From: Andrew Cooper <andrew.cooper3@citrix.com>
Date: Sat, 21 Feb 2015 19:21:11 +0000 (+0000)
Subject: CVE-2014-7815: vnc: sanitize bits_per_pixel from the client
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=3b050c69ee3171997d33bb8b2c111a4ebea169fd;p=qemu-xen-4.6-testing.git

CVE-2014-7815: vnc: sanitize bits_per_pixel from the client

Backport of qemu-upstream:
 * e6908bfe8e07f2b452e78e677da1b45b1c0f6829

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---

diff --git a/vnc.c b/vnc.c
index 48e5c463a..573af3be0 100644
--- a/vnc.c
+++ b/vnc.c
@@ -1616,6 +1616,16 @@ static void set_pixel_format(VncState *vs,
         return;
     }
 
+    switch (bits_per_pixel) {
+    case 8:
+    case 16:
+    case 32:
+        break;
+    default:
+        vnc_client_error(vs);
+        return;
+    }
+
     vs->clientds = vs->serverds;
     vs->clientds.pf.rmax = red_max;
     count_bits(vs->clientds.pf.rbits, red_max);