|
 |
e2c81d |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
73b8f2 |
From: Frediano Ziglio <fziglio@redhat.com>
|
|
|
73b8f2 |
Date: Tue, 8 Sep 2015 13:09:35 +0100
|
|
|
e2c81d |
Subject: [PATCH] Prevent 32 bit integer overflow in bitmap_consistent
|
|
|
73b8f2 |
|
|
|
73b8f2 |
The overflow may lead to buffer overflow as the row size computed from
|
|
|
73b8f2 |
width (bitmap->x) can be bigger than the size in bytes (bitmap->stride).
|
|
|
73b8f2 |
This can make spice-server accept the invalid sizes.
|
|
|
73b8f2 |
|
|
|
73b8f2 |
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
|
|
|
73b8f2 |
Acked-by: Christophe Fergeau <cfergeau@redhat.com>
|
|
|
73b8f2 |
---
|
|
|
73b8f2 |
server/red_parse_qxl.c | 9 +++++----
|
|
|
73b8f2 |
1 file changed, 5 insertions(+), 4 deletions(-)
|
|
|
73b8f2 |
|
|
|
73b8f2 |
diff --git a/server/red_parse_qxl.c b/server/red_parse_qxl.c
|
|
|
73b8f2 |
index 01cba0f..3385f52 100644
|
|
|
73b8f2 |
--- a/server/red_parse_qxl.c
|
|
|
73b8f2 |
+++ b/server/red_parse_qxl.c
|
|
|
73b8f2 |
@@ -357,11 +357,12 @@ static const char *bitmap_format_to_string(int format)
|
|
|
73b8f2 |
return "unknown";
|
|
|
73b8f2 |
}
|
|
|
73b8f2 |
|
|
|
73b8f2 |
-static const int MAP_BITMAP_FMT_TO_BITS_PER_PIXEL[] = {0, 1, 1, 4, 4, 8, 16, 24, 32, 32, 8};
|
|
|
73b8f2 |
+static const unsigned int MAP_BITMAP_FMT_TO_BITS_PER_PIXEL[] =
|
|
|
73b8f2 |
+ {0, 1, 1, 4, 4, 8, 16, 24, 32, 32, 8};
|
|
|
73b8f2 |
|
|
|
73b8f2 |
static int bitmap_consistent(SpiceBitmap *bitmap)
|
|
|
73b8f2 |
{
|
|
|
73b8f2 |
- int bpp;
|
|
|
73b8f2 |
+ unsigned int bpp;
|
|
|
73b8f2 |
|
|
|
73b8f2 |
if (bitmap->format >= SPICE_N_ELEMENTS(MAP_BITMAP_FMT_TO_BITS_PER_PIXEL)) {
|
|
|
73b8f2 |
spice_warning("wrong format specified for image\n");
|
|
|
73b8f2 |
@@ -370,8 +371,8 @@ static int bitmap_consistent(SpiceBitmap *bitmap)
|
|
|
73b8f2 |
|
|
|
73b8f2 |
bpp = MAP_BITMAP_FMT_TO_BITS_PER_PIXEL[bitmap->format];
|
|
|
73b8f2 |
|
|
|
73b8f2 |
- if (bitmap->stride < ((bitmap->x * bpp + 7) / 8)) {
|
|
|
73b8f2 |
- spice_error("image stride too small for width: %d < ((%d * %d + 7) / 8) (%s=%d)\n",
|
|
|
73b8f2 |
+ if (bitmap->stride < (((uint64_t) bitmap->x * bpp + 7u) / 8u)) {
|
|
|
73b8f2 |
+ spice_warning("image stride too small for width: %d < ((%d * %d + 7) / 8) (%s=%d)\n",
|
|
|
73b8f2 |
bitmap->stride, bitmap->x, bpp,
|
|
|
73b8f2 |
bitmap_format_to_string(bitmap->format),
|
|
|
73b8f2 |
bitmap->format);
|