|
 |
7b23b6 |
From 5324e83bf636b995522088d508e61ba5543777f4 Mon Sep 17 00:00:00 2001
|
|
|
7b23b6 |
From: Frediano Ziglio <fziglio@redhat.com>
|
|
|
7b23b6 |
Date: Thu, 19 Mar 2020 06:07:39 +0000
|
|
|
7b23b6 |
Subject: [PATCH 2/9] channel-main: Check proper size and caps handling
|
|
|
7b23b6 |
VD_AGENT_FILE_XFER_STATUS_NOT_ENOUGH_SPACE
|
|
|
7b23b6 |
|
|
|
7b23b6 |
VDAgentFileXferStatusMessage message can or cannot contain detailed
|
|
|
7b23b6 |
information attached to it.
|
|
|
7b23b6 |
Detect this correctly checking capabilities and flags.
|
|
|
7b23b6 |
This fixes a small buffer overflow reading in case the details are
|
|
|
7b23b6 |
off the payload.
|
|
|
7b23b6 |
|
|
|
7b23b6 |
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
|
|
|
7b23b6 |
Acked-by: Victor Toso <victortoso@redhat.com>
|
|
|
7b23b6 |
(cherry picked from commit b13fd0664075c951f5418f5828c0803408ad664d)
|
|
|
7b23b6 |
---
|
|
|
7b23b6 |
meson.build | 2 +-
|
|
|
7b23b6 |
src/channel-main.c | 16 +++++++++++++---
|
|
|
7b23b6 |
2 files changed, 14 insertions(+), 4 deletions(-)
|
|
|
7b23b6 |
|
|
|
7b23b6 |
diff --git a/meson.build b/meson.build
|
|
|
7b23b6 |
index 995268b..8098989 100644
|
|
|
7b23b6 |
--- a/meson.build
|
|
|
7b23b6 |
+++ b/meson.build
|
|
|
7b23b6 |
@@ -81,7 +81,7 @@ endforeach
|
|
|
7b23b6 |
#
|
|
|
7b23b6 |
# check for mandatory dependencies
|
|
|
7b23b6 |
#
|
|
|
7b23b6 |
-spice_protocol_version='>= 0.14.1'
|
|
|
7b23b6 |
+spice_protocol_version='>= 0.14.2'
|
|
|
7b23b6 |
|
|
|
7b23b6 |
glib_version = '2.46'
|
|
|
7b23b6 |
glib_version_info = '>= @0@'.format(glib_version)
|
|
|
7b23b6 |
diff --git a/src/channel-main.c b/src/channel-main.c
|
|
|
7b23b6 |
index e89b813..c4fe02b 100644
|
|
|
7b23b6 |
--- a/src/channel-main.c
|
|
|
7b23b6 |
+++ b/src/channel-main.c
|
|
|
7b23b6 |
@@ -1891,6 +1891,7 @@ static void file_xfer_read_async_cb(GObject *source_object,
|
|
|
7b23b6 |
|
|
|
7b23b6 |
/* coroutine context */
|
|
|
7b23b6 |
static void main_agent_handle_xfer_status(SpiceMainChannel *channel,
|
|
|
7b23b6 |
+ const VDAgentMessage *msg_hdr,
|
|
|
7b23b6 |
VDAgentFileXferStatusMessage *msg)
|
|
|
7b23b6 |
{
|
|
|
7b23b6 |
SpiceFileTransferTask *xfer_task;
|
|
|
7b23b6 |
@@ -1917,8 +1918,17 @@ static void main_agent_handle_xfer_status(SpiceMainChannel *channel,
|
|
|
7b23b6 |
_("The spice agent reported an error during the file transfer"));
|
|
|
7b23b6 |
break;
|
|
|
7b23b6 |
case VD_AGENT_FILE_XFER_STATUS_NOT_ENOUGH_SPACE: {
|
|
|
7b23b6 |
- uint64_t *free_space = SPICE_ALIGNED_CAST(uint64_t *, msg->data);
|
|
|
7b23b6 |
- gchar *free_space_str = g_format_size(*free_space);
|
|
|
7b23b6 |
+ const VDAgentFileXferStatusNotEnoughSpace *err =
|
|
|
7b23b6 |
+ (VDAgentFileXferStatusNotEnoughSpace*) msg->data;
|
|
|
7b23b6 |
+ if (!test_agent_cap(channel, VD_AGENT_CAP_FILE_XFER_DETAILED_ERRORS) ||
|
|
|
7b23b6 |
+ msg_hdr->size < sizeof(*msg) + sizeof(*err)) {
|
|
|
7b23b6 |
+ error =
|
|
|
7b23b6 |
+ g_error_new(SPICE_CLIENT_ERROR, SPICE_CLIENT_ERROR_FAILED,
|
|
|
7b23b6 |
+ _("File transfer failed due to lack of free space on remote machine"));
|
|
|
7b23b6 |
+ break;
|
|
|
7b23b6 |
+ }
|
|
|
7b23b6 |
+
|
|
|
7b23b6 |
+ gchar *free_space_str = g_format_size(err->disk_free_space);
|
|
|
7b23b6 |
gchar *file_size_str = g_format_size(spice_file_transfer_task_get_total_bytes(xfer_task));
|
|
|
7b23b6 |
error = g_error_new(SPICE_CLIENT_ERROR, SPICE_CLIENT_ERROR_FAILED,
|
|
|
7b23b6 |
_("File transfer failed due to lack of free space on remote machine "
|
|
|
7b23b6 |
@@ -2110,7 +2120,7 @@ static void main_agent_handle_msg(SpiceChannel *channel,
|
|
|
7b23b6 |
break;
|
|
|
7b23b6 |
}
|
|
|
7b23b6 |
case VD_AGENT_FILE_XFER_STATUS:
|
|
|
7b23b6 |
- main_agent_handle_xfer_status(self, payload);
|
|
|
7b23b6 |
+ main_agent_handle_xfer_status(self, msg, payload);
|
|
|
7b23b6 |
break;
|
|
|
7b23b6 |
default:
|
|
|
7b23b6 |
g_warning("unhandled agent message type: %u (%s), size %u",
|
|
|
7b23b6 |
--
|
|
|
7b23b6 |
2.26.2
|
|
|
7b23b6 |
|