| Message ID | 20250108-xen-v1-1-3f95cd358eed@daynix.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | hw/xen: Check if len is 0 before memcpy() | expand |
On 8/1/25 12:31, Akihiko Odaki wrote: > data->data can be NULL when len is 0. Strictly speaking, the behavior > of memcpy() in such a scenario is undefined so UBSan complaints. > > Satisfy UBSan by checking if len is 0 before memcpy(). > > Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> > --- > hw/i386/kvm/xen_xenstore.c | 4 ++++ > 1 file changed, 4 insertions(+) Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
On Wed, 2025-01-08 at 20:31 +0900, Akihiko Odaki wrote: > data->data can be NULL when len is 0. Strictly speaking, the behavior > of memcpy() in such a scenario is undefined so UBSan complaints. > > Satisfy UBSan by checking if len is 0 before memcpy(). > > Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Reviewed-by: David Woodhouse <dwmw@amazon.co.uk> Thanks. > --- > hw/i386/kvm/xen_xenstore.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/hw/i386/kvm/xen_xenstore.c b/hw/i386/kvm/xen_xenstore.c > index 59691056670e..17802aa33d20 100644 > --- a/hw/i386/kvm/xen_xenstore.c > +++ b/hw/i386/kvm/xen_xenstore.c > @@ -532,6 +532,10 @@ static void xs_read(XenXenstoreState *s, > unsigned int req_id, > return; > } > > + if (!len) { > + return; > + } > + > memcpy(&rsp_data[rsp->len], data->data, len); > rsp->len += len; > } > > --- > base-commit: 38d0939b86e2eef6f6a622c6f1f7befda0146595 > change-id: 20241227-xen-fb5a15cc0ca7 > > Best regards,
diff --git a/hw/i386/kvm/xen_xenstore.c b/hw/i386/kvm/xen_xenstore.c index 59691056670e..17802aa33d20 100644 --- a/hw/i386/kvm/xen_xenstore.c +++ b/hw/i386/kvm/xen_xenstore.c @@ -532,6 +532,10 @@ static void xs_read(XenXenstoreState *s, unsigned int req_id, return; } + if (!len) { + return; + } + memcpy(&rsp_data[rsp->len], data->data, len); rsp->len += len; }
data->data can be NULL when len is 0. Strictly speaking, the behavior of memcpy() in such a scenario is undefined so UBSan complaints. Satisfy UBSan by checking if len is 0 before memcpy(). Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> --- hw/i386/kvm/xen_xenstore.c | 4 ++++ 1 file changed, 4 insertions(+) --- base-commit: 38d0939b86e2eef6f6a622c6f1f7befda0146595 change-id: 20241227-xen-fb5a15cc0ca7 Best regards,