+++ /dev/null
-From: Markus Koschany <apo@debian.org>
-Date: Mon, 13 Feb 2017 21:38:02 +0100
-Subject: CVE-2016-9577 and CVE-2016-9578
-
-Bug-Debian: https://bugs.debian.org/854336
-Origin: http://pkgs.fedoraproject.org/cgit/rpms/spice.git/commit/?id=d919d639ae5f83a9735a04d843eed675f9357c0d
----
- server/main_channel.c | 3 +++
- server/reds.c | 11 ++++++++++-
- 2 files changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/server/main_channel.c b/server/main_channel.c
-index 0ecc9df..1fc3915 100644
---- a/server/main_channel.c
-+++ b/server/main_channel.c
-@@ -1026,6 +1026,9 @@ static uint8_t *main_channel_alloc_msg_rcv_buf(RedChannelClient *rcc,
-
- if (type == SPICE_MSGC_MAIN_AGENT_DATA) {
- return reds_get_agent_data_buffer(mcc, size);
-+ } else if (size > sizeof(main_chan->recv_buf)) {
-+ /* message too large, caller will log a message and close the connection */
-+ return NULL;
- } else {
- return main_chan->recv_buf;
- }
-diff --git a/server/reds.c b/server/reds.c
-index 61bf735..4c60f58 100644
---- a/server/reds.c
-+++ b/server/reds.c
-@@ -2110,6 +2110,14 @@ static void reds_handle_read_link_done(void *opaque)
- link_mess->num_channel_caps = GUINT32_FROM_LE(link_mess->num_channel_caps);
- link_mess->num_common_caps = GUINT32_FROM_LE(link_mess->num_common_caps);
-
-+ /* Prevent DoS. Currently we defined only 13 capabilities,
-+ * I expect 1024 to be valid for quite a lot time */
-+ if (link_mess->num_channel_caps > 1024 || link_mess->num_common_caps > 1024) {
-+ reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
-+ reds_link_free(link);
-+ return;
-+ }
-+
- num_caps = link_mess->num_common_caps + link_mess->num_channel_caps;
- caps = (uint32_t *)((uint8_t *)link_mess + link_mess->caps_offset);
-
-@@ -2202,7 +2210,8 @@ static void reds_handle_read_header_done(void *opaque)
-
- reds->peer_minor_version = header->minor_version;
-
-- if (header->size < sizeof(SpiceLinkMess)) {
-+ /* the check for 4096 is to avoid clients to cause arbitrary big memory allocations */
-+ if (header->size < sizeof(SpiceLinkMess) || header->size > 4096) {
- reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
- spice_warning("bad size %u", header->size);
- reds_link_free(link);