Package: spice / 0.12.5-1+deb8u5

CVE-2017-7506-2.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
From ff2b4ef70181087d5abd50bad76d026ec5088a93 Mon Sep 17 00:00:00 2001
From: Frediano Ziglio <fziglio@redhat.com>
Date: Mon, 15 May 2017 15:57:28 +0100
Subject: [spice-server 2/3] reds: Avoid integer overflows handling monitor
 configuration

Avoid VDAgentMessage::size integer overflows.

Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
[carnil: adjust context for backport to 0.12.5]
---
 server/reds.c | 3 +++
 1 file changed, 3 insertions(+)

--- a/server/reds.c
+++ b/server/reds.c
@@ -1020,6 +1020,9 @@ static void reds_on_main_agent_monitors_
         spice_debug("not enough data yet. %d\n", cmc->buffer_size);
         return;
     }
+    if (msg_header->size < sizeof(VDAgentMonitorsConfig)) {
+        goto overflow;
+    }
     monitors_config = (VDAgentMonitorsConfig *)(cmc->buffer + sizeof(*msg_header));
     spice_debug("%s: %d\n", __func__, monitors_config->num_of_monitors);
     red_dispatcher_client_monitors_config(monitors_config);