[Xen-changelog] [qemu-xen-4.2-testing] vnc: limit client_cut_text msg payload size

[patchbot@xxxxxxx]

commit 112599882987da1afbbe4c16f6b049065a64f065
Author:     Peter Lieven <pl@xxxxxxx>
AuthorDate: Mon Jun 30 10:07:54 2014 +0200
Commit:     Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CommitDate: Fri Sep 11 11:25:50 2015 +0100

    vnc: limit client_cut_text msg payload size
    
    currently a malicious client could define a payload
    size of 2^32 - 1 bytes and send up to that size of
    data to the vnc server. The server would allocated
    that amount of memory which could easily create an
    out of memory condition.
    
    This patch limits the payload size to 1MB max.
    
    Please note that client_cut_text messages are currently
    silently ignored.
    
    Signed-off-by: Peter Lieven <pl@xxxxxxx>
    Signed-off-by: Gerd Hoffmann <kraxel@xxxxxxxxxx>
    
    Above is f9a70e79391f in qemu upstream.
    
    Cherry picked onto in qemu-xen-4.6-testing and qemu-xen-unstable:
    
    Conflicts:
        ui/vnc.c
    Dropped { } style changes.
    
    Signed-off-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
    
    Above is 2b5684137e81 in qemu-xen-4.6-testing and qemu-xen-unstable,
    now being cherry picked onto qemu-xen-4.5-testing.  Also need
    1c8d43cbdf0f, its fixup patch:
    
    We do not have `error_report'.  Use fprintf to stderr, like the rest
    of the file.
    
    Fix commit message to refer to vnc.c, not ui/vnc.c.
    
    Signed-off-by: Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
    (cherry picked from commit dfe880e8d5fdc863ce6bbcdcaebaf918f8689cc0)
    (cherry picked from commit 5ae0569d964ad1a6d8dc781e5566d39210a5d063)
    (cherry picked from commit 1e5099d596b6f7a977d4bc040a54edc2a6a3c6a4)
---
 vnc.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/vnc.c b/vnc.c
index 7629dfa..48e5c46 100644
--- a/vnc.c
+++ b/vnc.c
@@ -1768,6 +1768,12 @@ static int protocol_client_msg(VncState *vs, uint8_t 
*data, size_t len)
        if (len == 8) {
            uint32_t v;
            v = read_u32(data, 4);
+           if (v > (1 << 20)) {
+               fprintf(stderr, "vnc: client_cut_text msg payload has %u bytes"
+                             " which exceeds our limit of 1MB.\n", v);
+               vnc_client_error(vs);
+               break;
+           }
            if (v)
                return 8 + v;
        }
--
generated by git-patchbot for /home/xen/git/qemu-xen-4.2-testing.git

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog