Re: [PATCH v2] xenbus: reject unterminated directory replies

[Jürgen Groß]

On 27.06.26 00:37, Yousef Alhouseen wrote:
> split_strings() walks each directory entry with strlen(). Although the
> transport adds a terminator after the reply buffer, a malformed reply
> without a final NUL inside its advertised length would let that walk
> cross the protocol payload boundary.
>
> Reject such replies before counting the strings. Report the protocol
> violation once and return -EIO to the caller.
>
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>

Reviewed-by: Juergen Gross <jgross@xxxxxxxx>


Juergen

Attachment: OpenPGP_0xB0DE9DD628BF132F.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature