integer overflow in several XSM/Flask hypercalls

ISSUE DESCRIPTION

The FLASK_{GET,SET}BOOL, FLASK_USER and FLASK_CONTEXT_TO_SID suboperations of the flask hypercall are vulnerable to an integer overflow on the input size. The hypercalls attempt to allocate a buffer which is 1 larger than this size and is therefore vulnerable to integer overflow and an attempt to allocate then access a zero byte buffer. (CVE-2014-1891)
Xen 3.3 through 4.1, while not affected by the above overflow, have a different overflow issue on FLASK_{GET,SET}BOOL (CVE-2014-1893) and expose unreasonably large memory allocation to aribitrary guests (CVE-2014-1892).
Xen 3.2 (and presumably earlier) exhibit both problems with the overflow issue being present for more than just the suboperations listed above. (CVE-2014-1894 for the subops not covered above.)
The FLASK_GETBOOL op is available to all domains.
The FLASK_SETBOOL op is only available to domains which are granted access via the Flask policy. However the permissions check is performed only after running the vulnerable code and the vulnerability via this subop is exposed to all domains.
The FLASK_USER and FLASK_CONTEXT_TO_SID ops are only available to domains which are granted access via the Flask policy.

IMPACT

Attempting to access the result of a zero byte allocation results in a processor fault leading to a denial of service.

VULNERABLE SYSTEMS

All Xen versions back to at least 3.2 are vulnerable to this issue when built with XSM/Flask support. XSM support is disabled by default and is enabled by building with XSM_ENABLE=y.
We have not checked earlier versions of Xen, but it is likely that they are vulnerable to this or related vulnerabilities.
All Xen versions built with XSM_ENABLE=y are vulnerable.