John Levon
2007-Mar-07 19:48 UTC
[Xen-devel] Re: [Xen-changelog] [xen-unstable] linux: Fix xenbus device write function.
On Wed, Mar 07, 2007 at 11:30:21AM -0800, Keir Fraser wrote:> u->len += len; > - if (u->len < (sizeof(u->u.msg) + u->u.msg.len)) > - return len; > + if ((u->len < sizeof(u->u.msg)) || > + (u->len < (sizeof(u->u.msg) + u->u.msg.len))) > + return rc;What is this trying to achieve? regards john _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel
Keir Fraser
2007-Mar-08 07:52 UTC
Re: [Xen-devel] Re: [Xen-changelog] [xen-unstable] linux: Fix xenbus device write function.
On 7/3/07 19:48, "John Levon" <levon@movementarian.org> wrote:>> u->len += len; >> - if (u->len < (sizeof(u->u.msg) + u->u.msg.len)) >> - return len; >> + if ((u->len < sizeof(u->u.msg)) || >> + (u->len < (sizeof(u->u.msg) + u->u.msg.len))) >> + return rc; > > What is this trying to achieve?Check you have a complete header before comparing on the header''s length field. -- Keir _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel