summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch')
-rw-r--r--meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch53
1 files changed, 0 insertions, 53 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch b/meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch
deleted file mode 100644
index 10a6dacbe5..0000000000
--- a/meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch
+++ /dev/null
@@ -1,53 +0,0 @@
1From b2f1d90530301d7915dddc8a750063757675b21a Mon Sep 17 00:00:00 2001
2From: Petr Matousek <pmatouse@redhat.com>
3Date: Mon, 27 Oct 2014 12:41:44 +0100
4Subject: [PATCH] vnc: sanitize bits_per_pixel from the client
5
6bits_per_pixel that are less than 8 could result in accessing
7non-initialized buffers later in the code due to the expectation
8that bytes_per_pixel value that is used to initialize these buffers is
9never zero.
10
11To fix this check that bits_per_pixel from the client is one of the
12values that the rfb protocol specification allows.
13
14This is CVE-2014-7815.
15
16Upstream-Status: Backport
17
18Signed-off-by: Petr Matousek <pmatouse@redhat.com>
19
20[ kraxel: apply codestyle fix ]
21
22Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
23(cherry picked from commit e6908bfe8e07f2b452e78e677da1b45b1c0f6829)
24Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
25Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
26---
27 ui/vnc.c | 10 ++++++++++
28 1 file changed, 10 insertions(+)
29
30diff --git a/ui/vnc.c b/ui/vnc.c
31index f8d9b7d..87e34ae 100644
32--- a/ui/vnc.c
33+++ b/ui/vnc.c
34@@ -2026,6 +2026,16 @@ static void set_pixel_format(VncState *vs,
35 return;
36 }
37
38+ switch (bits_per_pixel) {
39+ case 8:
40+ case 16:
41+ case 32:
42+ break;
43+ default:
44+ vnc_client_error(vs);
45+ return;
46+ }
47+
48 vs->client_pf.rmax = red_max;
49 vs->client_pf.rbits = hweight_long(red_max);
50 vs->client_pf.rshift = red_shift;
51--
521.9.1
53