From 2571cec5ebf2a7731fb62354f3bbc4c2c43699a5 Mon Sep 17 00:00:00 2001 From: Frediano Ziglio Date: Tue, 8 Sep 2015 13:07:00 +0100 Subject: [PATCH] prevent integer overflow in red_get_clip_rects Signed-off-by: Frediano Ziglio Acked-by: Christophe Fergeau --- server/red-parse-qxl.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/server/red-parse-qxl.c b/server/red-parse-qxl.c index 5a14b452..f5bdce30 100644 --- a/server/red-parse-qxl.c +++ b/server/red-parse-qxl.c @@ -332,7 +332,12 @@ static SpiceClipRects *red_get_clip_rects(RedMemSlotInfo *slots, int group_id, red_put_data_chunks(&chunks); num_rects = qxl->num_rects; - spice_assert(num_rects * sizeof(QXLRect) == size); + /* The cast is needed to prevent 32 bit integer overflows. + * This check is enough as size is limited to 31 bit + * by red_get_data_chunks_ptr checks. + */ + spice_assert((uint64_t) num_rects * sizeof(QXLRect) == size); + G_STATIC_ASSERT(sizeof(SpiceRect) == sizeof(QXLRect)); red = spice_malloc(sizeof(*red) + num_rects * sizeof(SpiceRect)); red->num_rects = num_rects;