From ef1b6ff7b82e15d759e5415b8e35b92bb1a4c206 Mon Sep 17 00:00:00 2001 From: Frediano Ziglio Date: Wed, 29 Apr 2020 15:11:38 +0100 Subject: [PATCH] quic: Check RLE lengths Avoid buffer overflows decoding images. On compression we compute lengths till end of line so it won't cause regressions. Proved by fuzzing the code. Signed-off-by: Frediano Ziglio Acked-by: Uri Lublin --- subprojects/spice-common/common//quic_tmpl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/subprojects/spice-common/common//quic_tmpl.c b/subprojects/spice-common/common//quic_tmpl.c index ecd6f3f187c7..ebae992d642a 100644 --- a/subprojects/spice-common/common//quic_tmpl.c +++ b/subprojects/spice-common/common//quic_tmpl.c @@ -563,7 +563,11 @@ static void FNAME_DECL(uncompress_row_seg)(const PIXEL * const prev_row, do_run: state->waitcnt = stopidx - i; run_index = i; - run_end = i + decode_state_run(encoder, state); + run_end = decode_state_run(encoder, state); + if (run_end < 0 || run_end > (end - i)) { + encoder->usr->error(encoder->usr, "wrong RLE\n"); + } + run_end += i; for (; i < run_end; i++) { UNCOMPRESS_PIX_START(&cur_row[i]); -- GitLab