[Xen-changelog] [qemu-xen stable-4.10] io: monitor encoutput buffer size from websocket GSource

[patchbot@xxxxxxx]

commit e0809fcc4b03b51435eabc8ad84ecd61acd83d31
Author:     Daniel P. Berrange <berrange@xxxxxxxxxx>
AuthorDate: Tue Oct 17 15:36:55 2017 +0100
Commit:     Michael Roth <mdroth@xxxxxxxxxxxxxxxxxx>
CommitDate: Wed Dec 6 09:38:20 2017 -0600

    io: monitor encoutput buffer size from websocket GSource
    
    The websocket GSource is monitoring the size of the rawoutput
    buffer to determine if the channel can accepts more writes.
    The rawoutput buffer, however, is merely a temporary staging
    buffer before data is copied into the encoutput buffer. Thus
    its size will always be zero when the GSource runs.
    
    This flaw causes the encoutput buffer to grow without bound
    if the other end of the underlying data channel doesn't
    read data being sent. This can be seen with VNC if a client
    is on a slow WAN link and the guest OS is sending many screen
    updates. A malicious VNC client can act like it is on a slow
    link by playing a video in the guest and then reading data
    very slowly, causing QEMU host memory to expand arbitrarily.
    
    This issue is assigned CVE-2017-15268, publically reported in
    
      https://bugs.launchpad.net/qemu/+bug/1718964
    
    (cherry picked from commit a7b20a8efa28e5f22c26c06cd06c2f12bc863493)
    
    Reviewed-by: Eric Blake <eblake@xxxxxxxxxx>
    
    [Dan: Added extra checks to deal with code refactored in master but
     not stable 2.10]
    
    Signed-off-by: Daniel P. Berrange <berrange@xxxxxxxxxx>
    Signed-off-by: Michael Roth <mdroth@xxxxxxxxxxxxxxxxxx>
---
 io/channel-websock.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/io/channel-websock.c b/io/channel-websock.c
index 5a3badb..19116dc 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -26,7 +26,7 @@
 #include "trace.h"
 
 
-/* Max amount to allow in rawinput/rawoutput buffers */
+/* Max amount to allow in rawinput/encoutput buffers */
 #define QIO_CHANNEL_WEBSOCK_MAX_BUFFER 8192
 
 #define QIO_CHANNEL_WEBSOCK_CLIENT_KEY_LEN 24
@@ -1006,7 +1006,7 @@ qio_channel_websock_source_prepare(GSource *source,
     if (wsource->wioc->rawinput.offset) {
         cond |= G_IO_IN;
     }
-    if (wsource->wioc->rawoutput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) {
+    if (wsource->wioc->encoutput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) {
         cond |= G_IO_OUT;
     }
 
@@ -1022,7 +1022,7 @@ qio_channel_websock_source_check(GSource *source)
     if (wsource->wioc->rawinput.offset) {
         cond |= G_IO_IN;
     }
-    if (wsource->wioc->rawoutput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) {
+    if (wsource->wioc->encoutput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) {
         cond |= G_IO_OUT;
     }
 
@@ -1041,7 +1041,7 @@ qio_channel_websock_source_dispatch(GSource *source,
     if (wsource->wioc->rawinput.offset) {
         cond |= G_IO_IN;
     }
-    if (wsource->wioc->rawoutput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) {
+    if (wsource->wioc->encoutput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) {
         cond |= G_IO_OUT;
     }
 
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#stable-4.10

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog