xc: fix segfault in pv domain create if kernel is an invalid image

If libelf calls elf_err() or elf_msg() before elf_set_log() has been
called then it could potentially read an uninitialised log handling
callback function pointer from struct elf_binary. Fix this in libxc by
zeroing the structure before calling elf_init().

Signed-off-by: Gianni Tedesco <gianni.tedesco@citrix.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

diff --git a/tools/libxc/xc_hvm_build.c b/tools/libxc/xc_hvm_build.c
index 7bdd50b1f3d4e57fc72802433be904d2c1735f27..03e81a9e1bc677ad5a412204816fc85397b0ab5c 100644 (file)
--- a/tools/libxc/xc_hvm_build.c
+++ b/tools/libxc/xc_hvm_build.c
@@ -142,6 +142,7 @@ static int setup_guest(xc_interface *xch,
     if ( memsize > target )
         pod_mode = 1;
 
+    memset(&elf, 0, sizeof(elf));
     if ( elf_init(&elf, image, image_size) != 0 )
         goto error_out;
     elf_parse_binary(&elf);