aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPetr Matousek <pmatouse@redhat.com>2014-10-27 12:41:44 +0100
committerGerd Hoffmann <kraxel@redhat.com>2014-10-28 11:51:04 +0100
commite6908bfe8e07f2b452e78e677da1b45b1c0f6829 (patch)
tree0afb5e0d8482271421d00a28574f15dd0066a664
parent3e9418e160cd8901c83a3c88967158084f5b5c03 (diff)
vnc: sanitize bits_per_pixel from the client
bits_per_pixel that are less than 8 could result in accessing non-initialized buffers later in the code due to the expectation that bytes_per_pixel value that is used to initialize these buffers is never zero. To fix this check that bits_per_pixel from the client is one of the values that the rfb protocol specification allows. This is CVE-2014-7815. Signed-off-by: Petr Matousek <pmatouse@redhat.com> [ kraxel: apply codestyle fix ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-rw-r--r--ui/vnc.c10
1 files changed, 10 insertions, 0 deletions
diff --git a/ui/vnc.c b/ui/vnc.c
index 0fe6eff1b8..8bca59798c 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2026,6 +2026,16 @@ static void set_pixel_format(VncState *vs,
return;
}
+ switch (bits_per_pixel) {
+ case 8:
+ case 16:
+ case 32:
+ break;
+ default:
+ vnc_client_error(vs);
+ return;
+ }
+
vs->client_pf.rmax = red_max;
vs->client_pf.rbits = hweight_long(red_max);
vs->client_pf.rshift = red_shift;