summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-10-09fix warnings about memory alignmentfix-clang-warningsVictor Toso6-13/+13
- By either using SPICE_ALIGNED_CAST to false positives and SPICE_UNALIGNED_CAST to the cast that could lead to problems; or - By using a better type to the variable;
2015-10-09smartcard: use SPICE_ALIGNED_CASTVictor Toso1-6/+6
In order to avoid false posive alignment warnings clang: smartcard.c:131:29: error: cast from 'uint8_t *' (aka 'unsigned char *') to 'VSCMsgHeader *' (aka 'struct VSCMsgHeader *') increases required alignment from 1 to 4 [-Werror,-Wcast-align] VSCMsgHeader *vheader = (VSCMsgHeader*)state->buf; ^~~~~~~~~~~~~~~~~~~~~~~~~
2015-10-09unaligned type with spice_marshaller_reserve_spaceVictor Toso2-3/+6
2015-10-07build-sys: Remove client check from configure.acHEADmasterChristophe Fergeau1-10/+0
configure.ac is checking for pyparsing availability if client/generated_marshallers.cpp is missing. The client/ code is gone, and the python modules checks are done in spice-common/configure.ac nowadays, so we can get rid of this check.
2015-10-06build-sys: bump libtool version informationv0.12.6Frediano Ziglio1-2/+2
As one interface was added bump the version and put a comment to avoid too much updates. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
2015-10-06Mention the 2 recently fixed CVEs in NEWSChristophe Fergeau1-1/+1
2015-10-06Prevent leak if size from red_get_data_chunks don't match in red_get_imageFrediano Ziglio1-0/+2
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
2015-10-06Prevent data_size to be set independently from dataFrediano Ziglio1-0/+1
There was not check for data_size field so one could set data to a small set of data and data_size much bigger than size of data leading to buffer overflow. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
2015-10-06Avoid race condition copying segments in red_get_pathFrediano Ziglio1-1/+1
The guest can attempt to increase the number of segments while spice-server is reading them. Make sure we don't copy more then the allocated segments. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06Make sure we can read QXLPathSeg structuresFrediano Ziglio1-2/+2
start pointer points to a QXLPathSeg structure. Before reading from the structure, make sure the structure is contained in the memory range checked. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06Fix some possible overflows in red_get_string for 32 bitFrediano Ziglio1-1/+7
Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06Prevent DoS from guest trying to allocate too much data on host for chunksFrediano Ziglio1-8/+41
Limit number of chunks to a given amount to avoid guest trying to allocate too much memory. Using circular or nested chunks lists guest could try to allocate huge amounts of memory. Considering the list can be infinite and guest can change data this also prevents strange security attacks from guest. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
2015-10-06Prevent memory leak if red_get_data_chunks_ptr failsFrediano Ziglio1-11/+20
Free linked list if client tries to do nasty things Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06Fix race condition in red_get_data_chunks_ptrFrediano Ziglio1-7/+10
Do not read multiple times data from guest as this can be changed by other guest vcpus. This causes races and security problems if these data are used for buffer allocation or checks. Actually, the 'data' member can't change during read as it is just a pointer to a fixed array contained in qxl. However, this change will make it clear that there can be no race condition. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
2015-10-06Fix integer overflow computing glyph_size in red_get_stringFrediano Ziglio1-3/+5
If bpp is int the formula can lead to weird overflows. width and height are uint16_t so the formula is: size_t = u16 * (u16 * int + const_int) / const_int; so it became size_t = (int) u16 * ((int) u16 * int + const_int) / const_int; However the (int) u16 * (int) u16 can then became negative to overflow. Under 64 bit architectures size_t is 64 and int usually 32 so converting this negative 32 bit number to a unsigned 64 bit lead to a very big number as the signed is extended and then converted to unsigned. Using unsigned arithmetic prevent extending the sign. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06Fix race condition in red_get_stringFrediano Ziglio1-6/+9
Do not read multiple time an array size that can be changed. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06Fix race in red_get_imageFrediano Ziglio1-8/+10
Do not read multiple times data from guest as this could be changed by other vcpu threads. This causes races and security problems if these data are used for buffer allocation or checks. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06Fix race condition on red_get_clip_rectsFrediano Ziglio1-3/+5
Do not read multiple time an array size that can be changed. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06Prevent 32 bit integer overflow in bitmap_consistentFrediano Ziglio1-3/+4
The overflow may lead to buffer overflow as the row size computed from width (bitmap->x) can be bigger than the size in bytes (bitmap->stride). This can make spice-server accept the invalid sizes. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06Fix buffer reading overflowFrediano Ziglio1-1/+8
Not security risk as just for read. However, this could be used to attempt integer overflows in the following lines. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06Check properly surface to be createdFrediano Ziglio1-1/+34
Check format is valid. Check stride is at least the size of required bytes for a row. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06Fix some integer overflow causing large memory allocationsFrediano Ziglio1-4/+11
Prevent integer overflow when computing image sizes. Image index computations are done using 32 bit so this can cause easily security issues. MAX_DATA_CHUNK is larger than the virtual card limit, so this is not going to cause change in behaviours. Comparing size calculation results with MAX_DATA_CHUNK will allow us to catch overflows. Prevent guest from allocating large amount of memory. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
2015-10-06Define a constant to limit data from guest.Frediano Ziglio1-0/+11
This limit will prevent guest trying to do nasty things and DoS to host. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
2015-10-06worker: avoid double free or double create of surfacesFrediano Ziglio1-1/+8
A driver can overwrite surface state creating a surface with the same id of a previous one. Also can try to destroy surfaces that are not created. Both requests cause invalid internal states that could lead to crashes or memory corruptions. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
2015-10-06worker: validate correctly surfacesFrediano Ziglio1-15/+18
Do not just give warning and continue to use an invalid index into an array. Resolves: CVE-2015-5260 Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-05worker: make it clear it returns from process when no cmdMarc-André Lureau1-4/+4
Acked-by: Frediano Ziglio <fziglio@redhat.com>
2015-10-02server: remove useless includesMarc-André Lureau1-2/+1
Acked-by: Frediano Ziglio <fziglio@redhat.com>
2015-10-01manual: Fix Arnon last nameChristophe Fergeau1-1/+1
It's "Gilboa", not "Giloba"
2015-10-01manual: Add section about debuggingChristophe Fergeau1-0/+95
This details the basics for now, but can be detailed in the future.
2015-10-01Update NEWSChristophe Fergeau1-0/+14
2015-09-29worker: count in drawable_new()Marc-André Lureau1-3/+4
2015-09-29PALLET -> PALETTEJonathon Jongsma1-6/+6
Use the correct spelling for the enumeration
2015-09-29tests: Fix -Werror=format-zero-length build failureChristophe Fergeau1-2/+0
replay.c: In function 'replay_channel_event': replay.c:226:16: error: zero-length gnu_printf format string [-Werror=format-zero-length] g_printerr("");
2015-09-24display: Advertise preferred compression capChristophe Fergeau1-0/+1
The patches adding a way for the client to set its preferred compression method added a new capability so that the server can indicate support for this feature. However, spice-server was not setting this capability on its display channel, which means clients are not going to try to send 'preferred-compression' messages even though the user request it.
2015-09-15manual: add smartcard channel sectionMarc-André Lureau1-0/+54
Add some basic instructions to setup smartcard channel Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-09-15manual: add missing spaceMarc-André Lureau1-1/+1
Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-09-15manual: update webdav virt-manager sectionMarc-André Lureau1-1/+3
virt-manager can add webdav channel for a while now. Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-09-08Avoid race conditions reading monitor configs from guestFrediano Ziglio1-13/+31
For security reasons do not assume guest do not change structures it pass to Qemu. Guest could change count field while Qemu is copying QXLMonitorsConfig structure leading to heap corruption. This patch avoid it reading count only once. This patch solves CVE-2015-3247. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-09-08replay: fix formatting stringFrediano Ziglio1-1/+1
Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-09-07build-sys: Update warning messageFrediano Ziglio1-4/+5
arch_warn was set to 1 only if architecture is not x86, x64 or arm. Update the message as we actually mainly test x64. Define the warning message and do the architecture checks in the same place so that they are easier to keep in sync. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-09-04improve performances comparing image pixelsFrediano Ziglio1-21/+20
This patch contains a bit of small optimizations. It avoid boolean operations which could involve branches replacing with binary operations (equal/all_ident -> some_differences). The other optimization avoids the use of ABS. First the way the macro was used (with a large expression) was not easy to optimize by the compiler. Then instead of using ABS a much simpler range check is used so instead of (ABS(n) >= k) a ((n) <= -k || (n) >= k) is used. This looks small but modern compilers can translate this not in range check in a couple of machine instructions (and a single compare). Using operf on same samples (using spice-server-replay) and trying 2 runs I got run 1 2 ------------------------- before 104441 106267 after 92387 91083 So the performance increase is about 13%. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
2015-09-03avoid to call red_get_streams_timout twice computing timeoutFrediano Ziglio1-4/+5
Due to how the MIN macro is defined the function was called twice unless the compiler could demonstrate that was returning the same value (which actually is impossible as function as clock_gettime are not deterministic). Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
2015-09-03spice_timer_queue: fix access after freeFrediano Ziglio1-1/+6
Do not access to timer after we call the associated function. Some of these callbacks can call spice_timer_remove making the pointer pointing to freed data. This happen for instance when the client is disconnecting. This does not cause memory corruption on current allocator implementations as all freeing/accessing happen on a single thread quite closely and allocators use different pools for different thread. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-09-01replay: compatibility with former versionFrediano Ziglio1-5/+6
GMutex usage in replay.c was not working so replace with plain pthread. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
2015-09-01replay: do not define same type twiceFrediano Ziglio1-4/+4
Avoid to use typedef twice for the same type as some compiler complaints about it. SpiceTimer and SpiceWatch are defined in server/spice-core.h as an abstract type which should be defined by some code (as server/tests/basic_event_loop.c does). Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
2015-09-01Update spice-common submoduleChristophe Fergeau1-0/+0
Christophe Fergeau (1): build-sys: Remove code generation files from EXTRA_DIST Frediano Ziglio (1): common: Fix typo in comment
2015-09-01build-sys: Add missing header files to _SOURCESChristophe Fergeau1-0/+2
2 newly-added header files were not added to _SOURCES, breaking make distcheck. Acked-by: Frediano Ziglio <fziglio@redhat.com>
2015-09-01Remove useless pack attributeMarc-André Lureau1-17/+7
Acked-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
2015-09-01server: remove srand(time(NULL))Marc-André Lureau1-2/+0
This is clearly not a library responsability. Acked-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
2015-09-01server/red_worker: remove redundant spice_warn_if in validate_surfaceAlon Levy1-1/+0
Acked-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-04 01:45:18 +0000