Re: [Xen-devel] Fix PVFB backend to validate frontend's frame buffer description

[Markus Armbruster <armbru@xxxxxxxxxx>]

Pat Campbell <plc@xxxxxxxxxx> writes:

> Markus Armbruster wrote:
>> A buggy or malicious frontend can describe its shared framebuffer to
>> the backend in a way that makes the backend map an arbitrary amount of
>>
>>   
> snipped out, see inline question below.
>>
>> diff -r 0a8fc1a62796 tools/ioemu/hw/xenfb.c
>> --- a/tools/ioemu/hw/xenfb.c Mon May 12 11:19:09 2008 +0100
>> +++ b/tools/ioemu/hw/xenfb.c Tue May 13 14:53:58 2008 +0200
>> @@ -28,8 +28,6 @@
[....]
>> +static int xenfb_configure_fb(struct xenfb *xenfb, size_t fb_len_lim,
>> +                          int width, int height, int depth,
>> +                          size_t fb_len, int offset, int row_stride)
>> +{
>> +    size_t mfn_sz = sizeof(*((struct xenfb_page *)0)->pd);
>> +    size_t pd_len = sizeof(((struct xenfb_page *)0)->pd) / mfn_sz;
>> +    size_t fb_pages = pd_len * XC_PAGE_SIZE / mfn_sz;
>> +    size_t fb_len_max = fb_pages * XC_PAGE_SIZE;
>> +    int max_width, max_height;
>> +
>> +    if (fb_len_lim > fb_len_max) {
>> +            fprintf(stderr,
>> +                    "FB: fb size limit %zu exceeds %zu, corrected\n",
>> +                    fb_len_lim, fb_len_max);
>> +            fb_len_lim = fb_len_max;
>> +    }
>> +    if (fb_len > fb_len_lim) {
>> +            fprintf(stderr,
>> +                    "FB: frontend fb size %zu limited to %zu\n",
>> +                    fb_len, fb_len_lim);
>>   
> Do we need to set fb_len to fb_len_lim here?
> fb_len = fb_len_lim;

Yes, we do!  Good catch, thank you.  I have no idea how that got lost.
I'll post a patch.

[...]

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel