Wed Sep 12 16:35:00 BST 2007 Richard W.M. Jones <rjones@redhat.com>

        * src/xend_internal.c, src/xml.c, src/xml.h: Properly check buffer
        size in virDomainXMLDevID (Hugh Brock).

ChangeLog

+Wed Sep 12 16:35:00 BST 2007 Richard W.M. Jones <rjones@redhat.com>
+
+	* src/xend_internal.c, src/xml.c, src/xml.h: Properly check buffer
+	size in virDomainXMLDevID (Hugh Brock).
+
 Wed Sep 12 11:30:00 BST 2007 Richard W.M. Jones <rjones@redhat.com>
 
 	* src/xend_internal.c, src/xen_unified.c: Removed an annoying

src/xend_internal.c

@@ -3116,7 +3116,7 @@ xenDaemonAttachDevice(virDomainPtr domain, char *xml)
         *(conf + strlen(conf) -1) = 0; /* suppress final ) */
     }
     else conf = sexpr;
-    if (virDomainXMLDevID(domain, xml, class, ref)) {
+    if (virDomainXMLDevID(domain, xml, class, ref, sizeof(ref))) {
         /* device doesn't exist, define it */
         ret = xend_op(domain->conn, domain->name, "op", "device_create",
                       "config", conf, NULL);
@@ -3149,7 +3149,7 @@ xenDaemonDetachDevice(virDomainPtr domain, char *xml)
 	             __FUNCTION__);
         return (-1);
     }
-    if (virDomainXMLDevID(domain, xml, class, ref))
+    if (virDomainXMLDevID(domain, xml, class, ref, sizeof(ref)))
         return (-1);
     return(xend_op(domain->conn, domain->name, "op", "device_destroy",
         "type", class, "dev", ref, NULL));

src/xml.c

@@ -1385,7 +1385,7 @@ virParseXMLDevice(virConnectPtr conn, char *xmldesc, int hvm, int xendConfigVers
  * Returns 0 in case of success, -1 in case of failure.
  */
 int
-virDomainXMLDevID(virDomainPtr domain, char *xmldesc, char *class, char *ref)
+virDomainXMLDevID(virDomainPtr domain, char *xmldesc, char *class, char *ref, int ref_len)
 {
     xmlDocPtr xml = NULL;
     xmlNodePtr node, cur;
@@ -1413,7 +1413,8 @@ virDomainXMLDevID(virDomainPtr domain, char *xmldesc, char *class, char *ref)
             attr = xmlGetProp(cur, BAD_CAST "dev");
             if (attr == NULL)
                 goto error;
-            strcpy(ref, (char *)attr);
+            strncpy(ref, (char *)attr, ref_len);
+               ref[ref_len -1] = '\0';
             goto cleanup;
         }
     }
@@ -1430,8 +1431,9 @@ virDomainXMLDevID(virDomainPtr domain, char *xmldesc, char *class, char *ref)
             xref = xenStoreDomainGetNetworkID(domain->conn, domain->id,
                                               (char *) attr);
             if (xref != NULL) {
-                strcpy(ref, xref);
+                strncpy(ref, xref, ref_len);
                 free(xref);
+                ref[ref_len - 1] = '\0';
                 goto cleanup;
             }
 #else /* without xen */

src/xml.h

@@ -33,7 +33,7 @@ int		virXPathNodeSet	(const char *xpath,
 
 char *virDomainParseXMLDesc(virConnectPtr conn, const char *xmldesc, char **name, int xendConfigVersion);
 char *virParseXMLDevice(virConnectPtr conn, char *xmldesc, int hvm, int xendConfigVersion);
-int virDomainXMLDevID(virDomainPtr domain, char *xmldesc, char *class, char *ref);
+  int virDomainXMLDevID(virDomainPtr domain, char *xmldesc, char *class, char *ref, int ref_len);
 
 #ifdef __cplusplus
 }