1.1 --- a/tools/libxc/xc_core.c	Thu Nov 22 10:33:10 2007 +0000
     1.2 +++ b/tools/libxc/xc_core.c	Thu Nov 22 10:40:45 2007 +0000
     1.3 @@ -107,17 +107,23 @@ xc_core_strtab_get(struct xc_core_strtab
     1.4      uint16_t ret = 0;
     1.5      uint16_t len = strlen(name) + 1;
     1.6  
     1.7 +    if ( strtab->current > UINT16_MAX - len )
     1.8 +    {
     1.9 +        PERROR("too long string table");
    1.10 +        errno = E2BIG;
    1.11 +        return ret;
    1.12 +    }
    1.13 +    
    1.14      if ( strtab->current + len > strtab->max )
    1.15      {
    1.16          char *tmp;
    1.17 -        if ( strtab->max * 2 < strtab->max )
    1.18 +        if ( strtab->max > UINT16_MAX / 2 )
    1.19          {
    1.20              PERROR("too long string table");
    1.21              errno = ENOMEM;
    1.22              return ret;
    1.23          }
    1.24  
    1.25 -
    1.26          tmp = realloc(strtab->strings, strtab->max * 2);
    1.27          if ( tmp == NULL )
    1.28          {
    1.29 @@ -143,8 +149,8 @@ struct xc_core_section_headers {
    1.30  
    1.31      Elf64_Shdr  *shdrs;
    1.32  };
    1.33 -#define SHDR_INIT       16
    1.34 -#define SHDR_INC        4U
    1.35 +#define SHDR_INIT       ((uint16_t)16)
    1.36 +#define SHDR_INC        ((uint16_t)4)
    1.37  
    1.38  static struct xc_core_section_headers*
    1.39  xc_core_shdr_init(void)
    1.40 @@ -180,7 +186,7 @@ xc_core_shdr_get(struct xc_core_section_
    1.41      if ( sheaders->num == sheaders->num_max )
    1.42      {
    1.43          Elf64_Shdr *shdrs;
    1.44 -        if ( sheaders->num_max + SHDR_INC < sheaders->num_max )
    1.45 +        if ( sheaders->num_max > UINT16_MAX - SHDR_INC )
    1.46          {
    1.47              errno = E2BIG;
    1.48              return NULL;

     2.1 --- a/tools/libxc/xc_core_x86.c	Thu Nov 22 10:33:10 2007 +0000
     2.2 +++ b/tools/libxc/xc_core_x86.c	Thu Nov 22 10:40:45 2007 +0000
     2.3 @@ -89,7 +89,7 @@ xc_core_arch_map_p2m(int xc_handle, xc_d
     2.4      }
     2.5  
     2.6      live_p2m_frame_list =
     2.7 -        xc_map_foreign_batch(xc_handle, dom, PROT_READ,
     2.8 +        xc_map_foreign_pages(xc_handle, dom, PROT_READ,
     2.9                               live_p2m_frame_list_list,
    2.10                               P2M_FLL_ENTRIES);
    2.11  
    2.12 @@ -99,7 +99,7 @@ xc_core_arch_map_p2m(int xc_handle, xc_d
    2.13          goto out;
    2.14      }
    2.15  
    2.16 -    *live_p2m = xc_map_foreign_batch(xc_handle, dom, PROT_READ,
    2.17 +    *live_p2m = xc_map_foreign_pages(xc_handle, dom, PROT_READ,
    2.18                                      live_p2m_frame_list,
    2.19                                      P2M_FL_ENTRIES);
    2.20