]> xenbits.xensource.com Git - qemu-upstream-4.5-testing.git/commit
vnc: sanitize bits_per_pixel from the client
authorPetr Matousek <pmatouse@redhat.com>
Mon, 27 Oct 2014 11:41:44 +0000 (12:41 +0100)
committerStefano Stabellini <stefano.stabellini@eu.citrix.com>
Thu, 5 Mar 2015 12:24:34 +0000 (12:24 +0000)
commit99aa8a7e0a05cec2eb7562ab7107b27c6b042b08
tree806578f1fa548959e73d308e5fb725f5e5ebdd8a
parent94d09f22b790648493038f964d2fc171b26f52f5
vnc: sanitize bits_per_pixel from the client

bits_per_pixel that are less than 8 could result in accessing
non-initialized buffers later in the code due to the expectation
that bytes_per_pixel value that is used to initialize these buffers is
never zero.

To fix this check that bits_per_pixel from the client is one of the
values that the rfb protocol specification allows.

This is CVE-2014-7815.

Signed-off-by: Petr Matousek <pmatouse@redhat.com>
[ kraxel: apply codestyle fix ]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
ui/vnc.c