From cba90ddee086e8d26063d8de90e40a098395e99b Mon Sep 17 00:00:00 2001 From: Roger Pau Monne Date: Thu, 24 Apr 2025 12:23:14 +0200 Subject: [PATCH] xen: fix buffer over-read in bitmap_to_xenctl_bitmap() MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit There's an off-by-one when calculating the last byte in the input array to bitmap_to_xenctl_bitmap(), which leads to bitmaps with sizes multiple of 8 to over-read and incorrectly use a byte past the end of the array. Fixes: 288c4641c80d ('xen: simplify bitmap_to_xenctl_bitmap for little endian') Signed-off-by: Roger Pau Monné Reviewed-by: Andrew Cooper --- xen/common/bitmap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xen/common/bitmap.c b/xen/common/bitmap.c index bf1a7fd91e..4f96fda389 100644 --- a/xen/common/bitmap.c +++ b/xen/common/bitmap.c @@ -369,6 +369,9 @@ int bitmap_to_xenctl_bitmap(struct xenctl_bitmap *xenctl_bitmap, const uint8_t *bytemap; uint8_t last, *buf = NULL; + if ( !nbits ) + return 0; + if ( !IS_ENABLED(LITTLE_ENDIAN) ) { buf = xmalloc_array(uint8_t, xen_bytes); @@ -396,7 +399,7 @@ int bitmap_to_xenctl_bitmap(struct xenctl_bitmap *xenctl_bitmap, * their loops to 8 bits. Ensure we clear those left over bits so as to * prevent surprises. */ - last = bytemap[nbits / 8]; + last = bytemap[(nbits - 1) / 8]; if ( nbits % 8 ) last &= (1U << (nbits % 8)) - 1; -- 2.39.5