diff options
| author | Yousef Alhouseen <alhouseenyousef@gmail.com> | 2026-06-27 00:37:38 +0200 |
|---|---|---|
| committer | Juergen Gross <jgross@suse.com> | 2026-07-01 10:01:14 +0200 |
| commit | cbbef43bdc083892a2d4787245c249502c215bb8 (patch) | |
| tree | 0b69f8ae85d7101e20b87e6975111ececf0dc7ce /drivers/xen/gntdev.c | |
| parent | 2299822f3f466b5dcad2377bf63986199f881a6b (diff) | |
| download | linux-next-cbbef43bdc083892a2d4787245c249502c215bb8.tar.gz linux-next-cbbef43bdc083892a2d4787245c249502c215bb8.zip | |
xenbus: reject unterminated directory replies
split_strings() walks each directory entry with strlen(). Although the
transport adds a terminator after the reply buffer, a malformed reply
without a final NUL inside its advertised length would let that walk
cross the protocol payload boundary.
Reject such replies before counting the strings. Report the protocol
violation once and return -EIO to the caller.
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260626223738.43742-1-alhouseenyousef@gmail.com>
Diffstat (limited to 'drivers/xen/gntdev.c')
0 files changed, 0 insertions, 0 deletions