From: Roger Pau Monne <roger.pau@citrix.com>
Date: Thu, 24 Apr 2025 10:23:14 +0000 (+0200)
Subject: xen: fix buffer over-read in bitmap_to_xenctl_bitmap()
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=cba90ddee086e8d26063d8de90e40a098395e99b;p=xen.git

xen: fix buffer over-read in bitmap_to_xenctl_bitmap()

There's an off-by-one when calculating the last byte in the input array to
bitmap_to_xenctl_bitmap(), which leads to bitmaps with sizes multiple of 8
to over-read and incorrectly use a byte past the end of the array.

Fixes: 288c4641c80d ('xen: simplify bitmap_to_xenctl_bitmap for little endian')
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
---

diff --git a/xen/common/bitmap.c b/xen/common/bitmap.c
index bf1a7fd91e..4f96fda389 100644
--- a/xen/common/bitmap.c
+++ b/xen/common/bitmap.c
@@ -369,6 +369,9 @@ int bitmap_to_xenctl_bitmap(struct xenctl_bitmap *xenctl_bitmap,
     const uint8_t *bytemap;
     uint8_t last, *buf = NULL;
 
+    if ( !nbits )
+        return 0;
+
     if ( !IS_ENABLED(LITTLE_ENDIAN) )
     {
         buf = xmalloc_array(uint8_t, xen_bytes);
@@ -396,7 +399,7 @@ int bitmap_to_xenctl_bitmap(struct xenctl_bitmap *xenctl_bitmap,
      * their loops to 8 bits. Ensure we clear those left over bits so as to
      * prevent surprises.
      */
-    last = bytemap[nbits / 8];
+    last = bytemap[(nbits - 1) / 8];
     if ( nbits % 8 )
         last &= (1U << (nbits % 8)) - 1;