|
 |
98b314b |
From c188c382afcad1a054541f8b101fa1044e2289cf Mon Sep 17 00:00:00 2001
|
|
|
98b314b |
From: Frediano Ziglio <fziglio@redhat.com>
|
|
|
98b314b |
Date: Sun, 2 Jun 2019 19:02:25 +0100
|
|
|
98b314b |
Subject: [PATCH spice-gtk] vmcstream: Fix buffer overflow sending data to task
|
|
|
98b314b |
MIME-Version: 1.0
|
|
|
98b314b |
Content-Type: text/plain; charset=UTF-8
|
|
|
98b314b |
Content-Transfer-Encoding: 8bit
|
|
|
98b314b |
|
|
|
98b314b |
The "count" variable is used to store the full length of the
|
|
|
98b314b |
initial buffer set using spice_vmc_input_stream_read_all_async or
|
|
|
98b314b |
spice_vmc_input_stream_read_async.
|
|
|
98b314b |
However on spice_vmc_input_stream_co_data the "buffer" variable is
|
|
|
98b314b |
increased by the amount read into it.
|
|
|
98b314b |
On potential next loop "count" is still used to compute the bytes to
|
|
|
98b314b |
read but now "buffer + count" points past the original buffer.
|
|
|
98b314b |
So we need to take into account the position written in order to
|
|
|
98b314b |
compute the right limit.
|
|
|
98b314b |
Tested with WebDAV.
|
|
|
98b314b |
|
|
|
98b314b |
https://bugzilla.redhat.com/show_bug.cgi?id=1720532
|
|
|
98b314b |
|
|
|
98b314b |
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
|
|
|
98b314b |
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
|
98b314b |
---
|
|
|
98b314b |
src/vmcstream.c | 11 +++++------
|
|
|
98b314b |
1 file changed, 5 insertions(+), 6 deletions(-)
|
|
|
98b314b |
|
|
|
98b314b |
diff --git a/src/vmcstream.c b/src/vmcstream.c
|
|
|
98b314b |
index 0634bce..86c949a 100644
|
|
|
98b314b |
--- a/src/vmcstream.c
|
|
|
98b314b |
+++ b/src/vmcstream.c
|
|
|
98b314b |
@@ -142,17 +142,16 @@ spice_vmc_input_stream_co_data(SpiceVmcInputStream *self,
|
|
|
98b314b |
|
|
|
98b314b |
g_return_if_fail(self->task != NULL);
|
|
|
98b314b |
|
|
|
98b314b |
- gsize min = MIN(self->count, size);
|
|
|
98b314b |
- memcpy(self->buffer, data, min);
|
|
|
98b314b |
+ gsize min = MIN(self->count - self->pos, size);
|
|
|
98b314b |
+ memcpy(self->buffer + self->pos, data, min);
|
|
|
98b314b |
|
|
|
98b314b |
size -= min;
|
|
|
98b314b |
data += min;
|
|
|
98b314b |
|
|
|
98b314b |
- SPICE_DEBUG("spicevmc co_data complete: %" G_GSIZE_FORMAT
|
|
|
98b314b |
- "/%" G_GSIZE_FORMAT, min, self->count);
|
|
|
98b314b |
-
|
|
|
98b314b |
self->pos += min;
|
|
|
98b314b |
- self->buffer += min;
|
|
|
98b314b |
+
|
|
|
98b314b |
+ SPICE_DEBUG("spicevmc co_data complete: %" G_GSIZE_FORMAT
|
|
|
98b314b |
+ "/%" G_GSIZE_FORMAT, self->pos, self->count);
|
|
|
98b314b |
|
|
|
98b314b |
if (self->all && min > 0 && self->pos != self->count)
|
|
|
98b314b |
continue;
|
|
|
98b314b |
--
|
|
|
98b314b |
2.22.0.rc2.384.g1a9a72ea1d
|
|
|
98b314b |
|