From 4783ee894f6bfb0f4deec9f1fe8e7faceafaa1a2 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Thu, 6 Feb 2020 09:52:33 +0100 Subject: [PATCH] EFI: don't leak heap contents through XEN_EFI_get_next_variable_name Commit 1f4eb9d27d0e ("EFI: fix getting EFI variable list on some systems") switched to using the caller provided size for the copy-out without making sure the copied buffer is properly scrubbed. Reported-by: Ilja Van Sprundel Signed-off-by: Jan Beulich Reviewed-by: George Dunlap --- xen/common/efi/runtime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/common/efi/runtime.c b/xen/common/efi/runtime.c index 752e604390..95367694b5 100644 --- a/xen/common/efi/runtime.c +++ b/xen/common/efi/runtime.c @@ -571,7 +571,7 @@ int efi_runtime_call(struct xenpf_efi_runtime_call *op) return -EINVAL; size = op->u.get_next_variable_name.size; - name.raw = xmalloc_bytes(size); + name.raw = xzalloc_bytes(size); if ( !name.raw ) return -ENOMEM; if ( copy_from_guest(name.raw, op->u.get_next_variable_name.name, -- 2.30.2