mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
cbbef43bdc
split_strings() walks each directory entry with strlen(). Although the transport adds a terminator after the reply buffer, a malformed reply without a final NUL inside its advertised length would let that walk cross the protocol payload boundary. Reject such replies before counting the strings. Report the protocol violation once and return -EIO to the caller. Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Reviewed-by: Juergen Gross <jgross@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260626223738.43742-1-alhouseenyousef@gmail.com> |
History
|
|
|---|---|---|
| .. | ||
| Makefile | ||
| xenbus.h | ||
| xenbus_client.c | ||
| xenbus_comms.c | ||
| xenbus_dev_backend.c | ||
| xenbus_dev_frontend.c | ||
| xenbus_probe.c | ||
| xenbus_probe_backend.c | ||
| xenbus_probe_frontend.c | ||
| xenbus_xs.c | ||