55 lines
2.2 KiB
Diff
55 lines
2.2 KiB
Diff
|
From: Markus Koschany <apo@debian.org>
|
||
|
|
Date: Mon, 13 Feb 2017 21:38:02 +0100
|
||
|
|
Subject: CVE-2016-9577 and CVE-2016-9578
|
||
|
|
|
||
|
|
Bug-Debian: https://bugs.debian.org/854336
|
||
|
|
Origin: http://pkgs.fedoraproject.org/cgit/rpms/spice.git/commit/?id=d919d639ae5f83a9735a04d843eed675f9357c0d
|
||
|
|
---
|
||
|
|
server/main_channel.c | 3 +++
|
||
|
|
server/reds.c | 11 ++++++++++-
|
||
|
|
2 files changed, 13 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/server/main_channel.c b/server/main_channel.c
|
||
|
|
index 0ecc9df..1fc3915 100644
|
||
|
|
--- a/server/main_channel.c
|
||
|
|
+++ b/server/main_channel.c
|
||
|
|
@@ -1026,6 +1026,9 @@ static uint8_t *main_channel_alloc_msg_rcv_buf(RedChannelClient *rcc,
|
||
|
|
|
||
|
|
if (type == SPICE_MSGC_MAIN_AGENT_DATA) {
|
||
|
|
return reds_get_agent_data_buffer(mcc, size);
|
||
|
|
+ } else if (size > sizeof(main_chan->recv_buf)) {
|
||
|
|
+ /* message too large, caller will log a message and close the connection */
|
||
|
|
+ return NULL;
|
||
|
|
} else {
|
||
|
|
return main_chan->recv_buf;
|
||
|
|
}
|
||
|
|
diff --git a/server/reds.c b/server/reds.c
|
||
|
|
index 61bf735..4c60f58 100644
|
||
|
|
--- a/server/reds.c
|
||
|
|
+++ b/server/reds.c
|
||
|
|
@@ -2110,6 +2110,14 @@ static void reds_handle_read_link_done(void *opaque)
|
||
|
|
link_mess->num_channel_caps = GUINT32_FROM_LE(link_mess->num_channel_caps);
|
||
|
|
link_mess->num_common_caps = GUINT32_FROM_LE(link_mess->num_common_caps);
|
||
|
|
|
||
|
|
+ /* Prevent DoS. Currently we defined only 13 capabilities,
|
||
|
|
+ * I expect 1024 to be valid for quite a lot time */
|
||
|
|
+ if (link_mess->num_channel_caps > 1024 || link_mess->num_common_caps > 1024) {
|
||
|
|
+ reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
|
||
|
|
+ reds_link_free(link);
|
||
|
|
+ return;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
num_caps = link_mess->num_common_caps + link_mess->num_channel_caps;
|
||
|
|
caps = (uint32_t *)((uint8_t *)link_mess + link_mess->caps_offset);
|
||
|
|
|
||
|
|
@@ -2202,7 +2210,8 @@ static void reds_handle_read_header_done(void *opaque)
|
||
|
|
|
||
|
|
reds->peer_minor_version = header->minor_version;
|
||
|
|
|
||
|
|
- if (header->size < sizeof(SpiceLinkMess)) {
|
||
|
|
+ /* the check for 4096 is to avoid clients to cause arbitrary big memory allocations */
|
||
|
|
+ if (header->size < sizeof(SpiceLinkMess) || header->size > 4096) {
|
||
|
|
reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
|
||
|
|
spice_warning("bad size %u", header->size);
|
||
|
|
reds_link_free(link);
|