From: Andrew Cooper <andrew.cooper3@citrix.com>
Date: Thu, 16 Jul 2015 19:32:45 +0000 (+0100)
Subject: tools/xl: Fix segfaults from `xl psr-cat-cbm-set` command line handling
X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~2756
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=a49077e5;p=xen.git

tools/xl: Fix segfaults from `xl psr-cat-cbm-set` command line handling

The socket option takes a mandatory argument.  Mark it as such, so
optarg isn't NULL when passed to trim(), which unconditionally
dereference it.

Range check optind against argc before blindly assuming that
argv[optind] and argv[optind+1] exist.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
CC: Ian Campbell <Ian.Campbell@citrix.com>
CC: Wei Liu <wei.liu2@citrix.com>
CC: Chao Peng <chao.p.peng@linux.intel.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
---

diff --git a/tools/libxl/xl_cmdimpl.c b/tools/libxl/xl_cmdimpl.c
index 0cc9f8bee5..79492021eb 100644
--- a/tools/libxl/xl_cmdimpl.c
+++ b/tools/libxl/xl_cmdimpl.c
@@ -8397,7 +8397,7 @@ int main_psr_cat_cbm_set(int argc, char **argv)
     int i, j, len;
 
     static struct option opts[] = {
-        {"socket", 0, 0, 's'},
+        {"socket", required_argument, 0, 's'},
         COMMON_LONG_OPTS,
         {0, 0, 0, 0}
     };
@@ -8405,7 +8405,7 @@ int main_psr_cat_cbm_set(int argc, char **argv)
     libxl_socket_bitmap_alloc(ctx, &target_map, 0);
     libxl_bitmap_set_none(&target_map);
 
-    SWITCH_FOREACH_OPT(opt, "s", opts, "psr-cat-cbm-set", 1) {
+    SWITCH_FOREACH_OPT(opt, "s:", opts, "psr-cat-cbm-set", 1) {
     case 's':
         trim(isspace, optarg, &value);
         split_string_into_string_list(value, ",", &socket_list);
@@ -8424,6 +8424,11 @@ int main_psr_cat_cbm_set(int argc, char **argv)
     if (libxl_bitmap_is_empty(&target_map))
         libxl_bitmap_set_any(&target_map);
 
+    if (argc != optind + 2) {
+        help("psr-cat-cbm-set");
+        return 2;
+    }
+
     domid = find_domain(argv[optind]);
     cbm = strtoll(argv[optind + 1], NULL , 0);