[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-stable] [PATCH 43/81] ui/vnc: Fix problem with sending too many by
From: |
Michael Roth |
Subject: |
[Qemu-stable] [PATCH 43/81] ui/vnc: Fix problem with sending too many bytes as server name |
Date: |
Mon, 20 Mar 2017 18:08:07 -0500 |
From: Thomas Huth <address@hidden>
If the buffer is not big enough, snprintf() does not return the number
of bytes that have been written to the buffer, but the number of bytes
that would be needed for writing the whole string. By using this value
for the following vnc_write() calls, we send some junk at the end of
the name in case the qemu_name is longer than 1017 bytes, which could
confuse the VNC clients. Fix this by adding an additional size check
here.
Buglink: https://bugs.launchpad.net/qemu/+bug/1637447
Signed-off-by: Thomas Huth <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 97efe4f961dcf5a0126baa75e8a6bff66d33186f)
Signed-off-by: Michael Roth <address@hidden>
---
ui/vnc.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/ui/vnc.c b/ui/vnc.c
index 2c28a59..29aa9c4 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2459,10 +2459,14 @@ static int protocol_client_init(VncState *vs, uint8_t
*data, size_t len)
pixel_format_message(vs);
- if (qemu_name)
+ if (qemu_name) {
size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
- else
+ if (size > sizeof(buf)) {
+ size = sizeof(buf);
+ }
+ } else {
size = snprintf(buf, sizeof(buf), "QEMU");
+ }
vnc_write_u32(vs, size);
vnc_write(vs, buf, size);
--
2.7.4
- [Qemu-stable] [PATCH 38/81] virtio: fix vq->inuse recalc after migr, (continued)
- [Qemu-stable] [PATCH 38/81] virtio: fix vq->inuse recalc after migr, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 03/81] 9pfs: remove side-effects in local_open() and local_opendir(), Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 46/81] exec: Add missing rcu_read_unlock, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 50/81] tcg/aarch64: Fix addsub2 for 0+C, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 41/81] ui/gtk: fix crash at startup when no console is available, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 33/81] 9pfs: fix O_PATH build break with older glibc versions, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 34/81] 9pfs: fix vulnerability in openat_dir() and local_unlinkat_common(), Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 45/81] virtio-crypto: fix possible integer and heap overflow, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 37/81] pci: fix error message for express slots, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 39/81] 9pfs: fix crash when fsdev is missing, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 43/81] ui/vnc: Fix problem with sending too many bytes as server name,
Michael Roth <=
- [Qemu-stable] [PATCH 42/81] scsi-block: fix direction of BYTCHK test for VERIFY commands, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 44/81] qemu-thread: fix qemu_thread_set_name() race in qemu_thread_create(), Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 48/81] x86: ioapic: fix fail migration when irqchip=split, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 49/81] char: fix ctrl-a b not working, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 36/81] balloon: Don't balloon roms, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 32/81] 9pfs: don't use AT_EMPTY_PATH in local_set_cred_passthrough(), Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 52/81] ui: use evdev keymap when running under wayland, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 54/81] block/iscsi: avoid data corruption with cache=writeback, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 57/81] cpu-exec: fix icount out-of-bounds access, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 59/81] target/s390x: use "qemu" cpu model in user mode, Michael Roth, 2017/03/20