4c956bd81e
Pixman returns a signed int for the image width/height, but the VNC protocol only permits a unsigned int16. Effective framebuffer size is determined by the guest, limited by the video RAM size, so the dimensions are unlikely to exceed the range of an unsigned int16, but this is not currently validated. With the current use of 'int' for client width/height, the calculation of offsets in vnc_update_throttle_offset() suffers from integer size promotion and sign extension, causing coverity warnings *** CID 1385147: Integer handling issues (SIGN_EXTENSION) /ui/vnc.c: 979 in vnc_update_throttle_offset() 973 * than that the client would already suffering awful audio 974 * glitches, so dropping samples is no worse really). 975 */ 976 static void vnc_update_throttle_offset(VncState *vs) 977 { 978 size_t offset = >>> CID 1385147: Integer handling issues (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "vs->client_pf.bytes_per_pixel" with type "unsigned char" (8 bits, unsigned) is promoted in "vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 979 vs->client_width * vs->client_height * vs->client_pf.bytes_per_pixel; Change client_width / client_height to be a size_t to avoid sign extension and integer promotion. Then validate that dimensions are in range wrt the RFB protocol u16 limits. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20180118155254.17053-1-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> |
||
---|---|---|
.. | ||
keycodemapdb@10739aa260 | ||
shader | ||
cocoa.m | ||
console-gl.c | ||
console.c | ||
curses_keys.h | ||
curses.c | ||
cursor_hidden.xpm | ||
cursor_left_ptr.xpm | ||
cursor.c | ||
egl-context.c | ||
egl-headless.c | ||
egl-helpers.c | ||
gtk-egl.c | ||
gtk-gl-area.c | ||
gtk.c | ||
input-keymap.c | ||
input-legacy.c | ||
input-linux.c | ||
input.c | ||
keymaps.c | ||
keymaps.h | ||
Makefile.objs | ||
qemu-pixman.c | ||
qemu-x509.h | ||
sdl2-2d.c | ||
sdl2-gl.c | ||
sdl2-input.c | ||
sdl2-keymap.h | ||
sdl2.c | ||
sdl_keysym.h | ||
sdl_zoom_template.h | ||
sdl_zoom.c | ||
sdl_zoom.h | ||
sdl.c | ||
shader.c | ||
spice-core.c | ||
spice-display.c | ||
spice-input.c | ||
trace-events | ||
vgafont.h | ||
vnc_keysym.h | ||
vnc-auth-sasl.c | ||
vnc-auth-sasl.h | ||
vnc-auth-vencrypt.c | ||
vnc-auth-vencrypt.h | ||
vnc-enc-hextile-template.h | ||
vnc-enc-hextile.c | ||
vnc-enc-tight.c | ||
vnc-enc-tight.h | ||
vnc-enc-zlib.c | ||
vnc-enc-zrle-template.c | ||
vnc-enc-zrle.c | ||
vnc-enc-zrle.h | ||
vnc-enc-zywrle-template.c | ||
vnc-enc-zywrle.h | ||
vnc-jobs.c | ||
vnc-jobs.h | ||
vnc-palette.c | ||
vnc-palette.h | ||
vnc-ws.c | ||
vnc-ws.h | ||
vnc.c | ||
vnc.h | ||
x_keymap.c | ||
x_keymap.h |