[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 1/4] ui: avoid risk of 32-bit int overflow in VN
From: |
Laszlo Ersek |
Subject: |
Re: [Qemu-devel] [PATCH 1/4] ui: avoid risk of 32-bit int overflow in VNC buffer check |
Date: |
Mon, 5 Feb 2018 13:58:03 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 |
On 02/05/18 12:49, Daniel P. Berrangé wrote:
> For very large framebuffers, it is theoretically possible for the result
> of 'vs->throttle_output_offset * VNC_THROTTLE_OUTPUT_LIMIT_SCALE' to
> exceed the size of a 32-bit int. For this to happen in practice, the
> video RAM would have to be set to a large enough value, which is not
> likely today. None the less we can be paranoid against future growth by
> using division instead of multiplication when checking the limits.
>
> Reported-by: Laszlo Ersek <address@hidden>
> Signed-off-by: Daniel P. Berrangé <address@hidden>
> ---
> ui/vnc.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/ui/vnc.c b/ui/vnc.c
> index 93731accb6..e14e524764 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -1572,8 +1572,8 @@ void vnc_write(VncState *vs, const void *data, size_t
> len)
> * handshake, or from the job thread's VncState clone
> */
> if (vs->throttle_output_offset != 0 &&
> - vs->output.offset > (vs->throttle_output_offset *
> - VNC_THROTTLE_OUTPUT_LIMIT_SCALE)) {
> + (vs->output.offset / VNC_THROTTLE_OUTPUT_LIMIT_SCALE) >
> + vs->throttle_output_offset) {
> trace_vnc_client_output_limit(vs, vs->ioc, vs->output.offset,
> vs->throttle_output_offset);
> vnc_disconnect_start(vs);
>
Reviewed-by: Laszlo Ersek <address@hidden>