1From a15f7d9913d050fb72a79bbbefa5c2329d92e71d Mon Sep 17 00:00:00 2001 2From: Hitendra Prajapati <hprajapati@mvista.com> 3Date: Tue, 8 Nov 2022 17:10:00 +0530 4Subject: [PATCH] CVE-2022-3165 5 6Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/d307040b18] 7CVE: CVE-2022-3165 8Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> 9 10ui/vnc-clipboard: fix integer underflow in vnc_client_cut_text_ext 11 12Extended ClientCutText messages start with a 4-byte header. If len < 4, 13an integer underflow occurs in vnc_client_cut_text_ext. The result is 14used to decompress data in a while loop in inflate_buffer, leading to 15CPU consumption and denial of service. Prevent this by checking dlen in 16protocol_client_msg. 17 18Fixes: CVE-2022-3165 19 20("ui/vnc: clipboard support") 21Reported-by: default avatarTangPeng <tangpeng@qianxin.com> 22Signed-off-by: Mauro Matteo Cascella's avatarMauro Matteo Cascella <mcascell@redhat.com> 23Message-Id: <20220925204511.1103214-1-mcascell@redhat.com> 24Signed-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com> 25--- 26 ui/vnc.c | 11 ++++++++--- 27 1 file changed, 8 insertions(+), 3 deletions(-) 28 29diff --git a/ui/vnc.c b/ui/vnc.c 30index af02522e8..a14b6861b 100644 31--- a/ui/vnc.c 32+++ b/ui/vnc.c 33@@ -2442,8 +2442,8 @@ static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len) 34 if (len == 1) { 35 return 8; 36 } 37+ uint32_t dlen = abs(read_s32(data, 4)); 38 if (len == 8) { 39- uint32_t dlen = abs(read_s32(data, 4)); 40 if (dlen > (1 << 20)) { 41 error_report("vnc: client_cut_text msg payload has %u bytes" 42 " which exceeds our limit of 1MB.", dlen); 43@@ -2456,8 +2456,13 @@ static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len) 44 } 45 46 if (read_s32(data, 4) < 0) { 47- vnc_client_cut_text_ext(vs, abs(read_s32(data, 4)), 48- read_u32(data, 8), data + 12); 49+ if (dlen < 4) { 50+ error_report("vnc: malformed payload (header less than 4 bytes)" 51+ " in extended clipboard pseudo-encoding."); 52+ vnc_client_error(vs); 53+ break; 54+ } 55+ vnc_client_cut_text_ext(vs, dlen, read_u32(data, 8), data + 12); 56 break; 57 } 58 vnc_client_cut_text(vs, read_u32(data, 4), data + 8); 59-- 602.25.1 61 62