From 5aaaa5bd91261a6b61fcaa75585f8446b9eeb036 Mon Sep 17 00:00:00 2001
From: Uri Lublin <uril@redhat.com>
Date: Tue, 31 Jul 2018 16:18:15 +0300
Subject: [PATCH 1/4] start streaming: check num_codecs

The server sends StreamMsgStartStop to tell spice-streaming-agent
to start streaming and a list of available codecs.

The first uint8_t is the number of codecs.
Each following uint8_t is a codec.

This patch checks that the number of codecs in the message, as
reported by the server, is not too large.
---
 src/spice-streaming-agent.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/spice-streaming-agent.cpp b/src/spice-streaming-agent.cpp
index 1121f35..9ebbf5d 100644
--- a/src/spice-streaming-agent.cpp
+++ b/src/spice-streaming-agent.cpp
@@ -95,6 +95,11 @@ static void handle_stream_start_stop(StreamPort &stream_port, uint32_t len)
     syslog(LOG_INFO, "GOT START_STOP message -- request to %s streaming\n",
            streaming_requested ? "START" : "STOP");
     client_codecs.clear();
+    const int mnc = len - 1; /* max num codecs, see struct StreamMsgStartStop */
+    if (msg[0] > mnc) {
+        throw std::runtime_error("num_codecs=" + std::to_string(msg[0]) +
+                                 " > max_num_codecs=" + std::to_string(mnc));
+    }
     for (int i = 1; i <= msg[0]; ++i) {
         client_codecs.insert((SpiceVideoCodecType) msg[i]);
     }
-- 
2.17.1