[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 6/9] ui: avoid risk of 32-bit int overflow in VNC buf
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 6/9] ui: avoid risk of 32-bit int overflow in VNC buffer check |
Date: |
Fri, 16 Feb 2018 12:54:07 +0100 |
From: Daniel P. Berrangé <address@hidden>
For very large framebuffers, it is theoretically possible for the result
of 'vs->throttle_output_offset * VNC_THROTTLE_OUTPUT_LIMIT_SCALE' to
exceed the size of a 32-bit int. For this to happen in practice, the
video RAM would have to be set to a large enough value, which is not
likely today. None the less we can be paranoid against future growth by
using division instead of multiplication when checking the limits.
Reported-by: Laszlo Ersek <address@hidden>
Signed-off-by: Daniel P. Berrangé <address@hidden>
Reviewed-by: Laszlo Ersek <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>
---
ui/vnc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/ui/vnc.c b/ui/vnc.c
index e371710f4f..746293ddfa 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -1579,8 +1579,8 @@ void vnc_write(VncState *vs, const void *data, size_t len)
* handshake, or from the job thread's VncState clone
*/
if (vs->throttle_output_offset != 0 &&
- vs->output.offset > (vs->throttle_output_offset *
- VNC_THROTTLE_OUTPUT_LIMIT_SCALE)) {
+ (vs->output.offset / VNC_THROTTLE_OUTPUT_LIMIT_SCALE) >
+ vs->throttle_output_offset) {
trace_vnc_client_output_limit(vs, vs->ioc, vs->output.offset,
vs->throttle_output_offset);
vnc_disconnect_start(vs);
--
2.9.3
- [Qemu-devel] [PULL 0/9] Ui 20180216 patches, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 6/9] ui: avoid risk of 32-bit int overflow in VNC buffer check,
Gerd Hoffmann <=
- [Qemu-devel] [PULL 4/9] sdl: restore optimized redraw, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 7/9] ui: avoid 'local_err' variable shadowing in VNC SASL auth, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 1/9] vnc: remove bogus object_unref on client socket, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 5/9] sdl2: fix mouse grab, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 3/9] vnc: fix segfault in closed connection handling, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 9/9] ui: extend VNC trottling tracing to SASL codepaths, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 8/9] ui: check VNC audio frequency limit at time of reading from client, Gerd Hoffmann, 2018/02/16
- [Qemu-devel] [PULL 2/9] vnc: add qapi/error.h include to stubs, Gerd Hoffmann, 2018/02/16
- Re: [Qemu-devel] [PULL 0/9] Ui 20180216 patches, Peter Maydell, 2018/02/16