From 214a0c88ecbac0229ddc2d7067a8a3ce9821df5c Mon Sep 17 00:00:00 2001 From: Frediano Ziglio Date: Tue, 8 Sep 2015 10:00:37 +0100 Subject: [PATCH 51/64] Fix buffer reading overflow Not security risk as just for read. However, this could be used to attempt integer overflows in the following lines. Signed-off-by: Frediano Ziglio Acked-by: Christophe Fergeau --- server/red_parse_qxl.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/server/red_parse_qxl.c b/server/red_parse_qxl.c index a7ca71d..01cba0f 100644 --- a/server/red_parse_qxl.c +++ b/server/red_parse_qxl.c @@ -361,7 +361,14 @@ static const int MAP_BITMAP_FMT_TO_BITS_PER_PIXEL[] = {0, 1, 1, 4, 4, 8, 16, 24, static int bitmap_consistent(SpiceBitmap *bitmap) { - int bpp = MAP_BITMAP_FMT_TO_BITS_PER_PIXEL[bitmap->format]; + int bpp; + + if (bitmap->format >= SPICE_N_ELEMENTS(MAP_BITMAP_FMT_TO_BITS_PER_PIXEL)) { + spice_warning("wrong format specified for image\n"); + return FALSE; + } + + bpp = MAP_BITMAP_FMT_TO_BITS_PER_PIXEL[bitmap->format]; if (bitmap->stride < ((bitmap->x * bpp + 7) / 8)) { spice_error("image stride too small for width: %d < ((%d * %d + 7) / 8) (%s=%d)\n", -- 2.4.3