|
 |
76100f |
From 9b98e01c8f5d0dc8faaf3af7b8fc95768e1ff0ad Mon Sep 17 00:00:00 2001
|
|
|
76100f |
From: Frediano Ziglio <freddy77@gmail.com>
|
|
|
76100f |
Date: Wed, 16 Sep 2020 15:50:33 +0100
|
|
|
76100f |
Subject: [PATCH 31/31] channel-main: Handle not terminated host_data and
|
|
|
76100f |
cert_subject_data fields
|
|
|
76100f |
|
|
|
76100f |
host_data and cert_subject_data fields from SPICE messages could be
|
|
|
76100f |
not NUL terminated so using g_strdup can lead to some read overflow.
|
|
|
76100f |
|
|
|
76100f |
This bug was discovered by Uri Lublin.
|
|
|
76100f |
|
|
|
76100f |
Signed-off-by: Frediano Ziglio <freddy77@gmail.com>
|
|
|
76100f |
Acked-by: Uri Lublin <uril@redhat.com>
|
|
|
76100f |
---
|
|
|
76100f |
src/channel-main.c | 5 +++--
|
|
|
76100f |
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
76100f |
|
|
|
76100f |
diff --git a/src/channel-main.c b/src/channel-main.c
|
|
|
76100f |
index 2881d59..5fefded 100644
|
|
|
76100f |
--- a/src/channel-main.c
|
|
|
76100f |
+++ b/src/channel-main.c
|
|
|
76100f |
@@ -2460,10 +2460,11 @@ static void main_migrate_connect(SpiceChannel *channel,
|
|
|
76100f |
mig->src_channel = channel;
|
|
|
76100f |
mig->info = *dst_info;
|
|
|
76100f |
if (dst_info->host_data) {
|
|
|
76100f |
- mig->info.host_data = (void *) g_strdup((char*) dst_info->host_data);
|
|
|
76100f |
+ mig->info.host_data = (void *) g_strndup((char*) dst_info->host_data, dst_info->host_size);
|
|
|
76100f |
}
|
|
|
76100f |
if (dst_info->cert_subject_data) {
|
|
|
76100f |
- mig->info.cert_subject_data = (void *) g_strdup((char*) dst_info->cert_subject_data);
|
|
|
76100f |
+ mig->info.cert_subject_data = (void *) g_strndup((char*) dst_info->cert_subject_data,
|
|
|
76100f |
+ dst_info->cert_subject_size);
|
|
|
76100f |
}
|
|
|
76100f |
mig->from = coroutine_self();
|
|
|
76100f |
mig->do_seamless = do_seamless;
|
|
|
76100f |
--
|
|
|
76100f |
2.28.0
|
|
|
76100f |
|