1.1 --- a/tools/libxc/xc_linux_build.c	Wed May 17 23:15:36 2006 +0100
     1.2 +++ b/tools/libxc/xc_linux_build.c	Wed May 17 23:19:18 2006 +0100
     1.3 @@ -794,9 +794,11 @@ static int setup_guest(int xc_handle,
     1.4          goto error_out;
     1.5      }
     1.6  
     1.7 -    (load_funcs.loadimage)(image, image_size,
     1.8 +    rc = (load_funcs.loadimage)(image, image_size,
     1.9                             xc_handle, dom, page_array,
    1.10                             &dsi);
    1.11 +    if ( rc != 0 )
    1.12 +        goto error_out;
    1.13  
    1.14      if ( load_initrd(xc_handle, dom, initrd,
    1.15                       vinitrd_start - dsi.v_start, page_array) )

     2.1 --- a/tools/libxc/xc_load_elf.c	Wed May 17 23:15:36 2006 +0100
     2.2 +++ b/tools/libxc/xc_load_elf.c	Wed May 17 23:19:18 2006 +0100
     2.3 @@ -151,6 +151,13 @@ static int parseelfimage(const char *ima
     2.4      virt_base = 0;
     2.5      if ( (p = strstr(guestinfo, "VIRT_BASE=")) != NULL )
     2.6          virt_base = strtoul(p+10, &p, 0);
     2.7 +
     2.8 +    if ( virt_base == 0 )
     2.9 +    {
    2.10 +        ERROR("Malformed ELF image. VIRT_BASE in '__xen_guest' section set incorrectly");
    2.11 +        return -EINVAL;
    2.12 +    }
    2.13 +
    2.14      dsi->elf_paddr_offset = virt_base;
    2.15      if ( (p = strstr(guestinfo, "ELF_PADDR_OFFSET=")) != NULL )
    2.16          dsi->elf_paddr_offset = strtoul(p+17, &p, 0);
    2.17 @@ -219,6 +226,8 @@ loadelfimage(
    2.18              pa = (phdr->p_paddr + done) - dsi->elf_paddr_offset;
    2.19              va = xc_map_foreign_range(
    2.20                  xch, dom, PAGE_SIZE, PROT_WRITE, parray[pa>>PAGE_SHIFT]);
    2.21 +            if ( va == NULL )
    2.22 +                return -1;
    2.23              chunksz = phdr->p_filesz - done;
    2.24              if ( chunksz > (PAGE_SIZE - (pa & (PAGE_SIZE-1))) )
    2.25                  chunksz = PAGE_SIZE - (pa & (PAGE_SIZE-1));
    2.26 @@ -232,6 +241,8 @@ loadelfimage(
    2.27              pa = (phdr->p_paddr + done) - dsi->elf_paddr_offset;
    2.28              va = xc_map_foreign_range(
    2.29                  xch, dom, PAGE_SIZE, PROT_WRITE, parray[pa>>PAGE_SHIFT]);
    2.30 +            if ( va == NULL )
    2.31 +                return -1;
    2.32              chunksz = phdr->p_memsz - done;
    2.33              if ( chunksz > (PAGE_SIZE - (pa & (PAGE_SIZE-1))) )
    2.34                  chunksz = PAGE_SIZE - (pa & (PAGE_SIZE-1));