diff options
author | Petr Matousek <pmatouse@redhat.com> | 2014-10-27 12:41:44 +0100 |
---|---|---|
committer | Gerd Hoffmann <kraxel@redhat.com> | 2014-10-28 11:51:04 +0100 |
commit | e6908bfe8e07f2b452e78e677da1b45b1c0f6829 (patch) | |
tree | 0afb5e0d8482271421d00a28574f15dd0066a664 /ui/vnc.c | |
parent | 3e9418e160cd8901c83a3c88967158084f5b5c03 (diff) | |
download | hqemu-e6908bfe8e07f2b452e78e677da1b45b1c0f6829.zip hqemu-e6908bfe8e07f2b452e78e677da1b45b1c0f6829.tar.gz |
vnc: sanitize bits_per_pixel from the client
bits_per_pixel that are less than 8 could result in accessing
non-initialized buffers later in the code due to the expectation
that bytes_per_pixel value that is used to initialize these buffers is
never zero.
To fix this check that bits_per_pixel from the client is one of the
values that the rfb protocol specification allows.
This is CVE-2014-7815.
Signed-off-by: Petr Matousek <pmatouse@redhat.com>
[ kraxel: apply codestyle fix ]
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'ui/vnc.c')
-rw-r--r-- | ui/vnc.c | 10 |
1 files changed, 10 insertions, 0 deletions
@@ -2026,6 +2026,16 @@ static void set_pixel_format(VncState *vs, return; } + switch (bits_per_pixel) { + case 8: + case 16: + case 32: + break; + default: + vnc_client_error(vs); + return; + } + vs->client_pf.rmax = red_max; vs->client_pf.rbits = hweight_long(red_max); vs->client_pf.rshift = red_shift; |