From c2cdd1daf8edceec8adbb456dca656efe3648eec Mon Sep 17 00:00:00 2001 From: Frediano Ziglio Date: Thu, 17 Sep 2015 14:28:36 +0100 Subject: [PATCH 56/57] Prevent data_size to be set independently from data There was not check for data_size field so one could set data to a small set of data and data_size much bigger than size of data leading to buffer overflow. Signed-off-by: Frediano Ziglio --- server/red_parse_qxl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/server/red_parse_qxl.c b/server/red_parse_qxl.c index c1df8e8..8e3dd55 100644 --- a/server/red_parse_qxl.c +++ b/server/red_parse_qxl.c @@ -1391,6 +1391,7 @@ static int red_get_cursor(RedMemSlotInfo *slots, int group_id, size = red_get_data_chunks_ptr(slots, group_id, get_memslot_id(slots, addr), &chunks, &qxl->chunk); + red->data_size = MIN(red->data_size, size); data = red_linearize_chunk(&chunks, size, &free_data); red_put_data_chunks(&chunks); if (free_data) { -- 2.4.3