spice/server
Frediano Ziglio 9235c84e0f Fix race in red_get_image
Do not read multiple times data from guest as this could be changed
by other vcpu threads.
This causes races and security problems if these data are used for
buffer allocation or checks.

Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06 11:11:10 +01:00
..
tests tests: Fix -Werror=format-zero-length build failure 2015-09-29 18:59:54 +01:00
.gitignore gitignore: add generated_*, vim temps, pyc 2010-11-08 16:06:55 +02:00
agent-msg-filter.c server: Add support for filtering out agent file-xfer msgs (rhbz#961848) 2013-06-06 16:07:30 +02:00
agent-msg-filter.h server: Add support for filtering out agent file-xfer msgs (rhbz#961848) 2013-06-06 16:07:30 +02:00
char_device.c char-device: spice_char_device_write_to_device: protect against recursion 2015-02-08 13:13:46 +02:00
char_device.h Fix typo in comment in char_device.h 2015-08-11 17:24:36 +02:00
demarshallers.h Remove trailing blank lines 2012-01-13 18:11:59 +02:00
dispatcher.c server/dispatcher: add extra_dispatcher, hack for red_record 2015-08-20 17:47:24 +01:00
dispatcher.h server/dispatcher: add extra_dispatcher, hack for red_record 2015-08-20 17:47:24 +01:00
glz_encode_match_tmpl.c Remove use of INLINE 2015-08-20 17:10:49 +01:00
glz_encode_tmpl.c remove wrong statement terminator from preprocessor macro 2015-08-25 16:26:49 +01:00
glz_encoder_config.h Remove use of INLINE 2015-08-20 17:10:49 +01:00
glz_encoder_dictionary_protected.h glz: WindowImageSegment lines lines_end as void* 2015-08-20 11:09:00 +01:00
glz_encoder_dictionary.c Remove use of INLINE 2015-08-20 17:10:49 +01:00
glz_encoder_dictionary.h Remove trailing blank lines 2012-01-13 18:11:59 +02:00
glz_encoder.c Remove use of INLINE 2015-08-20 17:10:49 +01:00
glz_encoder.h Use the spice-common submodule 2012-03-25 18:59:10 +02:00
inputs_channel.c server/inputs_channel: Cope with NULL keyboard in release_keys() 2015-08-12 10:28:57 +02:00
inputs_channel.h Remove trailing blank lines 2012-01-13 18:11:59 +02:00
jpeg_encoder.c mjpeg and jpeg encoder: fix alignment warnings 2015-08-20 11:22:59 +01:00
jpeg_encoder.h Remove trailing whitespace from end of lines 2012-01-13 18:11:59 +02:00
lz4_encoder.c LZ4: Send the original format with the compressed data 2015-02-03 10:39:16 +01:00
lz4_encoder.h LZ4: Send the original format with the compressed data 2015-02-03 10:39:16 +01:00
main_channel.c Remove unused struct RedsOutItem 2015-08-11 17:24:36 +02:00
main_channel.h Move RedsMigSpice to main-channel.h 2015-08-11 17:24:36 +02:00
main_dispatcher.c decouple disconnection of the main channel from client destruction 2013-07-29 11:35:17 -04:00
main_dispatcher.h decouple disconnection of the main channel from client destruction 2013-07-29 11:35:17 -04:00
Makefile.am build-sys: Add missing header files to _SOURCES 2015-09-01 14:21:04 +01:00
migration_protocol.h migration_protocol: use SPICE_MAGIC_CONST 2015-08-20 10:54:56 +01:00
mjpeg_encoder.c mjpeg and jpeg encoder: fix alignment warnings 2015-08-20 11:22:59 +01:00
mjpeg_encoder.h server: Remove the rate_control_is_active field from MJpegEncoder. 2015-06-29 18:04:12 +02:00
red_bitmap_utils.h improve performances comparing image pixels 2015-09-04 11:04:09 +01:00
red_channel.c Use MAX macro to compute the maximum value 2015-08-25 16:24:07 +01:00
red_channel.h RedChannel: remove unused BufDescriptor struct 2015-08-11 17:24:36 +02:00
red_client_cache.h Use the spice-common logging functions 2012-03-25 19:00:00 +02:00
red_client_shared_cache.h Lock the pixmap image cache for the entire fill_bits call 2015-06-29 13:21:14 +02:00
red_common.h server: remove useless includes 2015-10-02 10:13:45 +01:00
red_dispatcher.c display: Advertise preferred compression cap 2015-09-24 11:06:42 +02:00
red_dispatcher.h Adjust to new SpiceImageCompress name 2015-07-29 17:40:48 +02:00
red_memslots.c server: remove memslot unused functions 2013-10-01 16:23:59 +02:00
red_memslots.h server: remove memslot unused functions 2013-10-01 16:23:59 +02:00
red_parse_qxl.c Fix race in red_get_image 2015-10-06 11:11:10 +01:00
red_parse_qxl.h Add support for QXLComposite to spice server 2012-08-24 13:44:42 -04:00
red_record_qxl.c replay: fix check for QXL_SURF_FLAG_KEEP_DATA flag 2015-08-25 10:50:18 +01:00
red_record_qxl.h server/red_{record, replay}.[ch]: introduce 2015-08-21 09:38:44 +01:00
red_replay_qxl.c replay: fix formatting string 2015-09-08 10:16:12 +01:00
red_replay_qxl.h server/red_{record, replay}.[ch]: introduce 2015-08-21 09:38:44 +01:00
red_time.h server: move three functions to red_channel 2013-08-14 12:08:04 +03:00
red_worker.c worker: avoid double free or double create of surfaces 2015-10-06 11:07:15 +01:00
red_worker.h server: remove hardcoded RED_MAX_RENDERERS 2015-09-01 14:17:10 +01:00
reds_gl_canvas.c Remove unused SPICE_CANVAS_INTERNAL 2014-12-03 18:32:04 +01:00
reds_gl_canvas.h Remove unused SPICE_CANVAS_INTERNAL 2014-12-03 18:32:04 +01:00
reds_stream.c reds-stream: add reds_stream_get_family() function 2015-01-15 18:29:36 +01:00
reds_stream.h reds-stream: add reds_stream_get_family() function 2015-01-15 18:29:36 +01:00
reds_sw_canvas.c Remove unused SPICE_CANVAS_INTERNAL 2014-12-03 18:32:04 +01:00
reds_sw_canvas.h Remove unused SPICE_CANVAS_INTERNAL 2014-12-03 18:32:04 +01:00
reds-private.h Cleanup: move static function declarations out of header 2015-08-11 17:24:36 +02:00
reds.c Avoid core calling spice_server_destroy 2015-08-26 15:42:59 +01:00
reds.h Move RedsMigSpice to main-channel.h 2015-08-11 17:24:36 +02:00
smartcard.c red_channel: monitor connection latency using MSG_PING 2013-04-22 16:30:54 -04:00
smartcard.h Remove spice-experimental 2015-01-15 18:34:26 +01:00
snd_worker.c Remove unused snd_get_playback_compression() method 2015-08-11 17:24:36 +02:00
snd_worker.h Remove unused snd_get_playback_compression() method 2015-08-11 17:24:36 +02:00
spice_bitmap_utils.c server: Don't dump the bitmap when the format is invalid 2014-09-12 18:00:30 +02:00
spice_bitmap_utils.h server: move surface_format_to_image_type to spice_bitmap_utils 2013-08-14 12:08:04 +03:00
spice_image_cache.c server: split spice_image_cache from red_worker 2013-08-14 12:08:04 +03:00
spice_image_cache.h server: split spice_image_cache from red_worker 2013-08-14 12:08:04 +03:00
spice_server_utils.h server: move bit set/clear utilities out of red_worker.h 2013-08-14 12:08:04 +03:00
spice_timer_queue.c spice_timer_queue: fix access after free 2015-09-03 10:25:13 +01:00
spice_timer_queue.h server: spice_timer_queue 2013-04-22 16:30:54 -04:00
spice-audio.h Split spice.h 2014-11-27 14:27:18 +01:00
spice-char.h Split spice.h 2014-11-27 14:27:18 +01:00
spice-core.h Split spice.h 2014-11-27 14:27:18 +01:00
spice-experimental.h server: Readd spice-experimental.h 2015-08-26 11:01:09 +02:00
spice-input.h Split spice.h 2014-11-27 14:27:18 +01:00
spice-migration.h Move spice_server_get_num_clients() declaration 2014-11-27 15:03:38 +01:00
spice-qxl.h server: allows to set maximum monitors 2015-06-26 16:17:42 +02:00
spice-server.h Adjust to new SpiceImageCompress name 2015-07-29 17:40:48 +02:00
spice-server.syms server/red_{record, replay}.[ch]: introduce 2015-08-21 09:38:44 +01:00
spice-version.h.in build-sys: generate spice-version.h 2014-11-27 14:27:33 +01:00
spice.h Split spice.h 2014-11-27 14:27:18 +01:00
spicevmc.c red_channel: monitor connection latency using MSG_PING 2013-04-22 16:30:54 -04:00
stat.h Remove trailing blank lines 2012-01-13 18:11:59 +02:00
zlib_encoder.c Use the spice-common logging functions 2012-03-25 19:00:00 +02:00
zlib_encoder.h applying zlib compression over glz on WAN connection 2010-06-21 15:05:37 +02:00