|
 |
73b8f2 |
From 8f60fc6ec611aa6ad6fa31f3dfc8027462dbb442 Mon Sep 17 00:00:00 2001
|
|
|
73b8f2 |
From: Frediano Ziglio <fziglio@redhat.com>
|
|
|
73b8f2 |
Date: Tue, 8 Sep 2015 13:06:03 +0100
|
|
|
73b8f2 |
Subject: [PATCH 53/57] Fix some possible overflows in red_get_string for 32
|
|
|
73b8f2 |
bit
|
|
|
73b8f2 |
|
|
|
73b8f2 |
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
|
|
|
73b8f2 |
Acked-by: Christophe Fergeau <cfergeau@redhat.com>
|
|
|
73b8f2 |
---
|
|
|
73b8f2 |
server/red_parse_qxl.c | 8 +++++++-
|
|
|
73b8f2 |
1 file changed, 7 insertions(+), 1 deletion(-)
|
|
|
73b8f2 |
|
|
|
73b8f2 |
diff --git a/server/red_parse_qxl.c b/server/red_parse_qxl.c
|
|
|
73b8f2 |
index f183248..668ce10 100644
|
|
|
73b8f2 |
--- a/server/red_parse_qxl.c
|
|
|
73b8f2 |
+++ b/server/red_parse_qxl.c
|
|
|
73b8f2 |
@@ -895,6 +895,11 @@ static SpiceString *red_get_string(RedMemSlotInfo *slots, int group_id,
|
|
|
73b8f2 |
glyphs++;
|
|
|
73b8f2 |
glyph_size = start->height * ((start->width * bpp + 7u) / 8u);
|
|
|
73b8f2 |
red_size += sizeof(SpiceRasterGlyph *) + SPICE_ALIGN(sizeof(SpiceRasterGlyph) + glyph_size, 4);
|
|
|
73b8f2 |
+ /* do the test correctly, we know end - start->data[0] cannot
|
|
|
73b8f2 |
+ * overflow, don't use start->data[glyph_size] to test for
|
|
|
73b8f2 |
+ * buffer overflow as this on 32 bit can cause overflow
|
|
|
73b8f2 |
+ * on the pointer arithmetic */
|
|
|
73b8f2 |
+ spice_assert(glyph_size <= (char*) end - (char*) &start->data[0]);
|
|
|
73b8f2 |
start = (QXLRasterGlyph*)(&start->data[glyph_size]);
|
|
|
73b8f2 |
}
|
|
|
73b8f2 |
spice_assert(start <= end);
|
|
|
73b8f2 |
@@ -915,7 +920,8 @@ static SpiceString *red_get_string(RedMemSlotInfo *slots, int group_id,
|
|
|
73b8f2 |
red_get_point_ptr(&glyph->render_pos, &start->render_pos);
|
|
|
73b8f2 |
red_get_point_ptr(&glyph->glyph_origin, &start->glyph_origin);
|
|
|
73b8f2 |
glyph_size = glyph->height * ((glyph->width * bpp + 7u) / 8u);
|
|
|
73b8f2 |
- spice_assert((QXLRasterGlyph*)(&start->data[glyph_size]) <= end);
|
|
|
73b8f2 |
+ /* see above for similar test */
|
|
|
73b8f2 |
+ spice_assert(glyph_size <= (char*) end - (char*) &start->data[0]);
|
|
|
73b8f2 |
memcpy(glyph->data, start->data, glyph_size);
|
|
|
73b8f2 |
start = (QXLRasterGlyph*)(&start->data[glyph_size]);
|
|
|
73b8f2 |
glyph = (SpiceRasterGlyph*)
|
|
|
73b8f2 |
--
|
|
|
73b8f2 |
2.4.3
|
|
|
73b8f2 |
|