]> xenbits.xensource.com Git - qemu-upstream-4.4-testing.git/commit
vnc: sanitize bits_per_pixel from the client
authorPetr Matousek <pmatouse@redhat.com>
Mon, 27 Oct 2014 11:41:44 +0000 (12:41 +0100)
committerStefano Stabellini <stefano.stabellini@eu.citrix.com>
Thu, 5 Mar 2015 14:53:22 +0000 (14:53 +0000)
commitf67b16a7fe5b1823606be9ffa2dce3d408a5c3f1
tree3f1fa95739d020ed69bee04d66a65cd825ba0a77
parent97082344dd7916998571c93c4f7f994471f96c3d
vnc: sanitize bits_per_pixel from the client

bits_per_pixel that are less than 8 could result in accessing
non-initialized buffers later in the code due to the expectation
that bytes_per_pixel value that is used to initialize these buffers is
never zero.

To fix this check that bits_per_pixel from the client is one of the
values that the rfb protocol specification allows.

This is CVE-2014-7815.

Signed-off-by: Petr Matousek <pmatouse@redhat.com>
[ kraxel: apply codestyle fix ]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
ui/vnc.c