1*4882a593SmuzhiyunFrom a15f7d9913d050fb72a79bbbefa5c2329d92e71d Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Hitendra Prajapati <hprajapati@mvista.com> 3*4882a593SmuzhiyunDate: Tue, 8 Nov 2022 17:10:00 +0530 4*4882a593SmuzhiyunSubject: [PATCH] CVE-2022-3165 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunUpstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/d307040b18] 7*4882a593SmuzhiyunCVE: CVE-2022-3165 8*4882a593SmuzhiyunSigned-off-by: Hitendra Prajapati <hprajapati@mvista.com> 9*4882a593Smuzhiyun 10*4882a593Smuzhiyunui/vnc-clipboard: fix integer underflow in vnc_client_cut_text_ext 11*4882a593Smuzhiyun 12*4882a593SmuzhiyunExtended ClientCutText messages start with a 4-byte header. If len < 4, 13*4882a593Smuzhiyunan integer underflow occurs in vnc_client_cut_text_ext. The result is 14*4882a593Smuzhiyunused to decompress data in a while loop in inflate_buffer, leading to 15*4882a593SmuzhiyunCPU consumption and denial of service. Prevent this by checking dlen in 16*4882a593Smuzhiyunprotocol_client_msg. 17*4882a593Smuzhiyun 18*4882a593SmuzhiyunFixes: CVE-2022-3165 19*4882a593Smuzhiyun 20*4882a593Smuzhiyun("ui/vnc: clipboard support") 21*4882a593SmuzhiyunReported-by: default avatarTangPeng <tangpeng@qianxin.com> 22*4882a593SmuzhiyunSigned-off-by: Mauro Matteo Cascella's avatarMauro Matteo Cascella <mcascell@redhat.com> 23*4882a593SmuzhiyunMessage-Id: <20220925204511.1103214-1-mcascell@redhat.com> 24*4882a593SmuzhiyunSigned-off-by: Gerd Hoffmann's avatarGerd Hoffmann <kraxel@redhat.com> 25*4882a593Smuzhiyun--- 26*4882a593Smuzhiyun ui/vnc.c | 11 ++++++++--- 27*4882a593Smuzhiyun 1 file changed, 8 insertions(+), 3 deletions(-) 28*4882a593Smuzhiyun 29*4882a593Smuzhiyundiff --git a/ui/vnc.c b/ui/vnc.c 30*4882a593Smuzhiyunindex af02522e8..a14b6861b 100644 31*4882a593Smuzhiyun--- a/ui/vnc.c 32*4882a593Smuzhiyun+++ b/ui/vnc.c 33*4882a593Smuzhiyun@@ -2442,8 +2442,8 @@ static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len) 34*4882a593Smuzhiyun if (len == 1) { 35*4882a593Smuzhiyun return 8; 36*4882a593Smuzhiyun } 37*4882a593Smuzhiyun+ uint32_t dlen = abs(read_s32(data, 4)); 38*4882a593Smuzhiyun if (len == 8) { 39*4882a593Smuzhiyun- uint32_t dlen = abs(read_s32(data, 4)); 40*4882a593Smuzhiyun if (dlen > (1 << 20)) { 41*4882a593Smuzhiyun error_report("vnc: client_cut_text msg payload has %u bytes" 42*4882a593Smuzhiyun " which exceeds our limit of 1MB.", dlen); 43*4882a593Smuzhiyun@@ -2456,8 +2456,13 @@ static int protocol_client_msg(VncState *vs, uint8_t *data, size_t len) 44*4882a593Smuzhiyun } 45*4882a593Smuzhiyun 46*4882a593Smuzhiyun if (read_s32(data, 4) < 0) { 47*4882a593Smuzhiyun- vnc_client_cut_text_ext(vs, abs(read_s32(data, 4)), 48*4882a593Smuzhiyun- read_u32(data, 8), data + 12); 49*4882a593Smuzhiyun+ if (dlen < 4) { 50*4882a593Smuzhiyun+ error_report("vnc: malformed payload (header less than 4 bytes)" 51*4882a593Smuzhiyun+ " in extended clipboard pseudo-encoding."); 52*4882a593Smuzhiyun+ vnc_client_error(vs); 53*4882a593Smuzhiyun+ break; 54*4882a593Smuzhiyun+ } 55*4882a593Smuzhiyun+ vnc_client_cut_text_ext(vs, dlen, read_u32(data, 8), data + 12); 56*4882a593Smuzhiyun break; 57*4882a593Smuzhiyun } 58*4882a593Smuzhiyun vnc_client_cut_text(vs, read_u32(data, 4), data + 8); 59*4882a593Smuzhiyun-- 60*4882a593Smuzhiyun2.25.1 61*4882a593Smuzhiyun 62