From: "Charles Coffing" <ccoffing@novell.com>
Subject: [PATCH] wild pointer in xenstat.c
Date: Mon, 31 Oct 2005 13:18:02 -0700
Message-ID: <4366192E.D169.003C.0@novell.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xensource.com>
Content-Disposition: inline
List-Unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: xen-devel <xen-devel@lists.xensource.com>
List-Id: xen-devel@lists.xenproject.org

There is an error in xenstat, such that a wild pointer is being
dereferenced and written to.

Signed-off-by:  Charles Coffing <ccoffing@novell.com>


--- xen-unstable.orig/tools/xenstat/libxenstat/src/xenstat.c
+++ xen-unstable/tools/xenstat/libxenstat/src/xenstat.c
@@ -704,7 +704,7 @@ static char *xenstat_get_domain_name(xen
 {
        char path[80];
        char *name;
-       unsigned int *len;
+       unsigned int len;
        struct xs_transaction_handle *xstranshandle;

        snprintf(path, sizeof(path),"/local/domain/%i/name",
domain_id);
@@ -715,7 +715,7 @@ static char *xenstat_get_domain_name(xen
                exit(1); /* Change this */
        }

-       name = (char *) xs_read(handle->xshandle, xstranshandle, path,
len);
+       name = (char *) xs_read(handle->xshandle, xstranshandle, path,
&len);

        xs_transaction_end(handle->xshandle, xstranshandle, false);