From 97efe4f961dcf5a0126baa75e8a6bff66d33186f Mon Sep 17 00:00:00 2001 From: Thomas Huth Date: Mon, 21 Nov 2016 18:25:15 +0100 Subject: [PATCH] ui/vnc: Fix problem with sending too many bytes as server name If the buffer is not big enough, snprintf() does not return the number of bytes that have been written to the buffer, but the number of bytes that would be needed for writing the whole string. By using this value for the following vnc_write() calls, we send some junk at the end of the name in case the qemu_name is longer than 1017 bytes, which could confuse the VNC clients. Fix this by adding an additional size check here. Buglink: https://bugs.launchpad.net/qemu/+bug/1637447 Signed-off-by: Thomas Huth Reviewed-by: Eric Blake Message-id: 1479749115-21932-1-git-send-email-thuth@redhat.com Signed-off-by: Gerd Hoffmann --- ui/vnc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index 2c28a59ff7..29aa9c4c97 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2459,10 +2459,14 @@ static int protocol_client_init(VncState *vs, uint8_t *data, size_t len) pixel_format_message(vs); - if (qemu_name) + if (qemu_name) { size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name); - else + if (size > sizeof(buf)) { + size = sizeof(buf); + } + } else { size = snprintf(buf, sizeof(buf), "QEMU"); + } vnc_write_u32(vs, size); vnc_write(vs, buf, size);