Go to file
Marc-Andre Lureau 2ec0791beb smartcard: add a ref to item before adding to pipe
There is an unref when the message is sent.

This is related to CVE-2016-0749

==17204== ERROR: AddressSanitizer: heap-use-after-free on address 0x6008000144a8 at pc 0x7fffee0ce245 bp 0x7fffffffc630 sp 0x7fffffffc620
READ of size 4 at 0x6008000144a8 thread T0
    #0 0x7fffee0ce244 in smartcard_unref_vsc_msg_item /home/elmarco/src/spice/spice/server/smartcard.c:608
    #1 0x7fffee0cb451 in smartcard_unref_msg_to_client /home/elmarco/src/spice/spice/server/smartcard.c:178
    #2 0x7fffedfcdf14 in spice_char_device_read_from_device /home/elmarco/src/spice/spice/server/char-device.c:330
    #3 0x7fffedfd1763 in spice_char_device_wakeup /home/elmarco/src/spice/spice/server/char-device.c:901
    #4 0x7fffee05da98 in spice_server_char_device_wakeup /home/elmarco/src/spice/spice/server/reds.c:2990
    #5 0x55555593fa34 in spice_chr_write /home/elmarco/src/qemu/spice-qemu-char.c:189
    #6 0x5555559375f1 in qemu_chr_fe_write /home/elmarco/src/qemu/qemu-char.c:220
    #7 0x555555b3b682 in ccid_card_vscard_send_msg.isra.2 /home/elmarco/src/qemu/hw/usb/ccid-card-passthru.c:76
    #8 0x555555b3c466 in ccid_card_vscard_send_error /home/elmarco/src/qemu/hw/usb/ccid-card-passthru.c:91
    #9 0x555555b3c466 in ccid_card_vscard_handle_message /home/elmarco/src/qemu/hw/usb/ccid-card-passthru.c:242
    #10 0x555555b3c466 in ccid_card_vscard_read /home/elmarco/src/qemu/hw/usb/ccid-card-passthru.c:289
    #11 0x55555593f169 in vmc_write /home/elmarco/src/qemu/spice-qemu-char.c:41
    #12 0x7fffedfcee6d in spice_char_device_write_to_device /home/elmarco/src/spice/spice/server/char-device.c:477
    #13 0x7fffedfcfd31 in spice_char_device_write_buffer_add /home/elmarco/src/spice/spice/server/char-device.c:629
    #14 0x7fffee0ce9df in smartcard_channel_write_to_reader /home/elmarco/src/spice/spice/server/smartcard.c:675
    #15 0x7fffee0cc7db in smartcard_char_device_notify_reader_add /home/elmarco/src/spice/spice/server/smartcard.c:341
    #16 0x7fffee0ce4f3 in smartcard_add_reader /home/elmarco/src/spice/spice/server/smartcard.c:648
    #17 0x7fffee0cf2e2 in smartcard_channel_handle_message /home/elmarco/src/spice/spice/server/smartcard.c:763
    #18 0x7fffedffe21f in red_peer_handle_incoming /home/elmarco/src/spice/spice/server/red-channel.c:307
    #19 0x7fffedffe4f6 in red_channel_client_receive /home/elmarco/src/spice/spice/server/red-channel.c:325
    #20 0x7fffee00726c in red_channel_client_event /home/elmarco/src/spice/spice/server/red-channel.c:1566
    #21 0x555555c3c53d in qemu_iohandler_poll /home/elmarco/src/qemu/iohandler.c:143
    #22 0x555555c3b800 in main_loop_wait /home/elmarco/src/qemu/main-loop.c:504
    #23 0x5555556f160c in main_loop /home/elmarco/src/qemu/vl.c:1818
    #24 0x5555556f160c in main /home/elmarco/src/qemu/vl.c:4394
    #25 0x7fffed7d0b14 in __libc_start_main /usr/src/debug/glibc-2.17-c758a686/csu/libc-start.c:274
    #26 0x5555556f9c20 in _start (/home/elmarco/src/qemu/x86_64-softmmu/qemu-system-x86_64+0x1a5c20)
0x6008000144a8 is located 24 bytes inside of 40-byte region [0x600800014490,0x6008000144b8)
freed by thread T0 here:
    #0 0x7ffff4e61009 in __interceptor_free /usr/src/debug/gcc-4.8.5-20150702/obj-x86_64-redhat-linux/x86_64-redhat-linux/libsanitizer/asan/../../../../libsanitizer/asan/asan_malloc_linux.cc:61
    #1 0x7fffee0ce2a1 in smartcard_unref_vsc_msg_item /home/elmarco/src/spice/spice/server/smartcard.c:610
    #2 0x7fffee0cdd58 in smartcard_channel_release_pipe_item /home/elmarco/src/spice/spice/server/smartcard.c:548
    #3 0x7fffee000668 in red_channel_client_release_item /home/elmarco/src/spice/spice/server/red-channel.c:602
    #4 0x7fffee0006ef in red_channel_client_release_sent_item /home/elmarco/src/spice/spice/server/red-channel.c:609
    #5 0x7fffee0007b5 in red_channel_peer_on_out_msg_done /home/elmarco/src/spice/spice/server/red-channel.c:620
    #6 0x7fffedffed7e in red_peer_handle_outgoing /home/elmarco/src/spice/spice/server/red-channel.c:385
    #7 0x7fffee0057bb in red_channel_client_send /home/elmarco/src/spice/spice/server/red-channel.c:1294
    #8 0x7fffee0076e6 in red_channel_client_begin_send_message /home/elmarco/src/spice/spice/server/red-channel.c:1605
    #9 0x7fffee0cdccd in smartcard_channel_send_item /home/elmarco/src/spice/spice/server/smartcard.c:541
    #10 0x7fffee000570 in red_channel_client_send_item /home/elmarco/src/spice/spice/server/red-channel.c:588
    #11 0x7fffee005bfb in red_channel_client_push /home/elmarco/src/spice/spice/server/red-channel.c:1347
    #12 0x7fffee007ef7 in red_channel_client_pipe_add_push /home/elmarco/src/spice/spice/server/red-channel.c:1673
    #13 0x7fffee0cde4d in smartcard_channel_client_pipe_add_push /home/elmarco/src/spice/spice/server/smartcard.c:571
    #14 0x7fffee0cb567 in smartcard_send_msg_to_client /home/elmarco/src/spice/spice/server/smartcard.c:187
    #15 0x7fffedfcdba2 in spice_char_device_send_msg_to_clients /home/elmarco/src/spice/spice/server/char-device.c:282
    #16 0x7fffedfcdea4 in spice_char_device_read_from_device /home/elmarco/src/spice/spice/server/char-device.c:329
    #17 0x7fffedfd1763 in spice_char_device_wakeup /home/elmarco/src/spice/spice/server/char-device.c:901
    #18 0x7fffee05da98 in spice_server_char_device_wakeup /home/elmarco/src/spice/spice/server/reds.c:2990
    #19 0x55555593fa34 in spice_chr_write /home/elmarco/src/qemu/spice-qemu-char.c:189

Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
2016-07-07 18:39:54 +02:00
build-aux Update git-version-gen to latest version 2013-12-11 16:32:36 +01:00
docs syntax-check: manual: Remove duplicate word 2015-12-11 18:39:49 +01:00
m4 m4: WARN FLAGS: Drop -Wenum-compare 2015-03-15 13:57:12 +02:00
server smartcard: add a ref to item before adding to pipe 2016-07-07 18:39:54 +02:00
spice-common@6ddcd5468a Update spice-common 2016-04-14 14:39:43 +02:00
tests tests/migrate.py: add --vdagent 2011-08-23 17:01:14 +03:00
tools Add casts for compatibility purposes 2012-02-14 10:44:49 +02:00
uncrustify_cfg fresh start 2009-10-14 15:06:41 +02:00
.gitignore Update the .gitignore files for the new manual, 2015-12-11 18:39:27 +01:00
.gitmodules Use the spice-common submodule 2012-03-25 18:59:10 +02:00
.mailmap syntax-check: Add missing AUTHORS 2015-12-11 18:39:49 +01:00
.travis.yml Add travis CI file 2015-12-11 18:48:58 +01:00
AUTHORS syntax-check: Add missing AUTHORS 2015-12-11 18:39:49 +01:00
autogen.sh build-sys: Pass --enable-python-checks when running autogen.sh 2015-04-23 10:38:24 +02:00
cfg.mk syntax-check: Exclude png files from sc_prohibit_empty_lines_at_EOF 2015-12-11 18:41:19 +01:00
ChangeLog fresh start 2009-10-14 15:06:41 +02:00
configure.ac Update libtool versioning for 0.12.7 release 2016-04-14 14:50:13 +02:00
COPYING Relicense everything from GPL to LGPL 2.1+ 2010-04-13 22:22:15 +02:00
GNUmakefile Add a 'syntax-check' make target 2012-01-13 18:12:00 +02:00
maint.mk syntax-check: Ignore .png files in sc_trailing_blank test 2015-12-11 18:39:49 +01:00
Makefile.am client: Remove client code 2014-12-03 11:31:17 +01:00
NEWS Update NEWS file for 0.12.7 2016-04-14 16:01:58 +02:00
README Revise the spice client and server to use the new snd_codec functions in spice-common. 2014-01-02 12:34:34 +01:00
spice-server.pc.in build-sys: Require a new enough spice-protocol in .pc file 2015-08-26 11:01:09 +02:00
TODO.multiclient Remove trailing whitespace from end of lines 2012-01-13 18:11:59 +02:00

   SPICE: Simple Protocol for Independent Computing Environments
   =============================================================

SPICE is a remote display system built for virtual environments which
allows you to view a computing 'desktop' environment not only on the
machine where it is running, but from anywhere on the Internet and
from a wide variety of machine architectures.

Installation
------------

The SPICE package uses GNU autotools, so the build install process
follows the standard process documented in the INSTALL file. As a
quick start you can do

  ./configure --prefix=/usr --sysconfdir=/etc \
        --localstatedir=/var --libdir=/usr/lib
  make
  sudo make install

Or to install into a private user specific location

  ./configure --prefix=$HOME/spice
  make
  make install

The following mandatory dependancies are required in order to
build SPICE

    Spice protocol >= 0.9.0
    Pixman         >= 0.17.7
    OpenSSL
    libjpeg
    zlib
    Cyrus-SASL

The following optional dependancies increase the available
functionality

    GE Gui         >= 0.6.0,  < 0.7.0   (GUI app support)
    OpenGL                              (GUI app support)
    Alsa                                (Linux support)
    XRandR         >= 1.2               (X11 support)
    Xinerama       >= 1.0               (X11 support)
    libcacard      >= 0.1.2             (Smartcard support)

Communication
-------------

To communicate with the development team, or to post patches
there is a technical mailing list:

   http://lists.freedesktop.org/mailman/listinfo/spice-devel

There is also a mailing list for new release announcements:

   http://lists.freedesktop.org/archives/spice-announce/

To view known bugs, or report new bugs, in SPICE visit

   https://bugs.freedesktop.org/describecomponents.cgi?product=Spice

Bugs found when using an OS distribution's binary packages should
be reported to the OS vendors' own bug tracker first.

The latest SPICE code can be found in GIT at:

   http://cgit.freedesktop.org/spice/

Licensing
---------

SPICE is provided under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.

Please see the COPYING file for the complete LGPLv2+ license
terms, or visit <http://www.gnu.org/licenses/>.

Experimental Features
---------------------
To enable multiple client connections, set:
SPICE_DEBUG_ALLOW_MC=1

-- End of readme