From: Julien Grall Date: Fri, 25 Jun 2021 06:45:22 +0000 (+0100) Subject: tools/xenstored: Correctly read the requests header from the stream X-Git-Tag: archive/raspbian/4.16.0+51-g0941d6cb-1+rpi1~2^2~42^2~388 X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=8a9b94982b0e0928ad874907f5a5b005944ab7cf;p=xen.git tools/xenstored: Correctly read the requests header from the stream Commit c0fe360f42 ("tools/xenstored: Extend restore code to handle multiple input buffer") extend the read_buffered_state() to support multiple input buffers. Unfortunately, the commit didn't go far enough and still used sc->data (start of the buffers) for retrieving the header. This would lead to read the wrong headers for second and follow-up commands. Use data in place for sc->data for the source of the memcpy()s. Fixes: c0fe360f42 ("tools/xenstored: Extend restore code to handle multiple input buffer") Reported-by: Raphael Ning Signed-off-by: Julien Grall Reviewed-by: Juergen Gross --- diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c index cf7297a96c..16c856730c 100644 --- a/tools/xenstore/xenstored_core.c +++ b/tools/xenstore/xenstored_core.c @@ -2717,11 +2717,11 @@ void read_state_buffered_data(const void *ctx, struct connection *conn, len = sc->data_in_len - (data - sc->data); if (len < sizeof(bdata->hdr)) { bdata->inhdr = true; - memcpy(&bdata->hdr, sc->data, len); + memcpy(&bdata->hdr, data, len); bdata->used = len; } else { bdata->inhdr = false; - memcpy(&bdata->hdr, sc->data, sizeof(bdata->hdr)); + memcpy(&bdata->hdr, data, sizeof(bdata->hdr)); if (bdata->hdr.msg.len <= DEFAULT_BUFFER_SIZE) bdata->buffer = bdata->default_buffer; else