mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ui/vnc-enc-tight: Avoid dynamic stack allocation

Browse Source 
Use autofree heap allocation instead of variable-length
array on the stack.

The codebase has very few VLAs, and if we can get rid of them all we
can make the compiler error on new additions.  This is a defensive
measure against security bugs where an on-stack dynamic allocation
isn't correctly size-checked (e.g.  CVE-2021-3527).

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
[PMM: expanded commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230818151057.1541189-4-peter.maydell@linaro.org>
This commit is contained in:
Philippe Mathieu-Daudé 2023-08-18 16:10:57 +01:00 committed by Marc-André Lureau
parent e12acaf75d
commit dd0439e149
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ui/vnc-enc-tight.c
View File

@ -1097,13 +1097,13 @@ static int send_palette_rect(VncState *vs, int x, int y,
switch (vs->client_pf.bytes_per_pixel) { switch (vs->client_pf.bytes_per_pixel) {
case 4: case 4:
{ {
size_t old_offset, offset; size_t old_offset, offset, palette_sz = palette_size(palette);
uint32_t header[palette_size(palette)]; g_autofree uint32_t *header = g_new(uint32_t, palette_sz);
struct palette_cb_priv priv = { vs, (uint8_t *)header }; struct palette_cb_priv priv = { vs, (uint8_t *)header };
old_offset = vs->output.offset; old_offset = vs->output.offset;
palette_iter(palette, write_palette, &priv); palette_iter(palette, write_palette, &priv);
vnc_write(vs, header, sizeof(header)); vnc_write(vs, header, palette_sz * sizeof(uint32_t));
if (vs->tight->pixel24) { if (vs->tight->pixel24) {
tight_pack24(vs, vs->output.buffer + old_offset, colors, &offset); tight_pack24(vs, vs->output.buffer + old_offset, colors, &offset);
@ -1115,11 +1115,12 @@ static int send_palette_rect(VncState *vs, int x, int y,
} }
case 2: case 2:
{ {
uint16_t header[palette_size(palette)]; size_t palette_sz = palette_size(palette);
g_autofree uint16_t *header = g_new(uint16_t, palette_sz);
struct palette_cb_priv priv = { vs, (uint8_t *)header }; struct palette_cb_priv priv = { vs, (uint8_t *)header };
palette_iter(palette, write_palette, &priv); palette_iter(palette, write_palette, &priv);
vnc_write(vs, header, sizeof(header)); vnc_write(vs, header, palette_sz * sizeof(uint16_t));
tight_encode_indexed_rect16(vs->tight->tight.buffer, w * h, palette); tight_encode_indexed_rect16(vs->tight->tight.buffer, w * h, palette);
break; break;
} }