Skip to content

Commit

Permalink
Avoid writing junk into Xenstore
Browse files Browse the repository at this point in the history
The path buffer pointer would be overwritten, but the length would not
be.  xs_write() would therefore read out of bounds.

This is not a security problem as the not-script process has no secrets
in its address space, and besides it is not exposed to untrusted input.

Not tested beyond "it builds", but should be quite obvious.

Fixes: QubesOS/qubes-issues#8708
  • Loading branch information
DemiMarie committed Nov 13, 2023
1 parent 96698e2 commit b1e335a
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions not-script/not-script.c
Original file line number Diff line number Diff line change
Expand Up @@ -487,8 +487,9 @@ int main(int argc, char **argv)
char buf[sizeof("/dev/loop") + 10];
char *physdev_path = data;
if (major(dev) == LOOP_MAJOR) {
if ((unsigned)snprintf(buf, sizeof buf, "/dev/loop%" PRIu32,
(unsigned)minor(dev)) >= sizeof buf)
path_len = (unsigned)snprintf(buf, sizeof buf, "/dev/loop%" PRIu32,
(unsigned)minor(dev));
if (path_len >= sizeof buf)
abort();
physdev_path = buf;
}
Expand Down

0 comments on commit b1e335a

Please sign in to comment.