[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 10/11] ui/vnc: Fix problem with sending too many byte
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 10/11] ui/vnc: Fix problem with sending too many bytes as server name |
Date: |
Wed, 4 Jan 2017 12:21:22 +0100 |
From: Thomas Huth <address@hidden>
If the buffer is not big enough, snprintf() does not return the number
of bytes that have been written to the buffer, but the number of bytes
that would be needed for writing the whole string. By using this value
for the following vnc_write() calls, we send some junk at the end of
the name in case the qemu_name is longer than 1017 bytes, which could
confuse the VNC clients. Fix this by adding an additional size check
here.
Buglink: https://bugs.launchpad.net/qemu/+bug/1637447
Signed-off-by: Thomas Huth <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>
---
ui/vnc.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/ui/vnc.c b/ui/vnc.c
index 2c28a59..29aa9c4 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2459,10 +2459,14 @@ static int protocol_client_init(VncState *vs, uint8_t
*data, size_t len)
pixel_format_message(vs);
- if (qemu_name)
+ if (qemu_name) {
size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
- else
+ if (size > sizeof(buf)) {
+ size = sizeof(buf);
+ }
+ } else {
size = snprintf(buf, sizeof(buf), "QEMU");
+ }
vnc_write_u32(vs, size);
vnc_write(vs, buf, size);
--
1.8.3.1
- [Qemu-devel] [PULL 00/11] ui patch queue, Gerd Hoffmann, 2017/01/04
- [Qemu-devel] [PULL 01/11] ui/gtk: fix crash at startup when no console is available, Gerd Hoffmann, 2017/01/04
- [Qemu-devel] [PULL 04/11] console: add API to get underlying gui window ID, Gerd Hoffmann, 2017/01/04
- [Qemu-devel] [PULL 03/11] ps2: Fix lost scancodes by recent changes, Gerd Hoffmann, 2017/01/04
- [Qemu-devel] [PULL 07/11] egl-helpers: Change file licensing to LGPLv2, Gerd Hoffmann, 2017/01/04
- [Qemu-devel] [PULL 10/11] ui/vnc: Fix problem with sending too many bytes as server name,
Gerd Hoffmann <=
- [Qemu-devel] [PULL 02/11] ui: use evdev keymap when running under wayland, Gerd Hoffmann, 2017/01/04
- [Qemu-devel] [PULL 08/11] gtk: avoid oob array access, Gerd Hoffmann, 2017/01/04
- [Qemu-devel] [PULL 06/11] sdl2: set window ID, Gerd Hoffmann, 2017/01/04
- [Qemu-devel] [PULL 05/11] console: move window ID code from baum to sdl, Gerd Hoffmann, 2017/01/04
- [Qemu-devel] [PULL 09/11] ui: drop unused MOUSE_EVENT_WHEEL{UP, DN} defines, Gerd Hoffmann, 2017/01/04
- [Qemu-devel] [PULL 11/11] curses: Fix compiler warnings (Mingw-w64 redefinition of macro KEY_EVENT), Gerd Hoffmann, 2017/01/04