mirror of
https://gitlab.uni-freiburg.de/opensourcevdi/spice
synced 2025-12-27 07:29:32 +00:00
6b32af3e17
This is related to CVE-2016-0749
==529== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60040009c098 at pc 0x7fffee0eda6d bp 0x7fffffffcd00 sp 0x7fffffffccf0
WRITE of size 4 at 0x60040009c098 thread T0
#0 0x7fffee0eda6c in smartcard_char_device_notify_reader_add /home/elmarco/pkg/spice/spice-0.12.4/server/smartcard.c:334
#1 0x7fffee0ef783 in smartcard_add_reader /home/elmarco/pkg/spice/spice-0.12.4/server/smartcard.c:642
#2 0x7fffee0f0568 in smartcard_channel_handle_message /home/elmarco/pkg/spice/spice-0.12.4/server/smartcard.c:757
#3 0x7fffee032f3f in red_peer_handle_incoming /home/elmarco/pkg/spice/spice-0.12.4/server/red_channel.c:304
#4 0x7fffee033216 in red_channel_client_receive /home/elmarco/pkg/spice/spice-0.12.4/server/red_channel.c:322
#5 0x7fffee03bf1f in red_channel_client_event /home/elmarco/pkg/spice/spice-0.12.4/server/red_channel.c:1561
#6 0x555555c3c53d in qemu_iohandler_poll /home/elmarco/src/qemu/iohandler.c:143
#7 0x555555c3b800 in main_loop_wait /home/elmarco/src/qemu/main-loop.c:504
#8 0x5555556f160c in main_loop /home/elmarco/src/qemu/vl.c:1818
#9 0x5555556f160c in main /home/elmarco/src/qemu/vl.c:4394
#10 0x7fffed80eb14 in __libc_start_main /usr/src/debug/glibc-2.17-c758a686/csu/libc-start.c:274
#11 0x5555556f9c20 in _start (/home/elmarco/src/qemu/x86_64-softmmu/qemu-system-x86_64+0x1a5c20)
0x60040009c098 is located 0 bytes to the right of 8-byte region [0x60040009c090,0x60040009c098)
allocated by thread T0 here:
#0 0x7ffff4e612be in __interceptor_realloc /usr/src/debug/gcc-4.8.5-20150702/obj-x86_64-redhat-linux/x86_64-redhat-linux/libsanitizer/asan/../../../../libsanitizer/asan/asan_malloc_linux.cc:92
#1 0x7fffee121308 in spice_realloc /home/elmarco/pkg/spice/spice-0.12.4/spice-common/common/mem.c:123
#2 0x7fffee004a48 in __spice_char_device_write_buffer_get /home/elmarco/pkg/spice/spice-0.12.4/server/char_device.c:516
#3 0x7fffee004e87 in spice_char_device_write_buffer_get /home/elmarco/pkg/spice/spice-0.12.4/server/char_device.c:557
#4 0x7fffee0ed8b9 in smartcard_char_device_notify_reader_add /home/elmarco/pkg/spice/spice-0.12.4/server/smartcard.c:325
#5 0x7fffee0ef783 in smartcard_add_reader /home/elmarco/pkg/spice/spice-0.12.4/server/smartcard.c:642
#6 0x7fffee0f0568 in smartcard_channel_handle_message /home/elmarco/pkg/spice/spice-0.12.4/server/smartcard.c:757
#7 0x7fffee032f3f in red_peer_handle_incoming /home/elmarco/pkg/spice/spice-0.12.4/server/red_channel.c:304
#8 0x7fffee033216 in red_channel_client_receive /home/elmarco/pkg/spice/spice-0.12.4/server/red_channel.c:322
#9 0x7fffee03bf1f in red_channel_client_event /home/elmarco/pkg/spice/spice-0.12.4/server/red_channel.c:1561
#10 0x555555c3c53d in qemu_iohandler_poll /home/elmarco/src/qemu/iohandler.c:143
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/elmarco/pkg/spice/spice-0.12.4/server/smartcard.c:334 smartcard_char_device_notify_reader_add
Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
|
||
|---|---|---|
| .. | ||
| tests | ||
| .gitignore | ||
| agent-msg-filter.c | ||
| agent-msg-filter.h | ||
| cache-item.h | ||
| cache-item.tmpl.c | ||
| char-device.c | ||
| char-device.h | ||
| cursor-channel.c | ||
| cursor-channel.h | ||
| dcc-send.c | ||
| dcc.c | ||
| dcc.h | ||
| demarshallers.h | ||
| dispatcher.c | ||
| dispatcher.h | ||
| display-channel.c | ||
| display-channel.h | ||
| display-limits.h | ||
| event-loop.c | ||
| glz-encode-match.tmpl.c | ||
| glz-encode.tmpl.c | ||
| glz-encoder-dict.c | ||
| glz-encoder-dict.h | ||
| glz-encoder-priv.h | ||
| glz-encoder.c | ||
| glz-encoder.h | ||
| gstreamer-encoder.c | ||
| image-cache.c | ||
| image-cache.h | ||
| image-encoders.c | ||
| image-encoders.h | ||
| inputs-channel-client.c | ||
| inputs-channel-client.h | ||
| inputs-channel.c | ||
| inputs-channel.h | ||
| jpeg-encoder.c | ||
| jpeg-encoder.h | ||
| lz4-encoder.c | ||
| lz4-encoder.h | ||
| main-channel-client.c | ||
| main-channel-client.h | ||
| main-channel.c | ||
| main-channel.h | ||
| main-dispatcher.c | ||
| main-dispatcher.h | ||
| Makefile.am | ||
| memslot.c | ||
| memslot.h | ||
| migration-protocol.h | ||
| mjpeg-encoder.c | ||
| pixmap-cache.c | ||
| pixmap-cache.h | ||
| red-channel.c | ||
| red-channel.h | ||
| red-common.h | ||
| red-parse-qxl.c | ||
| red-parse-qxl.h | ||
| red-pipe-item.c | ||
| red-pipe-item.h | ||
| red-qxl.c | ||
| red-qxl.h | ||
| red-record-qxl.c | ||
| red-record-qxl.h | ||
| red-replay-qxl.c | ||
| red-replay-qxl.h | ||
| red-worker.c | ||
| red-worker.h | ||
| reds-private.h | ||
| reds-stream.c | ||
| reds-stream.h | ||
| reds.c | ||
| reds.h | ||
| smartcard.c | ||
| smartcard.h | ||
| sound.c | ||
| sound.h | ||
| spice-audio.h | ||
| spice-bitmap-utils.c | ||
| spice-bitmap-utils.h | ||
| spice-bitmap-utils.tmpl.c | ||
| spice-char.h | ||
| spice-core.h | ||
| spice-experimental.h | ||
| spice-input.h | ||
| spice-migration.h | ||
| spice-qxl.h | ||
| spice-server.h | ||
| spice-server.syms | ||
| spice-version.h.in | ||
| spice.h | ||
| spicevmc.c | ||
| stat.h | ||
| stream.c | ||
| stream.h | ||
| sw-canvas.c | ||
| tree.c | ||
| tree.h | ||
| utils.c | ||
| utils.h | ||
| video-encoder.h | ||
| zlib-encoder.c | ||
| zlib-encoder.h | ||