tinfo_first_offset();
 
     pages = calculate_tbuf_size(pages, t_info_first_offset);

Places

File 23405-xentrace_fix_type_of_offset_to_avoid_ouf-of-bounds_access.patch of Package xen (Revision 43b25d1f7f5589dd235134f645453186)

Places