OpenE2K
/
qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
qemu-e2k/ui
History
Gerd Hoffmann ab9509ccea spice: make sure we don't overflow ssd->buf 
Related spice-only bug.  We have a fixed 16 MB buffer here, being
presented to the spice-server as qxl video memory in case spice is
used with a non-qxl card.  It's also used with qxl in vga mode.

When using display resolutions requiring more than 16 MB of memory we
are going to overflow that buffer.  In theory the guest can write,
indirectly via spice-server.  The spice-server clears the memory after
setting a new video mode though, triggering a segfault in the overflow
case, so qemu crashes before the guest has a chance to do something
evil.

Fix that by switching to dynamic allocation for the buffer.

CVE-2014-3615

Cc: qemu-stable@nongnu.org
Cc: secalert@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
 		2014-09-05 12:19:50 +02:00
..
Makefile.objs input: key mapping helpers 2014-05-16 08:30:11 +02:00
cocoa.m ui/cocoa: Honour -show-cursor command line option 2014-06-29 22:00:33 +01:00
console.c qemu-char: introduce qemu_chr_alloc 2014-06-23 11:12:28 -04:00
curses.c input/curses: add kbd delay between keydown and keyup events 2014-06-04 08:40:42 +02:00
curses_keys.h janitor: add guards to headers 2012-12-19 08:31:31 +01:00
cursor.c ui: move files to ui/ and include/ui/ 2012-12-19 08:31:30 +01:00
cursor_hidden.xpm ui: move files to ui/ and include/ui/ 2012-12-19 08:31:30 +01:00
cursor_left_ptr.xpm ui: move files to ui/ and include/ui/ 2012-12-19 08:31:30 +01:00
d3des.c
…
d3des.h janitor: add guards to headers 2012-12-19 08:31:31 +01:00
gtk.c ui/gtk: Restore keyboard focus after Page change 2014-07-11 10:44:00 +02:00
input-keymap.c input: keymap: add meta keys 2014-05-26 08:42:43 +02:00
input-legacy.c input: use kbd delays for send_key monitor command 2014-06-04 08:40:41 +02:00
input.c input: add support for kbd delays 2014-06-04 08:40:41 +02:00
keymaps.c qemu-char: add support for U-prefixed symbols 2013-11-13 15:48:38 +04:00
keymaps.h
…
qemu-pixman.c pixman: render vgafont glyphs into pixman images 2013-04-16 09:03:47 +02:00
qemu-x509.h ui: move files to ui/ and include/ui/ 2012-12-19 08:31:30 +01:00
sdl.c input: sdl: fix guest_cursor logic. 2014-03-10 13:49:44 +01:00
sdl2-keymap.h ui/sdl2 : initial port to SDL 2.0 (v2.0) 2014-03-05 09:52:05 +01:00
sdl2.c sdl2: textinput + terminal 2014-06-02 16:28:58 +02:00
sdl_keysym.h ui/sdl2 : initial port to SDL 2.0 (v2.0) 2014-03-05 09:52:05 +01:00
sdl_zoom.c sdl: Fix heap smash in sdl_zoom_rgb{16,32} for int > 32 bits 2013-01-15 18:25:30 -06:00
sdl_zoom.h
…
sdl_zoom_template.h sdl: Fix heap smash in sdl_zoom_rgb{16,32} for int > 32 bits 2013-01-15 18:25:30 -06:00
spice-core.c spice: use console index as display id 2014-09-01 10:19:03 +02:00
spice-display.c spice: make sure we don't overflow ssd->buf 2014-09-05 12:19:50 +02:00
spice-input.c spice: input: Fix absolute mouse y coordinates 2014-03-24 08:41:21 +01:00
vgafont.h ui: move files to ui/ and include/ui/ 2012-12-19 08:31:30 +01:00
vnc-auth-sasl.c
…
vnc-auth-sasl.h aio / timers: Untangle include files 2013-08-22 19:10:27 +02:00
vnc-auth-vencrypt.c aio / timers: Untangle include files 2013-08-22 19:10:27 +02:00
vnc-auth-vencrypt.h
…
vnc-enc-hextile-template.h
…
vnc-enc-hextile.c
…
vnc-enc-tight.c vnc-enc-tight: Fix divide-by-zero in tight_detect_smooth_image{16,24,32} 2014-06-02 16:30:52 +02:00
vnc-enc-tight.h
…
vnc-enc-zlib.c
…
vnc-enc-zrle-template.c
…
vnc-enc-zrle.c
…
vnc-enc-zrle.h
…
vnc-enc-zywrle-template.c
…
vnc-enc-zywrle.h misc: Spelling and grammar fixes in comments 2013-10-26 13:06:45 +04:00
vnc-jobs.c vnc dirty tracking optinizations. 2014-03-11 10:53:17 +00:00
vnc-jobs.h
…
vnc-palette.c
…
vnc-palette.h misc: move include files to include/qemu/ 2012-12-19 08:32:39 +01:00
vnc-tls.c vnc: Drop superfluous conditionals around g_free() 2014-06-19 12:48:07 +02:00
vnc-tls.h misc: move include files to include/qemu/ 2012-12-19 08:32:39 +01:00
vnc-ws.c aio / timers: Untangle include files 2013-08-22 19:10:27 +02:00
vnc-ws.h TLS support for VNC Websockets 2013-05-03 12:04:57 -05:00
vnc.c vnc update fix 2014-07-25 09:43:31 +02:00
vnc.h vnc update fix 2014-07-25 09:43:31 +02:00
vnc_keysym.h qemu-char: add missing characters used in keymaps 2013-11-13 15:48:38 +04:00
x_keymap.c
…
x_keymap.h
…