[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL v2 09/11] ui/vnc: Fix problem with sending too many b
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL v2 09/11] ui/vnc: Fix problem with sending too many bytes as server name |
Date: |
Mon, 9 Jan 2017 14:09:43 +0100 |
From: Thomas Huth <address@hidden>
If the buffer is not big enough, snprintf() does not return the number
of bytes that have been written to the buffer, but the number of bytes
that would be needed for writing the whole string. By using this value
for the following vnc_write() calls, we send some junk at the end of
the name in case the qemu_name is longer than 1017 bytes, which could
confuse the VNC clients. Fix this by adding an additional size check
here.
Buglink: https://bugs.launchpad.net/qemu/+bug/1637447
Signed-off-by: Thomas Huth <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>
---
ui/vnc.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/ui/vnc.c b/ui/vnc.c
index 2c28a59..29aa9c4 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2459,10 +2459,14 @@ static int protocol_client_init(VncState *vs, uint8_t
*data, size_t len)
pixel_format_message(vs);
- if (qemu_name)
+ if (qemu_name) {
size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
- else
+ if (size > sizeof(buf)) {
+ size = sizeof(buf);
+ }
+ } else {
size = snprintf(buf, sizeof(buf), "QEMU");
+ }
vnc_write_u32(vs, size);
vnc_write(vs, buf, size);
--
1.8.3.1
- Re: [Qemu-devel] [PULL v2 02/11] ui: use evdev keymap when running under wayland, (continued)
- [Qemu-devel] [PULL v2 07/11] gtk: avoid oob array access, Gerd Hoffmann, 2017/01/09
- [Qemu-devel] [PULL v2 06/11] egl-helpers: Change file licensing to LGPLv2, Gerd Hoffmann, 2017/01/09
- [Qemu-devel] [PULL v2 11/11] ps2: Fix lost scancodes by recent changes, Gerd Hoffmann, 2017/01/09
- [Qemu-devel] [PULL v2 04/11] console: move window ID code from baum to sdl, Gerd Hoffmann, 2017/01/09
- [Qemu-devel] [PULL v2 05/11] sdl2: set window ID, Gerd Hoffmann, 2017/01/09
[Qemu-devel] [PULL v2 09/11] ui/vnc: Fix problem with sending too many bytes as server name,
Gerd Hoffmann <=
Re: [Qemu-devel] [PULL v2 00/11] ui patch queue, Peter Maydell, 2017/01/09
[Qemu-devel] [PULL v2 00/11] ui patch queue, Gerd Hoffmann, 2017/01/31
- [Qemu-devel] [PULL v2 02/11] ps2: add support for mice with extra/side buttons, Gerd Hoffmann, 2017/01/31
- [Qemu-devel] [PULL v2 03/11] ui: add support for mice with extra/side buttons, Gerd Hoffmann, 2017/01/31
- [Qemu-devel] [PULL v2 01/11] qapi: add support for mice with extra/side buttons, Gerd Hoffmann, 2017/01/31
- [Qemu-devel] [PULL v2 11/11] console: fix console resize, Gerd Hoffmann, 2017/01/31
- [Qemu-devel] [PULL v2 07/11] ui/gtk.c: add ctrl-alt-= support for zoom in acceleration, Gerd Hoffmann, 2017/01/31
- [Qemu-devel] [PULL v2 05/11] ui/gtk: Fix mouse wheel on 3.4.0 or later, Gerd Hoffmann, 2017/01/31