999512f123
- vdpa: suspend function return 0 when the vdpa device is stopped - vdpa: don't suspend/resume device when vdpa device not started - vdpa: support vdpa device suspend/resume - vdpa: correct param passed in when unregister save - vdpa: set vring enable only if the vring address has already been set - shadow_dev: introduce shadow dev for virtio-net device - revert "tcg/loongarch64: Fix tcg_out_mov() Aborted" - migration: Set downtime_start even for postcopy - gdb-xml: fix duplicate register in arm-neon.xml - iotests: fix default machine type detection - migration: fix RAMBlock add NULL check - s390x: Fix spelling errors - ppc: spelling fixes - hw/scsi/vhost-scsi: don't double close vhostfd on error - virtio/vhost-vsock: don't double close vhostfd, remove redundant cleanup - hw/scsi/vhost-scsi: don't leak vqs on error - hw/i386/pc: Add missing property descriptions - pcie_aer: Don't trigger a LSI if none are defined - pci: Export the pci_intx() function - hw/qdev: Cosmetic around documentation - tests/unit: fix a -Wformat-truncation warning - tests/avocado: mark ReplayKernelNormal.test_mips64el_malta as flaky - i386/sev: Avoid SEV-ES crash due to missing MSR_EFER_LMA bit - ui/vnc-clipboard: fix inflate_buffer - hw/usb/hcd-xhci.c: spelling: tranfer Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com> (cherry picked from commit 68fee7dc06a6beb5f69d951e22a7f16091f269ff)
48 lines
1.5 KiB
Diff
48 lines
1.5 KiB
Diff
From 7f19287be9b468b7065073a31d35c01b2632858d Mon Sep 17 00:00:00 2001
|
|
From: qihao <qihao_yewu@cmss.chinamobile.com>
|
|
Date: Tue, 5 Dec 2023 14:10:50 +0800
|
|
Subject: [PATCH] ui/vnc-clipboard: fix inflate_buffer
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
cheery-pick from ebfbf394671163c14e2b24d98f3927a3151d1aff
|
|
|
|
Commit d921fea338 ("ui/vnc-clipboard: fix infinite loop in
|
|
inflate_buffer (CVE-2023-3255)") removed this hunk, but it is still
|
|
required, because it can happen that stream.avail_in becomes zero
|
|
before coming across a return value of Z_STREAM_END in the loop.
|
|
|
|
This fixes the host->guest direction of the clipboard with noVNC and
|
|
TigerVNC as clients.
|
|
|
|
Fixes: d921fea338 ("ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255)")
|
|
Reported-by: Friedrich Weber <f.weber@proxmox.com>
|
|
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
|
|
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
Message-Id: <20231122125826.228189-1-f.ebner@proxmox.com>
|
|
Signed-off-by: qihao_yewu <qihao_yewu@cmss.chinamobile.com>
|
|
---
|
|
ui/vnc-clipboard.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/ui/vnc-clipboard.c b/ui/vnc-clipboard.c
|
|
index c84599cfdb..2bb1b07c40 100644
|
|
--- a/ui/vnc-clipboard.c
|
|
+++ b/ui/vnc-clipboard.c
|
|
@@ -70,6 +70,11 @@ static uint8_t *inflate_buffer(uint8_t *in, uint32_t in_len, uint32_t *size)
|
|
}
|
|
}
|
|
|
|
+ *size = stream.total_out;
|
|
+ inflateEnd(&stream);
|
|
+
|
|
+ return out;
|
|
+
|
|
err_end:
|
|
inflateEnd(&stream);
|
|
err:
|
|
--
|
|
2.27.0
|
|
|