From 8348cc77e6744a377ffd52c914f08e0dcc4074b6 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Thu, 5 Mar 2020 11:33:59 +0100 Subject: [PATCH] EFI: don't leak heap contents through XEN_EFI_get_next_variable_name Commit 1f4eb9d27d0e ("EFI: fix getting EFI variable list on some systems") switched to using the caller provided size for the copy-out without making sure the copied buffer is properly scrubbed. Reported-by: Ilja Van Sprundel Signed-off-by: Jan Beulich Reviewed-by: George Dunlap master commit: 4783ee894f6bfb0f4deec9f1fe8e7faceafaa1a2 master date: 2020-02-06 09:52:33 +0100 --- xen/common/efi/runtime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/common/efi/runtime.c b/xen/common/efi/runtime.c index 2427d22ab3..06c405700b 100644 --- a/xen/common/efi/runtime.c +++ b/xen/common/efi/runtime.c @@ -576,7 +576,7 @@ int efi_runtime_call(struct xenpf_efi_runtime_call *op) return -EINVAL; size = op->u.get_next_variable_name.size; - name.raw = xmalloc_bytes(size); + name.raw = xzalloc_bytes(size); if ( !name.raw ) return -ENOMEM; if ( copy_from_guest(name.raw, op->u.get_next_variable_name.name, -- 2.30.2