From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Frediano Ziglio Date: Mon, 15 May 2017 15:57:28 +0100 Subject: [PATCH] reds: Avoid integer overflows handling monitor configuration Avoid VDAgentMessage::size integer overflows. Signed-off-by: Frediano Ziglio --- server/reds.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/server/reds.c b/server/reds.c index 95293dd..eda3486 100644 --- a/server/reds.c +++ b/server/reds.c @@ -1024,6 +1024,9 @@ static void reds_on_main_agent_monitors_config( spice_debug("not enough data yet. %d", cmc->buffer_size); return; } + if (msg_header->size < sizeof(VDAgentMonitorsConfig)) { + goto overflow; + } monitors_config = (VDAgentMonitorsConfig *)(cmc->buffer + sizeof(*msg_header)); spice_debug("%s: %d", __func__, monitors_config->num_of_monitors); red_dispatcher_client_monitors_config(monitors_config);