Re: [Xen-devel] [PATCH] console: avoid buffer overflow in guest_console_write()

From: Ian Jackson <ian.jackson@citrix.com>
To: Jan Beulich <jbeulich@suse.com>
Cc: Juergen Gross <jgross@suse.com>,
	Stefano Stabellini <sstabellini@kernel.org>,
	Julien Grall <julien@xen.org>, Wei Liu <wl@xen.org>,
	Konrad Wilk <konrad.wilk@oracle.com>,
	Andrew Cooper <Andrew.Cooper3@citrix.com>,
	Ilja Van Sprundel <ivansprundel@ioactive.com>,
	George Dunlap <George.Dunlap@citrix.com>,
	"xen-devel@lists.xenproject.org" <xen-devel@lists.xenproject.org>
Subject: Re: [Xen-devel] [PATCH] console: avoid buffer overflow in guest_console_write()
Date: Fri, 29 Nov 2019 11:59:30 +0000	[thread overview]
Message-ID: <24033.2082.127306.518557@mariner.uk.xensource.com> (raw)
In-Reply-To: <5766dd2b-2aa7-bafe-56ad-3ea33ddf4591@suse.com>

Jan Beulich writes ("[PATCH] console: avoid buffer overflow in guest_console_write()"):
> The switch of guest_console_write()'s second parameter from plain to
> unsigned int has caused the function's main loop header to no longer
> guard the min_t() use within the function against effectively negative
> values, due to the casts hidden inside the macro. Replace by a plain
> min(), converting one of the arguments suitably without involving any
> cast.
> 
> Fixes: ea601ec9995b ("xen/console: Rework HYPERCALL_console_io interface")
> Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

ea601ec9995b included this hunk:

       case CONSOLEIO_read:
  +        /*
  +         * The return value is either the number of characters read or
  +         * a negative value in case of error. So we need to prevent
  +         * overlap between the two sets.
  +         */
  +        rc = -E2BIG;
  +        if ( count > INT_MAX )
  +            break;

Maybe it would be good to move that outside the switch so that it
affects CONSOLEIO_write too ?

Ian.

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel