[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 8/9] ui: check VNC audio frequency limit at time of r
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 8/9] ui: check VNC audio frequency limit at time of reading from client |
Date: |
Fri, 16 Feb 2018 12:54:09 +0100 |
From: Daniel P. Berrangé <address@hidden>
The 'vs->as.freq' value is a signed integer, which is read from an
unsigned 32-bit int field on the wire. There is thus a risk of overflow
on 32-bit platforms. Move the frequency limit checking to be done at
time of read before casting to a signed integer.
Reported-by: Laszlo Ersek <address@hidden>
Signed-off-by: Daniel P. Berrangé <address@hidden>
Reviewed-by: Laszlo Ersek <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>
---
ui/vnc.c | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/ui/vnc.c b/ui/vnc.c
index 746293ddfa..a77b568b57 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -982,14 +982,7 @@ static void vnc_update_throttle_offset(VncState *vs)
vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel;
if (vs->audio_cap) {
- int freq = vs->as.freq;
- /* We don't limit freq when reading settings from client, so
- * it could be upto MAX_INT in size. 48khz is a sensible
- * upper bound for trustworthy clients */
int bps;
- if (freq > 48000) {
- freq = 48000;
- }
switch (vs->as.fmt) {
default:
case AUD_FMT_U8:
@@ -1005,7 +998,7 @@ static void vnc_update_throttle_offset(VncState *vs)
bps = 4;
break;
}
- offset += freq * bps * vs->as.nchannels;
+ offset += vs->as.freq * bps * vs->as.nchannels;
}
/* Put a floor of 1MB on offset, so that if we have a large pending
@@ -2292,6 +2285,7 @@ static int protocol_client_msg(VncState *vs, uint8_t
*data, size_t len)
{
int i;
uint16_t limit;
+ uint32_t freq;
VncDisplay *vd = vs->vd;
if (data[0] > 3) {
@@ -2411,7 +2405,17 @@ static int protocol_client_msg(VncState *vs, uint8_t
*data, size_t len)
vnc_client_error(vs);
break;
}
- vs->as.freq = read_u32(data, 6);
+ freq = read_u32(data, 6);
+ /* No official limit for protocol, but 48khz is a sensible
+ * upper bound for trustworthy clients, and this limit
+ * protects calculations involving 'vs->as.freq' later.
+ */
+ if (freq > 48000) {
+ VNC_DEBUG("Invalid audio frequency %u > 48000", freq);
+ vnc_client_error(vs);
+ break;
+ }
+ vs->as.freq = freq;
break;
default:
VNC_DEBUG("Invalid audio message %d\n", read_u8(data, 4));
--
2.9.3
- [Qemu-devel] [PULL 0/9] Ui 20180216 patches, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 6/9] ui: avoid risk of 32-bit int overflow in VNC buffer check, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 4/9] sdl: restore optimized redraw, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 7/9] ui: avoid 'local_err' variable shadowing in VNC SASL auth, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 1/9] vnc: remove bogus object_unref on client socket, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 5/9] sdl2: fix mouse grab, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 3/9] vnc: fix segfault in closed connection handling, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 9/9] ui: extend VNC trottling tracing to SASL codepaths, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 8/9] ui: check VNC audio frequency limit at time of reading from client,
Gerd Hoffmann <=
- [Qemu-devel] [PULL 2/9] vnc: add qapi/error.h include to stubs, Gerd Hoffmann, 2018/02/16
- Re: [Qemu-devel] [PULL 0/9] Ui 20180216 patches, Peter Maydell, 2018/02/16