mirror of
https://gitlab.uni-freiburg.de/opensourcevdi/spice
synced 2025-12-26 14:41:25 +00:00
a4a16ac42d
RedMemSlotInfo keeps an array of groups, and each group contains an array of slots. Unfortunately, these checks are off by 1, they check that the index is greater or equal to the number of elements in the array, while these arrays are 0 based. The check should only check for strictly greater than the number of elements. For the group array, this is not a big issue, as these memslot groups are created by spice-server users (eg QEMU), and the group ids used to index that array are also generated by the spice-server user, so it should not be possible for the guest to set them to arbitrary values. The slot id is more problematic, as it's calculated from a QXLPHYSICAL address, and such addresses are usually set by the guest QXL driver, so the guest can set these to arbitrary values, including malicious values, which are probably easy to build from the guest PCI configuration. This patch fixes the arrays bound check, and adds a test case for this. This fixes CVE-2019-3813. Signed-off-by: Christophe Fergeau <cfergeau@redhat.com> Acked-by: Frediano Ziglio <fziglio@redhat.com> |
||
|---|---|---|
| .. | ||
| pki | ||
| valgrind | ||
| .gitignore | ||
| base_test.ppm | ||
| basic-event-loop.c | ||
| basic-event-loop.h | ||
| Makefile.am | ||
| meson.build | ||
| README | ||
| regression-test.py | ||
| replay.c | ||
| stat-test.c | ||
| test-agent-msg-filter.c | ||
| test-channel.c | ||
| test-codecs-parsing.c | ||
| test-display-base.c | ||
| test-display-base.h | ||
| test-display-no-ssl.c | ||
| test-display-resolution-changes.c | ||
| test-display-streaming.c | ||
| test-display-width-stride.c | ||
| test-empty-success.c | ||
| test-fail-on-null-core-interface.c | ||
| test-glib-compat.c | ||
| test-glib-compat.h | ||
| test-gst.c | ||
| test-leaks.c | ||
| test-listen.c | ||
| test-loop.c | ||
| test-multiple.py | ||
| test-options.c | ||
| test-playback.c | ||
| test-qxl-parsing.c | ||
| test-record.c | ||
| test-sasl.c | ||
| test-stat-file.c | ||
| test-stat.c | ||
| test-stream-device.c | ||
| test-stream.c | ||
| test-two-servers.c | ||
| test-vdagent.c | ||
| video-encoders | ||
What is here ============ This directory will contain a testsuite for the server. You can run all the tests and use libtool to debug any of them: libtool --mode=execute gdb test-just-sockets-no-ssl Overview of tests ================= test-just-sockets-no-ssl A complete server, only provides the main and inputs channels. Doesn't actually produce anything on the channels. Essentially a test of the regular link code (reds.c), good for multiple connect/disconnect tests. test-empty-success tests calling test-fail-on-null-core-interface should abort when run (when spice tries to watch_add) basic-event-loop.c event loop to provide core interface. Automated tests =============== test-display-streaming.c this test can be used to check regressions. For this, test-display-streaming needs to be called passing --automated-tests as parameter