>>> On 03.05.17 at 11:21, <t...@xen.org> wrote:
> At 10:15 +0100 on 03 May (1493806508), Tim Deegan wrote:
>> At 00:31 -0600 on 03 May (1493771502), Jan Beulich wrote:
>> > + else if ( ctxt.cur > sizeof(*desc) )
>> > {
>> > uint32_t off;
>> > - const struct hvm_save_descriptor *desc;
>> >
>> > - rv = -ENOENT;
>> > for ( off = 0; off < (ctxt.cur - sizeof(*desc)); off +=
>> > desc->length )
>
> It occurs to me that as well as underflowing, this test is off by one.
> It ought to be "off + sizeof(*desc) <= ctxt.cur" to allow for a
> zero-length record. AFAIK we don't actually have any of those, so
> it's academic, but we might want to represent the presence of some
> feature without having any feature-specific state to save.
Good point; I already have two follow-up patches, one of which I
think this adjustment would easily fit into.
Jan
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
