[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v1 1/7] io: monitor encoutput buffer size from w
From: |
Eric Blake |
Subject: |
Re: [Qemu-devel] [PATCH v1 1/7] io: monitor encoutput buffer size from websocket GSource |
Date: |
Tue, 10 Oct 2017 11:51:00 -0500 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 |
On 10/10/2017 10:43 AM, Daniel P. Berrange wrote:
> The websocket GSource is monitoring the size of the rawoutput
> buffer to determine if the channel can accepts more writes.
> The rawoutput buffer, however, is merely a temporary staging
> buffer before data is copied into the encoutput buffer. This
s/This/Thus/
> its size will always be zero when the GSource runs.
>
> This flaw causes the encoutput buffer to grow without bound
> if the other end of the underlying data channel doesn't
> read data being sent. This can be seen with VNC if a client
> is on a slow WAN link and the guest OS is sending many screen
> updates. A malicious VNC client can act like it is on a slow
> link by playing a video in the guest and then reading data
> very slowly, causing QEMU host memory to expand arbitrarily.
>
> This issue is assigned CVE-2017-????, publically reported in
If we get the assignment in time, I'm sure you'll update this before the
PULL request.
>
> https://bugs.launchpad.net/qemu/+bug/1718964
>
> Signed-off-by: Daniel P. Berrange <address@hidden>
> ---
> io/channel-websock.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
Reviewed-by: Eric Blake <address@hidden>
>
> diff --git a/io/channel-websock.c b/io/channel-websock.c
> index d1d471f86e..04bcc059cd 100644
> --- a/io/channel-websock.c
> +++ b/io/channel-websock.c
> @@ -28,7 +28,7 @@
> #include <time.h>
>
>
> -/* Max amount to allow in rawinput/rawoutput buffers */
> +/* Max amount to allow in rawinput/encoutput buffers */
> #define QIO_CHANNEL_WEBSOCK_MAX_BUFFER 8192
>
> #define QIO_CHANNEL_WEBSOCK_CLIENT_KEY_LEN 24
> @@ -1208,7 +1208,7 @@ qio_channel_websock_source_check(GSource *source)
> if (wsource->wioc->rawinput.offset || wsource->wioc->io_eof) {
> cond |= G_IO_IN;
> }
> - if (wsource->wioc->rawoutput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) {
> + if (wsource->wioc->encoutput.offset < QIO_CHANNEL_WEBSOCK_MAX_BUFFER) {
> cond |= G_IO_OUT;
> }
>
>
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3266
Virtualization: qemu.org | libvirt.org
signature.asc
Description: OpenPGP digital signature
- [Qemu-devel] [PATCH v1 0/7] Limit websockets memory usage & other bug fixes, Daniel P. Berrange, 2017/10/10
- [Qemu-devel] [PATCH v1 2/7] io: simplify websocket ping reply handling, Daniel P. Berrange, 2017/10/10
- [Qemu-devel] [PATCH v1 3/7] io: get rid of qio_channel_websock_encode helper method, Daniel P. Berrange, 2017/10/10
- [Qemu-devel] [PATCH v1 1/7] io: monitor encoutput buffer size from websocket GSource, Daniel P. Berrange, 2017/10/10
- Re: [Qemu-devel] [PATCH v1 1/7] io: monitor encoutput buffer size from websocket GSource,
Eric Blake <=
- [Qemu-devel] [PATCH v1 5/7] io: get rid of bounce buffering in websock write path, Daniel P. Berrange, 2017/10/10
- [Qemu-devel] [PATCH v1 4/7] io: pass a struct iovec into qio_channel_websock_encode, Daniel P. Berrange, 2017/10/10
- [Qemu-devel] [PATCH v1 7/7] io: add trace points for websocket HTTP protocol headers, Daniel P. Berrange, 2017/10/10
- [Qemu-devel] [PATCH v1 6/7] io: cope with websock 'Connection' header having multiple values, Daniel P. Berrange, 2017/10/10