{"push_id":741479907,"size":2,"distinct_size":2,"ref":"refs/heads/staging-4.5","head":"6040b3aeb32b4bce2d9958ecbcbd020c46c35d61","before":"07249f4fb80b222fc05a5a1e26d23fe50655e562","commits":[{"sha":"7ac1a262132a3c14df4147ed98bc04d12f2bb16f","author":{"email":"b803dfa457ee7108535c9a9d11bc20116c6b9c4f@eu.citrix.com","name":"Ian Jackson"},"message":"QEMU_TAG update","distinct":true,"url":"https://api.github.com/repos/mirage/xen/commits/7ac1a262132a3c14df4147ed98bc04d12f2bb16f"},{"sha":"6040b3aeb32b4bce2d9958ecbcbd020c46c35d61","author":{"email":"b803dfa457ee7108535c9a9d11bc20116c6b9c4f@eu.citrix.com","name":"Ian Jackson"},"message":"xl: Sane handling of extra config file arguments\n\nVarious xl sub-commands take additional parameters containing = as\nadditional config fragments.\n\nThe handling of these config fragments has a number of bugs:\n\n 1. Use of a static 1024-byte buffer.  (If truncation would occur,\n    with semi-trusted input, a security risk arises due to quotes\n    being lost.)\n\n 2. Mishandling of the return value from snprintf, so that if\n    truncation occurs, the to-write pointer is updated with the\n    wanted-to-write length, resulting in stack corruption.  (This is\n    XSA-137.)\n\n 3. Clone-and-hack of the code for constructing the appended\n    config file.\n\nThese are fixed here, by introducing a new function\n`string_realloc_append' and using it everywhere.  The `extra_info'\nbuffers are replaced by pointers, which start off NULL and are\nexplicitly freed on all return paths.\n\nThe separate variable which will become dom_info.extra_config is\nabolished (which involves moving the clearing of dom_info).\n\nAdditional bugs I observe, not fixed here:\n\n 4. The functions which now call string_realloc_append use ad-hoc\n    error returns, with multiple calls to `return'.  This currently\n    necessitates multiple new calls to `free'.\n\n 5. Many of the paths in xl call exit(-rc) where rc is a libxl status\n    code.  This is a ridiculous exit status `convention'.\n\n 6. The loops for handling extra config data are clone-and-hacks.\n\n 7. Once the extra config buffer is accumulated, it must be combined\n    with the appropriate main config file.  The code to do this\n    combining is clone-and-hacked too.\n\nSigned-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>\nTested-by: Ian Jackson <Ian.Jackson@eu.citrix.com>\nAcked-by: Ian Campbell <ian,campbell@citrix.com>\n(cherry picked from commit dd84604f35bd3855c57146eb8fe53924c10d3963)","distinct":true,"url":"https://api.github.com/repos/mirage/xen/commits/6040b3aeb32b4bce2d9958ecbcbd020c46c35d61"}]}