diff options
author | Wolfgang Bumiller <w.bumiller@proxmox.com> | 2016-01-13 09:09:58 +0100 |
---|---|---|
committer | Timothy Pearson <tpearson@raptorengineering.com> | 2019-11-29 19:30:23 -0600 |
commit | 8814dad0366edca6658710cb8611f2504d537a36 (patch) | |
tree | 8787bc98fe2358b9b67194e479431d5bf20841c0 /include/ui/console.h | |
parent | d4b501e7ce78ecb3c2cfe108267cd7203e735014 (diff) | |
download | hqemu-8814dad0366edca6658710cb8611f2504d537a36.zip hqemu-8814dad0366edca6658710cb8611f2504d537a36.tar.gz |
hmp: fix sendkey out of bounds write (CVE-2015-8619)
When processing 'sendkey' command, hmp_sendkey routine null
terminates the 'keyname_buf' array. This results in an OOB
write issue, if 'keyname_len' was to fall outside of
'keyname_buf' array.
Since the keyname's length is known the keyname_buf can be
removed altogether by adding a length parameter to
index_from_key() and using it for the error output as well.
Reported-by: Ling Liu <liuling-it@360.cn>
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Message-Id: <20160113080958.GA18934@olga>
[Comparison with "<" dumbed down, test for junk after strtoul()
tweaked]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Diffstat (limited to 'include/ui/console.h')
-rw-r--r-- | include/ui/console.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/ui/console.h b/include/ui/console.h index adac36d..116bc2b 100644 --- a/include/ui/console.h +++ b/include/ui/console.h @@ -448,7 +448,7 @@ static inline int vnc_display_pw_expire(const char *id, time_t expires) void curses_display_init(DisplayState *ds, int full_screen); /* input.c */ -int index_from_key(const char *key); +int index_from_key(const char *key, size_t key_length); /* gtk.c */ void early_gtk_display_init(int opengl); |