xen: fix potential integer overflow in queue_reply

Browse source

When len is greater than UINT_MAX - sizeof(*rb), in next allocation,
it can overflow integer range and allocates small size of heap.
After that, memcpy will overflow the allocated heap.
Therefore, it needs to check the size of given length.

Signed-off-by: Insu Yun <wuninsu@gmail.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>

...

This commit is contained in:

Insu Yun 2016-01-18 11:54:43 -05:00 • committed by David Vrabel

parent 52ba0746b3

commit 85c0a87cd1

1 changed files with 2 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

drivers/xen/xenbus/xenbus_dev_frontend.c

View file