Re: [libvirt] [PATCH 01/12] Add bounds checking on virDomainMigrate*Params RPC calls (CVE-2013-4292)

2013-08-29 Thread Daniel P. Berrange 
On Thu, Aug 29, 2013 at 02:58:44PM +0200, Michal Privoznik wrote:
> On 29.08.2013 14:55, Daniel P. Berrange wrote:
> > On Thu, Aug 29, 2013 at 02:34:15PM +0200, Michal Privoznik wrote:
> >> On 29.08.2013 12:49, Daniel P. Berrange wrote:
> >>> From: "Daniel P. Berrange" 
> >>>
> >>> The parameters for the virDomainMigrate*Params RPC calls were
> >>> not bounds checks, meaning a malicious client can cause libvirtd
> >>> to consume arbitrary memory
> >>>
> >>> This issue was introduced in the 1.1.0 release of libvirt
> >>>
> >>> Signed-off-by: Daniel P. Berrange 
> >>> ---
> >>>  daemon/remote.c  | 42 
> >>> ++
> >>>  src/remote/remote_driver.c   | 42 
> >>> ++
> >>>  src/remote/remote_protocol.x | 15 +--
> >>>  3 files changed, 93 insertions(+), 6 deletions(-)
> >>>
> >>> diff --git a/daemon/remote.c b/daemon/remote.c
> >>> index 03d5557..a11ba94 100644
> >>> --- a/daemon/remote.c
> >>> +++ b/daemon/remote.c
> >>> @@ -4620,6 +4620,13 @@ remoteDispatchDomainMigrateBegin3Params(
> >>>  goto cleanup;
> >>>  }
> >>>  
> >>> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> >>> +virReportError(VIR_ERR_RPC,
> >>> +   _("Too many migration parameters '%d' for limit 
> >>> '%d'"),
> >>> +   args->params.params_len, 
> >>> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> >>> +goto cleanup;
> >>> +}
> >>> +
> >>>  if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
> >>>  goto cleanup;
> >>>  
> >>> @@ -4671,6 +4678,13 @@ remoteDispatchDomainMigratePrepare3Params(
> >>>  goto cleanup;
> >>>  }
> >>>  
> >>> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> >>> +virReportError(VIR_ERR_RPC,
> >>> +   _("Too many migration parameters '%d' for limit 
> >>> '%d'"),
> >>> +   args->params.params_len, 
> >>> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> >>> +goto cleanup;
> >>> +}
> >>> +
> >>>  if (!(params = 
> >>> remoteDeserializeTypedParameters(args->params.params_val,
> >>>  
> >>> args->params.params_len,
> >>>  0, &nparams)))
> >>> @@ -4726,6 +4740,13 @@ remoteDispatchDomainMigratePrepareTunnel3Params(
> >>>  goto cleanup;
> >>>  }
> >>>  
> >>> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> >>> +virReportError(VIR_ERR_RPC,
> >>> +   _("Too many migration parameters '%d' for limit 
> >>> '%d'"),
> >>> +   args->params.params_len, 
> >>> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> >>> +goto cleanup;
> >>> +}
> >>> +
> >>>  if (!(params = 
> >>> remoteDeserializeTypedParameters(args->params.params_val,
> >>>  
> >>> args->params.params_len,
> >>>  0, &nparams)))
> >>> @@ -4790,6 +4811,13 @@ remoteDispatchDomainMigratePerform3Params(
> >>>  goto cleanup;
> >>>  }
> >>>  
> >>> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> >>> +virReportError(VIR_ERR_RPC,
> >>> +   _("Too many migration parameters '%d' for limit 
> >>> '%d'"),
> >>> +   args->params.params_len, 
> >>> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> >>> +goto cleanup;
> >>> +}
> >>> +
> >>>  if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
> >>>  goto cleanup;
> >>>  
> >>> @@ -4845,6 +4873,13 @@ remoteDispatchDomainMigrateFinish3Params(
> >>>  goto cleanup;
> >>>  }
> >>>  
> >>> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> >>> +virReportError(VIR_ERR_RPC,
> >>> +   _("Too many migration parameters '%d' for limit 
> >>> '%d'"),
> >>> +   args->params.params_len, 
> >>> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> >>> +goto cleanup;
> >>> +}
> >>> +
> >>>  if (!(params = 
> >>> remoteDeserializeTypedParameters(args->params.params_val,
> >>>  
> >>> args->params.params_len,
> >>>  0, &nparams)))
> >>> @@ -4897,6 +4932,13 @@ remoteDispatchDomainMigrateConfirm3Params(
> >>>  goto cleanup;
> >>>  }
> >>>  
> >>> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> >>> +virReportError(VIR_ERR_RPC,
> >>> +   _("Too many migration parameters '%d' for limit 
> >>> '%d'"),
> >>> +   args->params.params_len, 
> >>> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> >>> +goto cleanup;
> >>> +}
> >>> +
> >>>  if (!(dom = get_nonnull_domain(priv->conn,

Re: [libvirt] [PATCH 01/12] Add bounds checking on virDomainMigrate*Params RPC calls (CVE-2013-4292)

2013-08-29 Thread Michal Privoznik 
On 29.08.2013 14:55, Daniel P. Berrange wrote:
> On Thu, Aug 29, 2013 at 02:34:15PM +0200, Michal Privoznik wrote:
>> On 29.08.2013 12:49, Daniel P. Berrange wrote:
>>> From: "Daniel P. Berrange" 
>>>
>>> The parameters for the virDomainMigrate*Params RPC calls were
>>> not bounds checks, meaning a malicious client can cause libvirtd
>>> to consume arbitrary memory
>>>
>>> This issue was introduced in the 1.1.0 release of libvirt
>>>
>>> Signed-off-by: Daniel P. Berrange 
>>> ---
>>>  daemon/remote.c  | 42 
>>> ++
>>>  src/remote/remote_driver.c   | 42 
>>> ++
>>>  src/remote/remote_protocol.x | 15 +--
>>>  3 files changed, 93 insertions(+), 6 deletions(-)
>>>
>>> diff --git a/daemon/remote.c b/daemon/remote.c
>>> index 03d5557..a11ba94 100644
>>> --- a/daemon/remote.c
>>> +++ b/daemon/remote.c
>>> @@ -4620,6 +4620,13 @@ remoteDispatchDomainMigrateBegin3Params(
>>>  goto cleanup;
>>>  }
>>>  
>>> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
>>> +virReportError(VIR_ERR_RPC,
>>> +   _("Too many migration parameters '%d' for limit 
>>> '%d'"),
>>> +   args->params.params_len, 
>>> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
>>> +goto cleanup;
>>> +}
>>> +
>>>  if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
>>>  goto cleanup;
>>>  
>>> @@ -4671,6 +4678,13 @@ remoteDispatchDomainMigratePrepare3Params(
>>>  goto cleanup;
>>>  }
>>>  
>>> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
>>> +virReportError(VIR_ERR_RPC,
>>> +   _("Too many migration parameters '%d' for limit 
>>> '%d'"),
>>> +   args->params.params_len, 
>>> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
>>> +goto cleanup;
>>> +}
>>> +
>>>  if (!(params = 
>>> remoteDeserializeTypedParameters(args->params.params_val,
>>>  
>>> args->params.params_len,
>>>  0, &nparams)))
>>> @@ -4726,6 +4740,13 @@ remoteDispatchDomainMigratePrepareTunnel3Params(
>>>  goto cleanup;
>>>  }
>>>  
>>> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
>>> +virReportError(VIR_ERR_RPC,
>>> +   _("Too many migration parameters '%d' for limit 
>>> '%d'"),
>>> +   args->params.params_len, 
>>> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
>>> +goto cleanup;
>>> +}
>>> +
>>>  if (!(params = 
>>> remoteDeserializeTypedParameters(args->params.params_val,
>>>  
>>> args->params.params_len,
>>>  0, &nparams)))
>>> @@ -4790,6 +4811,13 @@ remoteDispatchDomainMigratePerform3Params(
>>>  goto cleanup;
>>>  }
>>>  
>>> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
>>> +virReportError(VIR_ERR_RPC,
>>> +   _("Too many migration parameters '%d' for limit 
>>> '%d'"),
>>> +   args->params.params_len, 
>>> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
>>> +goto cleanup;
>>> +}
>>> +
>>>  if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
>>>  goto cleanup;
>>>  
>>> @@ -4845,6 +4873,13 @@ remoteDispatchDomainMigrateFinish3Params(
>>>  goto cleanup;
>>>  }
>>>  
>>> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
>>> +virReportError(VIR_ERR_RPC,
>>> +   _("Too many migration parameters '%d' for limit 
>>> '%d'"),
>>> +   args->params.params_len, 
>>> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
>>> +goto cleanup;
>>> +}
>>> +
>>>  if (!(params = 
>>> remoteDeserializeTypedParameters(args->params.params_val,
>>>  
>>> args->params.params_len,
>>>  0, &nparams)))
>>> @@ -4897,6 +4932,13 @@ remoteDispatchDomainMigrateConfirm3Params(
>>>  goto cleanup;
>>>  }
>>>  
>>> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
>>> +virReportError(VIR_ERR_RPC,
>>> +   _("Too many migration parameters '%d' for limit 
>>> '%d'"),
>>> +   args->params.params_len, 
>>> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
>>> +goto cleanup;
>>> +}
>>> +
>>>  if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
>>>  goto cleanup;
>>
>> While the above is correct as it fixes the libvirtd (sanitizes input).
>> However, I don't think we need the following, esp. if we ever change the
>> limit. The older client won't be able to pass more parameters whereas it
>> currently can.
> 
> As mentioned in the

Re: [libvirt] [PATCH 01/12] Add bounds checking on virDomainMigrate*Params RPC calls (CVE-2013-4292)

2013-08-29 Thread Daniel P. Berrange 
On Thu, Aug 29, 2013 at 02:34:15PM +0200, Michal Privoznik wrote:
> On 29.08.2013 12:49, Daniel P. Berrange wrote:
> > From: "Daniel P. Berrange" 
> > 
> > The parameters for the virDomainMigrate*Params RPC calls were
> > not bounds checks, meaning a malicious client can cause libvirtd
> > to consume arbitrary memory
> > 
> > This issue was introduced in the 1.1.0 release of libvirt
> > 
> > Signed-off-by: Daniel P. Berrange 
> > ---
> >  daemon/remote.c  | 42 
> > ++
> >  src/remote/remote_driver.c   | 42 
> > ++
> >  src/remote/remote_protocol.x | 15 +--
> >  3 files changed, 93 insertions(+), 6 deletions(-)
> > 
> > diff --git a/daemon/remote.c b/daemon/remote.c
> > index 03d5557..a11ba94 100644
> > --- a/daemon/remote.c
> > +++ b/daemon/remote.c
> > @@ -4620,6 +4620,13 @@ remoteDispatchDomainMigrateBegin3Params(
> >  goto cleanup;
> >  }
> >  
> > +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> > +virReportError(VIR_ERR_RPC,
> > +   _("Too many migration parameters '%d' for limit 
> > '%d'"),
> > +   args->params.params_len, 
> > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> > +goto cleanup;
> > +}
> > +
> >  if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
> >  goto cleanup;
> >  
> > @@ -4671,6 +4678,13 @@ remoteDispatchDomainMigratePrepare3Params(
> >  goto cleanup;
> >  }
> >  
> > +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> > +virReportError(VIR_ERR_RPC,
> > +   _("Too many migration parameters '%d' for limit 
> > '%d'"),
> > +   args->params.params_len, 
> > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> > +goto cleanup;
> > +}
> > +
> >  if (!(params = 
> > remoteDeserializeTypedParameters(args->params.params_val,
> >  
> > args->params.params_len,
> >  0, &nparams)))
> > @@ -4726,6 +4740,13 @@ remoteDispatchDomainMigratePrepareTunnel3Params(
> >  goto cleanup;
> >  }
> >  
> > +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> > +virReportError(VIR_ERR_RPC,
> > +   _("Too many migration parameters '%d' for limit 
> > '%d'"),
> > +   args->params.params_len, 
> > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> > +goto cleanup;
> > +}
> > +
> >  if (!(params = 
> > remoteDeserializeTypedParameters(args->params.params_val,
> >  
> > args->params.params_len,
> >  0, &nparams)))
> > @@ -4790,6 +4811,13 @@ remoteDispatchDomainMigratePerform3Params(
> >  goto cleanup;
> >  }
> >  
> > +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> > +virReportError(VIR_ERR_RPC,
> > +   _("Too many migration parameters '%d' for limit 
> > '%d'"),
> > +   args->params.params_len, 
> > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> > +goto cleanup;
> > +}
> > +
> >  if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
> >  goto cleanup;
> >  
> > @@ -4845,6 +4873,13 @@ remoteDispatchDomainMigrateFinish3Params(
> >  goto cleanup;
> >  }
> >  
> > +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> > +virReportError(VIR_ERR_RPC,
> > +   _("Too many migration parameters '%d' for limit 
> > '%d'"),
> > +   args->params.params_len, 
> > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> > +goto cleanup;
> > +}
> > +
> >  if (!(params = 
> > remoteDeserializeTypedParameters(args->params.params_val,
> >  
> > args->params.params_len,
> >  0, &nparams)))
> > @@ -4897,6 +4932,13 @@ remoteDispatchDomainMigrateConfirm3Params(
> >  goto cleanup;
> >  }
> >  
> > +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> > +virReportError(VIR_ERR_RPC,
> > +   _("Too many migration parameters '%d' for limit 
> > '%d'"),
> > +   args->params.params_len, 
> > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> > +goto cleanup;
> > +}
> > +
> >  if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
> >  goto cleanup;
> 
> While the above is correct as it fixes the libvirtd (sanitizes input).
> However, I don't think we need the following, esp. if we ever change the
> limit. The older client won't be able to pass more parameters whereas it
> currently can.

As mentioned in the cover letter, we explicitly want to check data
received

Re: [libvirt] [PATCH 01/12] Add bounds checking on virDomainMigrate*Params RPC calls (CVE-2013-4292)

2013-08-29 Thread Michal Privoznik 
On 29.08.2013 12:49, Daniel P. Berrange wrote:
> From: "Daniel P. Berrange" 
> 
> The parameters for the virDomainMigrate*Params RPC calls were
> not bounds checks, meaning a malicious client can cause libvirtd
> to consume arbitrary memory
> 
> This issue was introduced in the 1.1.0 release of libvirt
> 
> Signed-off-by: Daniel P. Berrange 
> ---
>  daemon/remote.c  | 42 ++
>  src/remote/remote_driver.c   | 42 ++
>  src/remote/remote_protocol.x | 15 +--
>  3 files changed, 93 insertions(+), 6 deletions(-)
> 
> diff --git a/daemon/remote.c b/daemon/remote.c
> index 03d5557..a11ba94 100644
> --- a/daemon/remote.c
> +++ b/daemon/remote.c
> @@ -4620,6 +4620,13 @@ remoteDispatchDomainMigrateBegin3Params(
>  goto cleanup;
>  }
>  
> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> +virReportError(VIR_ERR_RPC,
> +   _("Too many migration parameters '%d' for limit 
> '%d'"),
> +   args->params.params_len, 
> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> +goto cleanup;
> +}
> +
>  if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
>  goto cleanup;
>  
> @@ -4671,6 +4678,13 @@ remoteDispatchDomainMigratePrepare3Params(
>  goto cleanup;
>  }
>  
> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> +virReportError(VIR_ERR_RPC,
> +   _("Too many migration parameters '%d' for limit 
> '%d'"),
> +   args->params.params_len, 
> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> +goto cleanup;
> +}
> +
>  if (!(params = remoteDeserializeTypedParameters(args->params.params_val,
>  args->params.params_len,
>  0, &nparams)))
> @@ -4726,6 +4740,13 @@ remoteDispatchDomainMigratePrepareTunnel3Params(
>  goto cleanup;
>  }
>  
> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> +virReportError(VIR_ERR_RPC,
> +   _("Too many migration parameters '%d' for limit 
> '%d'"),
> +   args->params.params_len, 
> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> +goto cleanup;
> +}
> +
>  if (!(params = remoteDeserializeTypedParameters(args->params.params_val,
>  args->params.params_len,
>  0, &nparams)))
> @@ -4790,6 +4811,13 @@ remoteDispatchDomainMigratePerform3Params(
>  goto cleanup;
>  }
>  
> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> +virReportError(VIR_ERR_RPC,
> +   _("Too many migration parameters '%d' for limit 
> '%d'"),
> +   args->params.params_len, 
> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> +goto cleanup;
> +}
> +
>  if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
>  goto cleanup;
>  
> @@ -4845,6 +4873,13 @@ remoteDispatchDomainMigrateFinish3Params(
>  goto cleanup;
>  }
>  
> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> +virReportError(VIR_ERR_RPC,
> +   _("Too many migration parameters '%d' for limit 
> '%d'"),
> +   args->params.params_len, 
> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> +goto cleanup;
> +}
> +
>  if (!(params = remoteDeserializeTypedParameters(args->params.params_val,
>  args->params.params_len,
>  0, &nparams)))
> @@ -4897,6 +4932,13 @@ remoteDispatchDomainMigrateConfirm3Params(
>  goto cleanup;
>  }
>  
> +if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> +virReportError(VIR_ERR_RPC,
> +   _("Too many migration parameters '%d' for limit 
> '%d'"),
> +   args->params.params_len, 
> REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
> +goto cleanup;
> +}
> +
>  if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
>  goto cleanup;

While the above is correct as it fixes the libvirtd (sanitizes input).
However, I don't think we need the following, esp. if we ever change the
limit. The older client won't be able to pass more parameters whereas it
currently can.


>  
> diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c
> index 71d0034..30f8f90 100644
> --- a/src/remote/remote_driver.c
> +++ b/src/remote/remote_driver.c
> @@ -6037,6 +6037,13 @@ remoteDomainMigrateBegin3Params(virDomainPtr domain,
>  make_nonnull_domain(&args.dom, domain);
>  args.flags = flags;
>  
> +if (nparams > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
> +

[libvirt] [PATCH 01/12] Add bounds checking on virDomainMigrate*Params RPC calls (CVE-2013-4292)

2013-08-29 Thread Daniel P. Berrange 
From: "Daniel P. Berrange" 

The parameters for the virDomainMigrate*Params RPC calls were
not bounds checks, meaning a malicious client can cause libvirtd
to consume arbitrary memory

This issue was introduced in the 1.1.0 release of libvirt

Signed-off-by: Daniel P. Berrange 
---
 daemon/remote.c  | 42 ++
 src/remote/remote_driver.c   | 42 ++
 src/remote/remote_protocol.x | 15 +--
 3 files changed, 93 insertions(+), 6 deletions(-)

diff --git a/daemon/remote.c b/daemon/remote.c
index 03d5557..a11ba94 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -4620,6 +4620,13 @@ remoteDispatchDomainMigrateBegin3Params(
 goto cleanup;
 }
 
+if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+virReportError(VIR_ERR_RPC,
+   _("Too many migration parameters '%d' for limit '%d'"),
+   args->params.params_len, 
REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+goto cleanup;
+}
+
 if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
 goto cleanup;
 
@@ -4671,6 +4678,13 @@ remoteDispatchDomainMigratePrepare3Params(
 goto cleanup;
 }
 
+if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+virReportError(VIR_ERR_RPC,
+   _("Too many migration parameters '%d' for limit '%d'"),
+   args->params.params_len, 
REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+goto cleanup;
+}
+
 if (!(params = remoteDeserializeTypedParameters(args->params.params_val,
 args->params.params_len,
 0, &nparams)))
@@ -4726,6 +4740,13 @@ remoteDispatchDomainMigratePrepareTunnel3Params(
 goto cleanup;
 }
 
+if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+virReportError(VIR_ERR_RPC,
+   _("Too many migration parameters '%d' for limit '%d'"),
+   args->params.params_len, 
REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+goto cleanup;
+}
+
 if (!(params = remoteDeserializeTypedParameters(args->params.params_val,
 args->params.params_len,
 0, &nparams)))
@@ -4790,6 +4811,13 @@ remoteDispatchDomainMigratePerform3Params(
 goto cleanup;
 }
 
+if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+virReportError(VIR_ERR_RPC,
+   _("Too many migration parameters '%d' for limit '%d'"),
+   args->params.params_len, 
REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+goto cleanup;
+}
+
 if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
 goto cleanup;
 
@@ -4845,6 +4873,13 @@ remoteDispatchDomainMigrateFinish3Params(
 goto cleanup;
 }
 
+if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+virReportError(VIR_ERR_RPC,
+   _("Too many migration parameters '%d' for limit '%d'"),
+   args->params.params_len, 
REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+goto cleanup;
+}
+
 if (!(params = remoteDeserializeTypedParameters(args->params.params_val,
 args->params.params_len,
 0, &nparams)))
@@ -4897,6 +4932,13 @@ remoteDispatchDomainMigrateConfirm3Params(
 goto cleanup;
 }
 
+if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+virReportError(VIR_ERR_RPC,
+   _("Too many migration parameters '%d' for limit '%d'"),
+   args->params.params_len, 
REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+goto cleanup;
+}
+
 if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
 goto cleanup;
 
diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c
index 71d0034..30f8f90 100644
--- a/src/remote/remote_driver.c
+++ b/src/remote/remote_driver.c
@@ -6037,6 +6037,13 @@ remoteDomainMigrateBegin3Params(virDomainPtr domain,
 make_nonnull_domain(&args.dom, domain);
 args.flags = flags;
 
+if (nparams > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+virReportError(VIR_ERR_RPC,
+   _("Too many migration parameters '%d' for limit '%d'"),
+   nparams, REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+goto cleanup;
+}
+
 if (remoteSerializeTypedParameters(params, nparams,
&args.params.params_val,
&args.params.params_len) < 0) {
@@ -6096,6 +6103,13 @@ remoteDomainMigratePrepare3Params(virConnectPtr dconn,
 memset(&args, 0, sizeof(args));
 memset(&ret, 0, sizeof(ret));