Out of bound check in bind_virq (trivial)

Here is a trivial patch that adds a domain->vcpu array out of bound check (without it I managed to take whole Xen down by trying to run a buggy domain).

Cheers
Gregor

# HG changeset patch
# User [email protected]
# Node ID 0c6432737d58f7276a3f60322123f3d967b23f91 # Parent 76a7a7aa27e40022fbfeacdd8d6ed9395e875894 Added missing array out of bound check for d->vcpu.

diff -r 76a7a7aa27e4 -r 0c6432737d58 xen/common/event_channel.c
@@ -269,7 +269,8 @@
     if ( virq >= ARRAY_SIZE(v->virq_to_evtchn) )
         return -EINVAL;
 
-    if ( (v = d->vcpu[bind->vcpu]) == NULL )
+    if ( bind->vcpu >= ARRAY_SIZE(d->vcpu) || 
+            (v = d->vcpu[bind->vcpu]) == NULL )
         return -ENOENT;
 
     spin_lock(&d->evtchn_lock);

_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xensource.com/xen-devel