debian/patches/extra/0010-ui-vnc-clipboard-fix-inflate_buffer.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Fiona Ebner <f.ebner@proxmox.com>
   3 Date: Wed, 22 Nov 2023 13:17:25 +0100
   4 Subject: [PATCH] ui/vnc-clipboard: fix inflate_buffer
   5
   6 Commit d921fea338 ("ui/vnc-clipboard: fix infinite loop in
   7 inflate_buffer (CVE-2023-3255)") removed this hunk, but it is still
   8 required, because it can happen that stream.avail_in becomes zero
   9 before coming across a return value of Z_STREAM_END.
  10
  11 This fixes the host->guest direction with noNVC.
  12
  13 Reported-by: Friedrich Weber <f.weber@proxmox.com>
  14 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  15 ---
  16  ui/vnc-clipboard.c | 5 +++++
  17  1 file changed, 5 insertions(+)
  18
  19 diff --git a/ui/vnc-clipboard.c b/ui/vnc-clipboard.c
  20 index c759be3438..124b6fbd9c 100644
  21 --- a/ui/vnc-clipboard.c
  22 +++ b/ui/vnc-clipboard.c
  23 @@ -69,6 +69,11 @@ static uint8_t *inflate_buffer(uint8_t *in, uint32_t in_len, uint32_t *size)
  24          }
  25      }
  26
  27 +    *size = stream.total_out;
  28 +    inflateEnd(&stream);
  29 +
  30 +    return out;
  31 +
  32  err_end:
  33      inflateEnd(&stream);
  34  err: