fix xenctl_cpumap_to_cpumask() buffer size check
authorMatthew Daley <mattjd@gmail.com>
Tue, 13 Nov 2012 10:28:10 +0000 (11:28 +0100)
committerMatthew Daley <mattjd@gmail.com>
Tue, 13 Nov 2012 10:28:10 +0000 (11:28 +0100)
commit3c6881d8d00fbdea64be3b67a41b654da7c71b2d
tree0c322930c576ef8f6c36e73b81c91bbe6136d102
parent0c6601ee18c664a8702c142bd901ebc9539ac48d
fix xenctl_cpumap_to_cpumask() buffer size check

xenctl_cpumap_to_cpumask incorrectly uses sizeof when checking whether
bits should be masked off from the input cpumap bitmap or not.

Fix by using the correct cpumask buffer size in place of sizeof.

Signed-off-by: Matthew Daley <mattjd@gmail.com>
Compare against copy_bytes instead, and use equality rather than less-
or-equal.

Further, this issue (introduced with c/s 23991:a7ccbc79fc17) is not
security relevant (i.e. the bug could not cause memory corruption):
_xmalloc() never returns chunks of data smaller than the size of a
pointer, i.e. even if sizeof(void*) > guest_bytes > copy_bytes, the
piece of memory erroneously written to would still be inside the
allocation done at the top of the function.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
Committed-by: Jan Beulich <jbeulich@suse.com>
xen/common/domctl.c