Index: libvirt-0.7.6/src/xen/xend_internal.c
===================================================================
--- libvirt-0.7.6.orig/src/xen/xend_internal.c
+++ libvirt-0.7.6/src/xen/xend_internal.c
@@ -69,6 +69,7 @@
 #define XEND_CONFIG_MIN_VERS_PVFB_NEWCONF 3
 #endif
 
+#define XEND_RCV_BUF_MAX_LEN 65536
 
 #ifndef PROXY
 static int
@@ -310,17 +311,19 @@ istartswith(const char *haystack, const
  * @xend: the xend connection object
  * @fd: the file descriptor
  * @content: the buffer to store the content
- * @n_content: the size of the buffer
  *
  * Read the HTTP response from a Xen Daemon request.
+ * If the response contains content, memory is allocated to
+ * hold the content.
  *
- * Returns the HTTP return code.
+ * Returns the HTTP return code and content is set to the
+ * allocated memory containing HTTP content.
  */
-static int
-xend_req(virConnectPtr xend, int fd, char *content, size_t n_content)
+static int ATTRIBUTE_NONNULL (3)
+xend_req(virConnectPtr xend, int fd, char **content)
 {
     char buffer[4096];
-    int content_length = -1;
+    int content_length = 0;
     int retcode = 0;
 
     while (sreads(xend, fd, buffer, sizeof(buffer)) > 0) {
@@ -333,19 +336,29 @@ xend_req(virConnectPtr xend, int fd, cha
             retcode = atoi(buffer + 9);
     }
 
-    if (content_length > -1) {
+    if (content_length > 0) {
         ssize_t ret;
 
-        if ((unsigned int) content_length > (n_content + 1))
-            content_length = n_content - 1;
+        if (content_length > XEND_RCV_BUF_MAX_LEN) {
+            virXendError(xend, VIR_ERR_INTERNAL_ERROR,
+                         _("Xend returned HTTP Content-Length of %d, "
+                           "which exceeds maximum of %d"),
+                         content_length,
+                         XEND_RCV_BUF_MAX_LEN);
+            return -1;
+        }
 
-        ret = sread(xend, fd, content, content_length);
-        if (ret < 0)
+        /* Allocate one byte beyond the end of the largest buffer we will read.
+           Combined with the fact that VIR_ALLOC_N zeros the returned buffer,
+           this guarantees that "content" will always be NUL-terminated. */
+        if (VIR_ALLOC_N(*content, content_length + 1) < 0 ) {
+            virReportOOMError(NULL);
             return -1;
+        }
 
-        content[ret] = 0;
-    } else {
-        content[0] = 0;
+        ret = sread(xend, fd, *content, content_length);
+        if (ret < 0)
+            return -1;
     }
 
     return retcode;
@@ -356,15 +369,14 @@ xend_req(virConnectPtr xend, int fd, cha
  * @xend: pointer to the Xen Daemon structure
  * @path: the path used for the HTTP request
  * @content: the buffer to store the content
- * @n_content: the size of the buffer
  *
  * Do an HTTP GET RPC with the Xen Daemon
  *
  * Returns the HTTP return code or -1 in case or error.
  */
-static int
+static int ATTRIBUTE_NONNULL(3)
 xend_get(virConnectPtr xend, const char *path,
-         char *content, size_t n_content)
+         char **content)
 {
     int ret;
     int s = do_connect(xend);
@@ -381,14 +393,14 @@ xend_get(virConnectPtr xend, const char
             "Accept-Encoding: identity\r\n"
             "Content-Type: application/x-www-form-urlencoded\r\n" "\r\n");
 
-    ret = xend_req(xend, s, content, n_content);
+    ret = xend_req(xend, s, content);
     close(s);
 
     if (((ret < 0) || (ret >= 300)) &&
         ((ret != 404) || (!STRPREFIX(path, "/xend/domain/")))) {
         virXendError(xend, VIR_ERR_GET_FAILED,
                      _("%d status from xen daemon: %s:%s"),
-                     ret, path, content);
+                     ret, path, NULLSTR(*content));
     }
 
     return ret;
@@ -400,8 +412,6 @@ xend_get(virConnectPtr xend, const char
  * @xend: pointer to the Xen Daemon structure
  * @path: the path used for the HTTP request
  * @ops: the information sent for the POST
- * @content: the buffer to store the content
- * @n_content: the size of the buffer
  *
  * Do an HTTP POST RPC with the Xen Daemon, this usually makes changes at the
  * Xen level.
@@ -409,10 +419,10 @@ xend_get(virConnectPtr xend, const char
  * Returns the HTTP return code or -1 in case or error.
  */
 static int
-xend_post(virConnectPtr xend, const char *path, const char *ops,
-          char *content, size_t n_content)
+xend_post(virConnectPtr xend, const char *path, const char *ops)
 {
     char buffer[100];
+    char *err_buf = NULL;
     int ret;
     int s = do_connect(xend);
 
@@ -433,26 +443,29 @@ xend_post(virConnectPtr xend, const char
     swrites(xend, s, "\r\n\r\n");
     swrites(xend, s, ops);
 
-    ret = xend_req(xend, s, content, n_content);
+    ret = xend_req(xend, s, &err_buf);
     close(s);
 
     if ((ret < 0) || (ret >= 300)) {
         virXendError(xend, VIR_ERR_POST_FAILED,
-                     _("xend_post: error from xen daemon: %s"), content);
-    } else if ((ret == 202) && (strstr(content, "failed") != NULL)) {
+                     _("xend_post: error from xen daemon: %s"), err_buf);
+    } else if ((ret == 202) && err_buf &&
+               (strstr(err_buf, "failed") != NULL)) {
         virXendError(xend, VIR_ERR_POST_FAILED,
-                     _("xend_post: error from xen daemon: %s"), content);
+                     _("xend_post: error from xen daemon: %s"), err_buf);
         ret = -1;
-    } else if (((ret >= 200) && (ret <= 202)) && (strstr(content, "xend.err") != NULL)) {
+    } else if (((ret >= 200) && (ret <= 202)) && err_buf &&
+               (strstr(err_buf, "xend.err") != NULL)) {
         /* This is to catch case of things like 'virsh dump Domain-0 foo'
          * which returns a success code, but the word 'xend.err'
          * in body to indicate error :-(
          */
         virXendError(xend, VIR_ERR_POST_FAILED,
-                     _("xend_post: error from xen daemon: %s"), content);
+                     _("xend_post: error from xen daemon: %s"), err_buf);
         ret = -1;
     }
 
+    VIR_FREE(err_buf);
     return ret;
 }
 #endif /* ! PROXY */
@@ -496,8 +509,6 @@ http2unix(virConnectPtr xend, int ret)
  * xend_op_ext:
  * @xend: pointer to the Xen Daemon structure
  * @path: path for the object
- * @error: buffer for the error output
- * @n_error: size of @error
  * @key: the key for the operation
  * @ap: input values to pass to the operation
  *
@@ -506,8 +517,7 @@ http2unix(virConnectPtr xend, int ret)
  * Returns 0 in case of success, -1 in case of failure.
  */
 static int
-xend_op_ext(virConnectPtr xend, const char *path, char *error,
-            size_t n_error, const char *key, va_list ap)
+xend_op_ext(virConnectPtr xend, const char *path, const char *key, va_list ap)
 {
     const char *k = key, *v;
     virBuffer buf = VIR_BUFFER_INITIALIZER;
@@ -533,7 +543,7 @@ xend_op_ext(virConnectPtr xend, const ch
     }
 
     content = virBufferContentAndReset(&buf);
-    ret = http2unix(xend, xend_post(xend, path, content, error, n_error));
+    ret = http2unix(xend, xend_post(xend, path, content));
     VIR_FREE(content);
 
     return ret;
@@ -544,8 +554,6 @@ xend_op_ext(virConnectPtr xend, const ch
  * xend_op:
  * @xend: pointer to the Xen Daemon structure
  * @name: the domain name target of this operation
- * @error: buffer for the error output
- * @n_error: size of @error
  * @key: the key for the operation
  * @ap: input values to pass to the operation
  * @...: input values to pass to the operation
@@ -559,14 +567,13 @@ static int ATTRIBUTE_SENTINEL
 xend_op(virConnectPtr xend, const char *name, const char *key, ...)
 {
     char buffer[1024];
-    char error[1024];
     va_list ap;
     int ret;
 
     snprintf(buffer, sizeof(buffer), "/xend/domain/%s", name);
 
     va_start(ap, key);
-    ret = xend_op_ext(xend, buffer, error, sizeof(error), key, ap);
+    ret = xend_op_ext(xend, buffer, key, ap);
     va_end(ap);
 
     return ret;
@@ -590,21 +597,29 @@ static struct sexpr *sexpr_get(virConnec
 static struct sexpr *
 sexpr_get(virConnectPtr xend, const char *fmt, ...)
 {
-    char buffer[4096];
+    char *buffer = NULL;
     char path[1024];
     va_list ap;
     int ret;
+    struct sexpr *res = NULL;
 
     va_start(ap, fmt);
     vsnprintf(path, sizeof(path), fmt, ap);
     va_end(ap);
 
-    ret = xend_get(xend, path, buffer, sizeof(buffer));
+    ret = xend_get(xend, path, &buffer);
     ret = http2unix(xend ,ret);
     if (ret == -1)
-        return NULL;
+        goto cleanup;
+
+    if (buffer == NULL)
+        goto cleanup;
+
+    res = string2sexpr(buffer);
 
-    return string2sexpr(buffer);
+cleanup:
+    VIR_FREE(buffer);
+    return res;
 }
 
 /**
