From: Andrew Cooper <andrew.cooper3@citrix.com>
Date: Thu, 19 Dec 2019 20:32:20 +0000 (+0000)
Subject: libxc/restore: Fix data auditing in handle_x86_pv_vcpu_blob()
X-Git-Tag: archive/raspbian/4.11.4+24-gddaaccbbab-1_deb10u1+rpi1^2^2~53^2~17
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=a58bba28da793da70b93b841289d99370800180c;p=xen.git

libxc/restore: Fix data auditing in handle_x86_pv_vcpu_blob()

The current logic only works by chance, in that XSAVE records also tend to be
a multiple of 128.  Implement the missing logic for XSAVE.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
(cherry picked from commit 2a62c22715bf81c5695ae0511f89a940c7c6a492)
(cherry picked from commit 0e2bbcf8b4fe6f5fd23a341848f3785c213b26bb)
(cherry picked from commit 288872ad3bb320bd9f31145d9bd4e53786fa3245)
---

diff --git a/tools/libxc/xc_sr_restore_x86_pv.c b/tools/libxc/xc_sr_restore_x86_pv.c
index 0f02751992..8c7adaeeda 100644
--- a/tools/libxc/xc_sr_restore_x86_pv.c
+++ b/tools/libxc/xc_sr_restore_x86_pv.c
@@ -825,6 +825,15 @@ static int handle_x86_pv_vcpu_blob(struct xc_sr_context *ctx,
         break;
 
     case REC_TYPE_X86_PV_VCPU_XSAVE:
+        if ( blobsz < 128 )
+        {
+            ERROR("%s record too short: min %zu, got %u",
+                  rec_name, sizeof(*vhdr) + 128, rec->length);
+            goto out;
+        }
+        break;
+
+    case REC_TYPE_X86_PV_VCPU_MSRS:
         if ( blobsz % sizeof(xen_domctl_vcpu_msr_t) != 0 )
         {
             ERROR("%s record payload size %zu expected to be a multiple of %zu",