From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ian Jackson Subject: [PATCH 22/22] libxc: check blob size before proceeding in xc_dom_check_gzip Date: Tue, 11 Jun 2013 19:22:40 +0100 Message-ID: <1370974960-19824-23-git-send-email-ian.jackson@eu.citrix.com> References: <1370974960-19824-1-git-send-email-ian.jackson@eu.citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1370974960-19824-1-git-send-email-ian.jackson@eu.citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xensource.com Cc: andrew.cooper3@citrix.com, mattjd@gmail.com, security@xen.org List-Id: xen-devel@lists.xenproject.org From: Matthew Daley This is part of the fix to a security issue, XSA-55. Signed-off-by: Matthew Daley --- tools/libxc/xc_dom_core.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c index 3cbf9f7..37bb566 100644 --- a/tools/libxc/xc_dom_core.c +++ b/tools/libxc/xc_dom_core.c @@ -284,6 +284,10 @@ size_t xc_dom_check_gzip(xc_interface *xch, void *blob, size_t ziplen) unsigned char *gzlen; size_t unziplen; + if ( ziplen < 6 ) + /* too small */ + return 0; + if ( strncmp(blob, "\037\213", 2) ) /* not gzipped */ return 0; -- 1.7.2.5