diff --git a/SOURCES/0085-Prevent-possible-DoS-attempts-during-protocol-handsh.patch b/SOURCES/0085-Prevent-possible-DoS-attempts-during-protocol-handsh.patch
new file mode 100644
index 0000000..38c9db7
--- /dev/null
+++ b/SOURCES/0085-Prevent-possible-DoS-attempts-during-protocol-handsh.patch
@@ -0,0 +1,57 @@
+From 198ad1ea078c1b74c9e24617c509c6a408eb822e Mon Sep 17 00:00:00 2001
+From: Frediano Ziglio <fziglio@redhat.com>
+Date: Mon, 28 Nov 2016 13:15:58 +0000
+Subject: [PATCH] Prevent possible DoS attempts during protocol handshake
+
+The limit for link message is specified using a 32 bit unsigned integer.
+This could cause possible DoS due to excessive memory allocations and
+some possible crashes.
+For instance a value >= 2^31 causes a spice_assert to be triggered in
+async_read_handler (reds-stream.c) due to an integer overflow at this
+line:
+
+ int n = async->end - async->now;
+
+This could be easily triggered with a program like
+
+ #!/usr/bin/env python
+
+ import socket
+ import time
+ from struct import pack
+
+ server = '127.0.0.1'
+ port = 5900
+
+ s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+ s.connect((server, port))
+ data = pack('<4sIII', 'REDQ', 2, 2, 0xaaaaaaaa)
+ s.send(data)
+
+ time.sleep(1)
+
+without requiring any authentication (the same can be done
+with TLS).
+
+Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
+---
+ server/reds.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/server/reds.c b/server/reds.c
+index 9e1d5e7..1c215ed 100644
+--- a/server/reds.c
++++ b/server/reds.c
+@@ -2826,7 +2826,8 @@ static void reds_handle_read_header_done(void *opaque)
+
+ reds->peer_minor_version = header->minor_version;
+
+- if (header->size < sizeof(SpiceLinkMess)) {
++ /* the check for 4096 is to avoid clients to cause arbitrary big memory allocations */
++ if (header->size < sizeof(SpiceLinkMess) || header->size > 4096) {
+ reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
+ spice_warning("bad size %u", header->size);
+ reds_link_free(link);
+--
+2.9.3
+
diff --git a/SOURCES/0086-Prevent-integer-overflows-in-capability-checks.patch b/SOURCES/0086-Prevent-integer-overflows-in-capability-checks.patch
new file mode 100644
index 0000000..83c914d
--- /dev/null
+++ b/SOURCES/0086-Prevent-integer-overflows-in-capability-checks.patch
@@ -0,0 +1,40 @@
+From 665f7dddd2d534500d3b3e3e1f8135c49479ad25 Mon Sep 17 00:00:00 2001
+From: Frediano Ziglio <fziglio@redhat.com>
+Date: Mon, 28 Nov 2016 13:15:58 +0000
+Subject: [PATCH] Prevent integer overflows in capability checks
+
+The limits for capabilities are specified using 32 bit unsigned integers.
+This could cause possible integer overflows causing buffer overflows.
+For instance the sum of num_common_caps and num_caps can be 0 avoiding
+additional checks.
+As the link message is now capped to 4096 and the capabilities are
+contained in the link message, this commit limits the capabilities
+to 1024 (capabilities are expressed in number of uint32_t items).
+
+Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
+---
+ server/reds.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/server/reds.c b/server/reds.c
+index 64f07cc..f5542f6 100644
+--- a/server/reds.c
++++ b/server/reds.c
+@@ -2744,6 +2744,14 @@ static void reds_handle_read_link_done(void *opaque)
+ uint32_t num_caps = link_mess->num_common_caps + link_mess->num_channel_caps;
+ int auth_selection;
+
++ /* Prevent integer overflows. Currently we defined only 13 capabilities,
++ * I expect 1024 to be valid for quite a lot time */
++ if (link_mess->num_channel_caps > 1024 || link_mess->num_common_caps > 1024) {
++ reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
++ reds_link_free(link);
++ return;
++ }
++
+ if (num_caps && (num_caps * sizeof(uint32_t) + link_mess->caps_offset >
+ link->link_header.size ||
+ link_mess->caps_offset < sizeof(*link_mess))) {
+--
+2.9.3
+
diff --git a/SOURCES/0087-main-channel-Prevent-overflow-reading-messages-from-.patch b/SOURCES/0087-main-channel-Prevent-overflow-reading-messages-from-.patch
new file mode 100644
index 0000000..a61dd04
--- /dev/null
+++ b/SOURCES/0087-main-channel-Prevent-overflow-reading-messages-from-.patch
@@ -0,0 +1,30 @@
+From c4e3113a8df53ba60c36829c8b2d583c2d5e529d Mon Sep 17 00:00:00 2001
+From: Frediano Ziglio <fziglio@redhat.com>
+Date: Tue, 29 Nov 2016 16:46:56 +0000
+Subject: [PATCH] main-channel: Prevent overflow reading messages from client
+
+Caller is supposed the function return a buffer able to store
+size bytes.
+
+Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
+---
+ server/main_channel.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/server/main_channel.c b/server/main_channel.c
+index 54718ba..bedff46 100644
+--- a/server/main_channel.c
++++ b/server/main_channel.c
+@@ -1030,6 +1030,9 @@ static uint8_t *main_channel_alloc_msg_rcv_buf(RedChannelClient *rcc,
+
+ if (type == SPICE_MSGC_MAIN_AGENT_DATA) {
+ return reds_get_agent_data_buffer(mcc, size);
++ } else if (size > sizeof(main_chan->recv_buf)) {
++ /* message too large, caller will log a message and close the connection */
++ return NULL;
+ } else {
+ return main_chan->recv_buf;
+ }
+--
+2.9.3
+
diff --git a/SPECS/spice.spec b/SPECS/spice.spec
index 88a3616..86854af 100644
--- a/SPECS/spice.spec
+++ b/SPECS/spice.spec
@@ -1,6 +1,6 @@
Name: spice
Version: 0.12.4
-Release: 19%{?dist}
+Release: 20%{?dist}
Summary: Implements the SPICE protocol
Group: User Interface/Desktops
License: LGPLv2+
@@ -90,6 +90,9 @@ Patch81: 0081-sound-do-not-modify-client-state-on-migration.patch
Patch82: 0082-char-device-spice_char_device_write_to_device-protec.patch
Patch83: 0083-server-allows-to-set-maximum-monitors.patch
Patch84: 0084-Call-migrate_end_complete-after-falling-back-to-swit.patch
+Patch85: 0085-Prevent-possible-DoS-attempts-during-protocol-handsh.patch
+Patch86: 0086-Prevent-integer-overflows-in-capability-checks.patch
+Patch87: 0087-main-channel-Prevent-overflow-reading-messages-from-.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=613529
@@ -177,6 +180,12 @@ mkdir -p %{buildroot}%{_libexecdir}
%changelog
+* Fri Dec 09 2016 Frediano Ziglio <fziglio@redhat.com> - 0.12.4-20
+- Fix buffer overflow in main_channel_alloc_msg_rcv_buf when reading large
+ messages.
+ Resolves: CVE-2016-9577
+- Fix remote DoS via crafted message.
+ Resolves: CVE-2016-9578
* Fri Sep 09 2016 Christophe Fergeau <cfergeau@redhat.com> 0.12.4-19
- Ensure SPICE_MIGRATE_COMPLETED is sent in all cases when it's needed.
Resolves: rhbz#1352836