Skip to content
Commit eb8934b0 authored by Gerd Hoffmann's avatar Gerd Hoffmann
Browse files

vnc: fix memory corruption (CVE-2015-5225)



The _cmp_bytes variable added by commit "bea60dd7 ui/vnc: fix potential
memory corruption issues" can become negative.  Result is (possibly
exploitable) memory corruption.  Reason for that is it uses the stride
instead of bytes per scanline to apply limits.

For the server surface is is actually fine.  vnc creates that itself,
there is never any padding and thus scanline length always equals stride.

For the guest surface scanline length and stride are typically identical
too, but it doesn't has to be that way.  So add and use a new variable
(guest_ll) for the guest scanline length.  Also rename min_stride to
line_bytes to make more clear what it actually is.  Finally sprinkle
in an assert() to make sure we never use a negative _cmp_bytes again.

Reported-by: default avatar范祚至(库特) <zuozhi.fzz@alibaba-inc.com>
Reviewed-by: default avatarP J P <ppandit@redhat.com>
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 7df96719
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment