mirror of
https://gitlab.com/qemu-project/qemu.git
synced 2024-12-08 22:02:44 +03:00
ui/vnc-enc-tight: Avoid dynamic stack allocation
Use autofree heap allocation instead of variable-length array on the stack. The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> [PMM: expanded commit message] Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230818151057.1541189-4-peter.maydell@linaro.org>
This commit is contained in:
parent
e12acaf75d
commit
dd0439e149
@ -1097,13 +1097,13 @@ static int send_palette_rect(VncState *vs, int x, int y,
|
||||
switch (vs->client_pf.bytes_per_pixel) {
|
||||
case 4:
|
||||
{
|
||||
size_t old_offset, offset;
|
||||
uint32_t header[palette_size(palette)];
|
||||
size_t old_offset, offset, palette_sz = palette_size(palette);
|
||||
g_autofree uint32_t *header = g_new(uint32_t, palette_sz);
|
||||
struct palette_cb_priv priv = { vs, (uint8_t *)header };
|
||||
|
||||
old_offset = vs->output.offset;
|
||||
palette_iter(palette, write_palette, &priv);
|
||||
vnc_write(vs, header, sizeof(header));
|
||||
vnc_write(vs, header, palette_sz * sizeof(uint32_t));
|
||||
|
||||
if (vs->tight->pixel24) {
|
||||
tight_pack24(vs, vs->output.buffer + old_offset, colors, &offset);
|
||||
@ -1115,11 +1115,12 @@ static int send_palette_rect(VncState *vs, int x, int y,
|
||||
}
|
||||
case 2:
|
||||
{
|
||||
uint16_t header[palette_size(palette)];
|
||||
size_t palette_sz = palette_size(palette);
|
||||
g_autofree uint16_t *header = g_new(uint16_t, palette_sz);
|
||||
struct palette_cb_priv priv = { vs, (uint8_t *)header };
|
||||
|
||||
palette_iter(palette, write_palette, &priv);
|
||||
vnc_write(vs, header, sizeof(header));
|
||||
vnc_write(vs, header, palette_sz * sizeof(uint16_t));
|
||||
tight_encode_indexed_rect16(vs->tight->tight.buffer, w * h, palette);
|
||||
break;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user