xapi-project/xen-api — pull request #1892 by robhoes (2014-08-19 13:29:51+00:00)
Title: Safeguard against malicious suspend images

During VM.resume, as part of Domain.restore in Xenopsd, when a Qemu record in
the suspend image is detected, the header is parsed (with a length) and then
this number of bytes is written out to a file in dom0's filesystem to be passed
to Qemu.

This patch:
* Catches any error that may occur when writing the file for qemu.
* Puts some sanity checks when parsing the length in the Qemu record header.
This should be large enough that we won't need to change it if/when we
upgrade Qemu to future versions but small enough to avoid a DoS. Qemu save
records are currently around 7-8k. We have chosen to read a max of 1M and
raise an exception if we parse a suspend image that claims to have a Qemu
record bigger than this.

Signed-off-by: Rob Hoes