update submodule and patches to QEMU 8.1.5

[pve-qemu.git] / debian / patches / extra / 0010-ui-vnc-clipboard-fix-inflate_buffer.patch

diff --git a/debian/patches/extra/0010-ui-vnc-clipboard-fix-inflate_buffer.patch b/debian/patches/extra/0010-ui-vnc-clipboard-fix-inflate_buffer.patch
deleted file mode 100644 (file)
index 4711fa0..0000000
--- a/debian/patches/extra/0010-ui-vnc-clipboard-fix-inflate_buffer.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Fiona Ebner <f.ebner@proxmox.com>
-Date: Wed, 22 Nov 2023 13:17:25 +0100
-Subject: [PATCH] ui/vnc-clipboard: fix inflate_buffer
-
-Commit d921fea338 ("ui/vnc-clipboard: fix infinite loop in
-inflate_buffer (CVE-2023-3255)") removed this hunk, but it is still
-required, because it can happen that stream.avail_in becomes zero
-before coming across a return value of Z_STREAM_END.
-
-This fixes the host->guest direction with noNVC.
-
-Reported-by: Friedrich Weber <f.weber@proxmox.com>
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- ui/vnc-clipboard.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/ui/vnc-clipboard.c b/ui/vnc-clipboard.c
-index c759be3438..124b6fbd9c 100644
---- a/ui/vnc-clipboard.c
-+++ b/ui/vnc-clipboard.c
-@@ -69,6 +69,11 @@ static uint8_t *inflate_buffer(uint8_t *in, uint32_t in_len, uint32_t *size)
-         }
-     }
- 
-+    *size = stream.total_out;
-+    inflateEnd(&stream);
-+
-+    return out;
-+
- err_end:
-     inflateEnd(&stream);
- err: