From 5324e83bf636b995522088d508e61ba5543777f4 Mon Sep 17 00:00:00 2001 From: Frediano Ziglio Date: Thu, 19 Mar 2020 06:07:39 +0000 Subject: [PATCH 2/9] channel-main: Check proper size and caps handling VD_AGENT_FILE_XFER_STATUS_NOT_ENOUGH_SPACE VDAgentFileXferStatusMessage message can or cannot contain detailed information attached to it. Detect this correctly checking capabilities and flags. This fixes a small buffer overflow reading in case the details are off the payload. Signed-off-by: Frediano Ziglio Acked-by: Victor Toso (cherry picked from commit b13fd0664075c951f5418f5828c0803408ad664d) --- meson.build | 2 +- src/channel-main.c | 16 +++++++++++++--- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/meson.build b/meson.build index 995268b..8098989 100644 --- a/meson.build +++ b/meson.build @@ -81,7 +81,7 @@ endforeach # # check for mandatory dependencies # -spice_protocol_version='>= 0.14.1' +spice_protocol_version='>= 0.14.2' glib_version = '2.46' glib_version_info = '>= @0@'.format(glib_version) diff --git a/src/channel-main.c b/src/channel-main.c index e89b813..c4fe02b 100644 --- a/src/channel-main.c +++ b/src/channel-main.c @@ -1891,6 +1891,7 @@ static void file_xfer_read_async_cb(GObject *source_object, /* coroutine context */ static void main_agent_handle_xfer_status(SpiceMainChannel *channel, + const VDAgentMessage *msg_hdr, VDAgentFileXferStatusMessage *msg) { SpiceFileTransferTask *xfer_task; @@ -1917,8 +1918,17 @@ static void main_agent_handle_xfer_status(SpiceMainChannel *channel, _("The spice agent reported an error during the file transfer")); break; case VD_AGENT_FILE_XFER_STATUS_NOT_ENOUGH_SPACE: { - uint64_t *free_space = SPICE_ALIGNED_CAST(uint64_t *, msg->data); - gchar *free_space_str = g_format_size(*free_space); + const VDAgentFileXferStatusNotEnoughSpace *err = + (VDAgentFileXferStatusNotEnoughSpace*) msg->data; + if (!test_agent_cap(channel, VD_AGENT_CAP_FILE_XFER_DETAILED_ERRORS) || + msg_hdr->size < sizeof(*msg) + sizeof(*err)) { + error = + g_error_new(SPICE_CLIENT_ERROR, SPICE_CLIENT_ERROR_FAILED, + _("File transfer failed due to lack of free space on remote machine")); + break; + } + + gchar *free_space_str = g_format_size(err->disk_free_space); gchar *file_size_str = g_format_size(spice_file_transfer_task_get_total_bytes(xfer_task)); error = g_error_new(SPICE_CLIENT_ERROR, SPICE_CLIENT_ERROR_FAILED, _("File transfer failed due to lack of free space on remote machine " @@ -2110,7 +2120,7 @@ static void main_agent_handle_msg(SpiceChannel *channel, break; } case VD_AGENT_FILE_XFER_STATUS: - main_agent_handle_xfer_status(self, payload); + main_agent_handle_xfer_status(self, msg, payload); break; default: g_warning("unhandled agent message type: %u (%s), size %u", -- 2.26.2