While doing the XSA-492 work I further noticed an inefficiency with
safe_copy_string_from_guest(). All callers pass PAGE_SIZE as the maximum
buffer size, and with the function adding 1 to append a nul terminator
the resulting allocations are all order-1 ones. Which we'd better avoid.
Require respective callers of hypercalls to nul-terminate the strings
within the buffer supplied. While an ABI change, I think it's an
acceptable one.

1: libxc: adjust string size calculations in xc_{,de,test_}assign_dt_device()
2: libxc: drop size parameter from xc_flask_context_to_sid()
3: libxc: adjust string size calculations in xc_flask_{getbool_byname,setbool}()
4: lib: make safe_copy_string_from_guest() validate input

Jan

On 16/06/2026 9:59 am, Jan Beulich wrote:
> While doing the XSA-492 work I further noticed an inefficiency with
> safe_copy_string_from_guest(). All callers pass PAGE_SIZE as the maximum
> buffer size, and with the function adding 1 to append a nul terminator
> the resulting allocations are all order-1 ones. Which we'd better avoid.
> Require respective callers of hypercalls to nul-terminate the strings
> within the buffer supplied. While an ABI change, I think it's an
> acceptable one.

FWIW, I think this is an acceptable ABI change too.  The chances of
there being any users outside of libxc/libxl is slim.

~Andrew