[Xen-changelog] [xen-unstable] [ACM] Check boundary conditions of passed parameters before accessing

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User kfraser@xxxxxxxxxxxxxxxxxxxxx
# Date 1185181009 -3600
# Node ID f45c9f122e0eabf80d8f5e908a6bdc08a5810cc3
# Parent  dae6a2790f6b615959fa8e1aaa640bbd78c8f4ad
[ACM] Check boundary conditions of passed parameters before accessing
an array with them.
Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxx>
---
 xen/acm/acm_simple_type_enforcement_hooks.c |   19 ++++++++++++-------
 1 files changed, 12 insertions(+), 7 deletions(-)

diff -r dae6a2790f6b -r f45c9f122e0e xen/acm/acm_simple_type_enforcement_hooks.c
--- a/xen/acm/acm_simple_type_enforcement_hooks.c       Mon Jul 23 09:56:00 
2007 +0100
+++ b/xen/acm/acm_simple_type_enforcement_hooks.c       Mon Jul 23 09:56:49 
2007 +0100
@@ -40,13 +40,18 @@ struct ste_binary_policy ste_bin_pol;
 
 static inline int have_common_type (ssidref_t ref1, ssidref_t ref2) {
     int i;
-    for( i = 0; i< ste_bin_pol.max_types; i++ )
-        if ( ste_bin_pol.ssidrefs[ref1*ste_bin_pol.max_types + i] && 
-             ste_bin_pol.ssidrefs[ref2*ste_bin_pol.max_types + i])
-        {
-            printkd("%s: common type #%02x.\n", __func__, i);
-            return 1;
-        }
+
+    if ( ref1 >= 0 && ref1 < ste_bin_pol.max_ssidrefs &&
+         ref2 >= 0 && ref2 < ste_bin_pol.max_ssidrefs )
+    {
+        for( i = 0; i< ste_bin_pol.max_types; i++ )
+            if ( ste_bin_pol.ssidrefs[ref1*ste_bin_pol.max_types + i] &&
+                 ste_bin_pol.ssidrefs[ref2*ste_bin_pol.max_types + i])
+            {
+                printkd("%s: common type #%02x.\n", __func__, i);
+                return 1;
+            }
+    }
     return 0;
 }
 

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog