Re: [PATCH] xenbus: preserve terminator when splitting directory strings

[Juergen Gross]

On 24.06.26 14:42, Yousef Alhouseen wrote:
> xenbus_directory() gets a reply buffer that xenbus_comms.c
> null-terminates at body[len]. split_strings() counts strings using
> that terminator, but then copies only len bytes into its combined
> pointer/string allocation.
>
> If a malformed or unexpected directory reply does not carry a final NUL
> within the advertised length, the relocated last string is left
> unterminated. Callers then treat the entries as C strings and can read
> past the allocation.

This would be a major bug in a trusted component (Xenstore).

> Allocate and copy the transport-added terminator as part of the
> relocated string block. This preserves current parsing behavior while
> keeping every returned entry NUL-terminated.

I'd rather see a check that the last byte of the reply is indeed a NUL byte.
In case it is not NUL, then the reply is most certainly nonsense anyway and
a fat pr_err_once() is wanted plus "return ERR_PTR(-EIO);"


Juergen

Attachment: OpenPGP_0xB0DE9DD628BF132F.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature