]> xenbits.xensource.com Git - qemu-upstream-4.3-testing.git/commit
vnc: sanitize bits_per_pixel from the client
authorPetr Matousek <pmatouse@redhat.com>
Mon, 27 Oct 2014 11:41:44 +0000 (12:41 +0100)
committerStefano Stabellini <stefano.stabellini@eu.citrix.com>
Thu, 5 Mar 2015 13:21:57 +0000 (13:21 +0000)
commit080b7f3a6f11bb724926d9aab364c4f660960489
tree040aca9282d14755b40b9fb53d91e287a0ec8ebc
parentd36794af8ad947a2d3eb33df2137980366b63d49
vnc: sanitize bits_per_pixel from the client

bits_per_pixel that are less than 8 could result in accessing
non-initialized buffers later in the code due to the expectation
that bytes_per_pixel value that is used to initialize these buffers is
never zero.

To fix this check that bits_per_pixel from the client is one of the
values that the rfb protocol specification allows.

This is CVE-2014-7815.

Signed-off-by: Petr Matousek <pmatouse@redhat.com>
[ kraxel: apply codestyle fix ]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
ui/vnc.c