From df2cc786ee44e10dd6f9ba2b728499d03630ccd5 Mon Sep 17 00:00:00 2001 From: Fiona Ebner Date: Wed, 22 Nov 2023 13:41:14 +0100 Subject: [PATCH] add fix for vnc clipboard This fixes the host->guest direction with noNVC as a client (and likely others). Reported-by: Friedrich Weber Signed-off-by: Fiona Ebner Tested-by: Friedrich Weber --- ...-ui-vnc-clipboard-fix-inflate_buffer.patch | 34 +++++++++++++++++++ debian/patches/series | 1 + 2 files changed, 35 insertions(+) create mode 100644 debian/patches/extra/0010-ui-vnc-clipboard-fix-inflate_buffer.patch diff --git a/debian/patches/extra/0010-ui-vnc-clipboard-fix-inflate_buffer.patch b/debian/patches/extra/0010-ui-vnc-clipboard-fix-inflate_buffer.patch new file mode 100644 index 0000000..4711fa0 --- /dev/null +++ b/debian/patches/extra/0010-ui-vnc-clipboard-fix-inflate_buffer.patch @@ -0,0 +1,34 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Fiona Ebner +Date: Wed, 22 Nov 2023 13:17:25 +0100 +Subject: [PATCH] ui/vnc-clipboard: fix inflate_buffer + +Commit d921fea338 ("ui/vnc-clipboard: fix infinite loop in +inflate_buffer (CVE-2023-3255)") removed this hunk, but it is still +required, because it can happen that stream.avail_in becomes zero +before coming across a return value of Z_STREAM_END. + +This fixes the host->guest direction with noNVC. + +Reported-by: Friedrich Weber +Signed-off-by: Fiona Ebner +--- + ui/vnc-clipboard.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/ui/vnc-clipboard.c b/ui/vnc-clipboard.c +index c759be3438..124b6fbd9c 100644 +--- a/ui/vnc-clipboard.c ++++ b/ui/vnc-clipboard.c +@@ -69,6 +69,11 @@ static uint8_t *inflate_buffer(uint8_t *in, uint32_t in_len, uint32_t *size) + } + } + ++ *size = stream.total_out; ++ inflateEnd(&stream); ++ ++ return out; ++ + err_end: + inflateEnd(&stream); + err: diff --git a/debian/patches/series b/debian/patches/series index 992299c..9938b8e 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -7,6 +7,7 @@ extra/0006-Revert-Revert-graph-lock-Disable-locking-for-now.patch extra/0007-migration-states-workaround-snapshot-performance-reg.patch extra/0008-Revert-x86-acpi-workaround-Windows-not-handling-name.patch extra/0009-hw-ide-ahci-fix-legacy-software-reset.patch +extra/0010-ui-vnc-clipboard-fix-inflate_buffer.patch bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch -- 2.39.2