diff options
Diffstat (limited to 'meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch')
-rw-r--r-- | meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch | 53 |
1 files changed, 0 insertions, 53 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch b/meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch deleted file mode 100644 index 10a6dacbe5..0000000000 --- a/meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch +++ /dev/null | |||
@@ -1,53 +0,0 @@ | |||
1 | From b2f1d90530301d7915dddc8a750063757675b21a Mon Sep 17 00:00:00 2001 | ||
2 | From: Petr Matousek <pmatouse@redhat.com> | ||
3 | Date: Mon, 27 Oct 2014 12:41:44 +0100 | ||
4 | Subject: [PATCH] vnc: sanitize bits_per_pixel from the client | ||
5 | |||
6 | bits_per_pixel that are less than 8 could result in accessing | ||
7 | non-initialized buffers later in the code due to the expectation | ||
8 | that bytes_per_pixel value that is used to initialize these buffers is | ||
9 | never zero. | ||
10 | |||
11 | To fix this check that bits_per_pixel from the client is one of the | ||
12 | values that the rfb protocol specification allows. | ||
13 | |||
14 | This is CVE-2014-7815. | ||
15 | |||
16 | Upstream-Status: Backport | ||
17 | |||
18 | Signed-off-by: Petr Matousek <pmatouse@redhat.com> | ||
19 | |||
20 | [ kraxel: apply codestyle fix ] | ||
21 | |||
22 | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> | ||
23 | (cherry picked from commit e6908bfe8e07f2b452e78e677da1b45b1c0f6829) | ||
24 | Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> | ||
25 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
26 | --- | ||
27 | ui/vnc.c | 10 ++++++++++ | ||
28 | 1 file changed, 10 insertions(+) | ||
29 | |||
30 | diff --git a/ui/vnc.c b/ui/vnc.c | ||
31 | index f8d9b7d..87e34ae 100644 | ||
32 | --- a/ui/vnc.c | ||
33 | +++ b/ui/vnc.c | ||
34 | @@ -2026,6 +2026,16 @@ static void set_pixel_format(VncState *vs, | ||
35 | return; | ||
36 | } | ||
37 | |||
38 | + switch (bits_per_pixel) { | ||
39 | + case 8: | ||
40 | + case 16: | ||
41 | + case 32: | ||
42 | + break; | ||
43 | + default: | ||
44 | + vnc_client_error(vs); | ||
45 | + return; | ||
46 | + } | ||
47 | + | ||
48 | vs->client_pf.rmax = red_max; | ||
49 | vs->client_pf.rbits = hweight_long(red_max); | ||
50 | vs->client_pf.rshift = red_shift; | ||
51 | -- | ||
52 | 1.9.1 | ||
53 | |||