xapi-project/xen-api — pull request #1516 by simonjbeaumont (2013-10-17 11:59:33+00:00)
Title: CA-108913: Initialise parameters on the stack.

These four values are passed by pointer into libxc, and are only filled in if
relevent. The bindings then convert the uninitialised variable into an
integer and pass it to xenops, which writes it to xenstore.

xenconsoled sees the write and, if the junk value looks like a valid guest
gfn, maps it and starts the console connect protocol by writing into it.

This causes HVM domain corruption if the junk value happens to be in the range
1 to max_pages.

Signed-off-by: Andrew Cooper