Gerd Hoffmann ab9509ccea spice: make sure we don't overflow ssd->buf ... Related spice-only bug. We have a fixed 16 MB buffer here, being presented to the spice-server as qxl video memory in case spice is used with a non-qxl card. It's also used with qxl in vga mode. When using display resolutions requiring more than 16 MB of memory we are going to overflow that buffer. In theory the guest can write, indirectly via spice-server. The spice-server clears the memory after setting a new video mode though, triggering a segfault in the overflow case, so qemu crashes before the guest has a chance to do something evil. Fix that by switching to dynamic allocation for the buffer. CVE-2014-3615 Cc: qemu-stable@nongnu.org Cc: secalert@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>		2014-09-05 12:19:50 +02:00
..
cocoa.m	ui/cocoa: Honour -show-cursor command line option	2014-06-29 22:00:33 +01:00
console.c	qemu-char: introduce qemu_chr_alloc	2014-06-23 11:12:28 -04:00
curses_keys.h	janitor: add guards to headers	2012-12-19 08:31:31 +01:00
curses.c	input/curses: add kbd delay between keydown and keyup events	2014-06-04 08:40:42 +02:00
cursor_hidden.xpm	ui: move files to ui/ and include/ui/	2012-12-19 08:31:30 +01:00
cursor_left_ptr.xpm	ui: move files to ui/ and include/ui/	2012-12-19 08:31:30 +01:00
cursor.c	ui: move files to ui/ and include/ui/	2012-12-19 08:31:30 +01:00
d3des.c
d3des.h	janitor: add guards to headers	2012-12-19 08:31:31 +01:00
gtk.c	ui/gtk: Restore keyboard focus after Page change	2014-07-11 10:44:00 +02:00
input-keymap.c	input: keymap: add meta keys	2014-05-26 08:42:43 +02:00
input-legacy.c	input: use kbd delays for send_key monitor command	2014-06-04 08:40:41 +02:00
input.c	input: add support for kbd delays	2014-06-04 08:40:41 +02:00
keymaps.c	qemu-char: add support for U-prefixed symbols	2013-11-13 15:48:38 +04:00
keymaps.h
Makefile.objs	input: key mapping helpers	2014-05-16 08:30:11 +02:00
qemu-pixman.c	pixman: render vgafont glyphs into pixman images	2013-04-16 09:03:47 +02:00
qemu-x509.h	ui: move files to ui/ and include/ui/	2012-12-19 08:31:30 +01:00
sdl2-keymap.h	ui/sdl2 : initial port to SDL 2.0 (v2.0)	2014-03-05 09:52:05 +01:00
sdl2.c	sdl2: textinput + terminal	2014-06-02 16:28:58 +02:00
sdl_keysym.h	ui/sdl2 : initial port to SDL 2.0 (v2.0)	2014-03-05 09:52:05 +01:00
sdl_zoom_template.h	sdl: Fix heap smash in sdl_zoom_rgb{16,32} for int > 32 bits	2013-01-15 18:25:30 -06:00
sdl_zoom.c	sdl: Fix heap smash in sdl_zoom_rgb{16,32} for int > 32 bits	2013-01-15 18:25:30 -06:00
sdl_zoom.h
sdl.c	input: sdl: fix guest_cursor logic.	2014-03-10 13:49:44 +01:00
spice-core.c	spice: use console index as display id	2014-09-01 10:19:03 +02:00
spice-display.c	spice: make sure we don't overflow ssd->buf	2014-09-05 12:19:50 +02:00
spice-input.c	spice: input: Fix absolute mouse y coordinates	2014-03-24 08:41:21 +01:00
vgafont.h	ui: move files to ui/ and include/ui/	2012-12-19 08:31:30 +01:00
vnc_keysym.h	qemu-char: add missing characters used in keymaps	2013-11-13 15:48:38 +04:00
vnc-auth-sasl.c	Merge branch 'trivial-patches' of git://github.com/stefanha/qemu	2012-10-06 18:54:14 +02:00
vnc-auth-sasl.h	aio / timers: Untangle include files	2013-08-22 19:10:27 +02:00
vnc-auth-vencrypt.c	aio / timers: Untangle include files	2013-08-22 19:10:27 +02:00
vnc-auth-vencrypt.h
vnc-enc-hextile-template.h	pixman/vnc: use pixman images in vnc.	2012-11-01 14:00:04 +01:00
vnc-enc-hextile.c	pixman/vnc: remove dead code.	2012-11-01 14:00:05 +01:00
vnc-enc-tight.c	vnc-enc-tight: Fix divide-by-zero in tight_detect_smooth_image{16,24,32}	2014-06-02 16:30:52 +02:00
vnc-enc-tight.h
vnc-enc-zlib.c	Use glib memory allocation and free functions	2011-08-20 23:01:08 -05:00
vnc-enc-zrle-template.c	vnc: Add ZRLE and ZYWRLE encodings.	2011-02-23 16:28:28 -06:00
vnc-enc-zrle.c	pixman/vnc: use pixman images in vnc.	2012-11-01 14:00:04 +01:00
vnc-enc-zrle.h	vnc: Add ZRLE and ZYWRLE encodings.	2011-02-23 16:28:28 -06:00
vnc-enc-zywrle-template.c	Fix spelling in comments, documentation and messages	2011-12-14 11:09:44 +00:00
vnc-enc-zywrle.h	misc: Spelling and grammar fixes in comments	2013-10-26 13:06:45 +04:00
vnc-jobs.c	vnc dirty tracking optinizations.	2014-03-11 10:53:17 +00:00
vnc-jobs.h	vnc: add missing static	2012-11-01 19:49:45 +01:00
vnc-palette.c	ui/vnc-palette.c: Include headers it needs	2012-12-06 09:17:05 +01:00
vnc-palette.h	misc: move include files to include/qemu/	2012-12-19 08:32:39 +01:00
vnc-tls.c	vnc: Drop superfluous conditionals around g_free()	2014-06-19 12:48:07 +02:00
vnc-tls.h	misc: move include files to include/qemu/	2012-12-19 08:32:39 +01:00
vnc-ws.c	aio / timers: Untangle include files	2013-08-22 19:10:27 +02:00
vnc-ws.h	TLS support for VNC Websockets	2013-05-03 12:04:57 -05:00
vnc.c	vnc update fix	2014-07-25 09:43:31 +02:00
vnc.h	vnc update fix	2014-07-25 09:43:31 +02:00
x_keymap.c
x_keymap.h