summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* syntax-check: manual: Remove duplicate wordChristophe Fergeau2015-10-191-1/+1
|
* syntax-check: Add missing AUTHORSChristophe Fergeau2015-10-192-7/+28
|
* worker: use GOnce to surround some global init in dispatcherMarc-André Lureau2015-10-192-3/+8
| | | | | Acked-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
* server: move some pixmap cache code in own fileMarc-André Lureau2015-10-195-359/+364
| | | | | | | Remove that hideous template header that should really be regular code since it's specialized and instanciated only for pixmap. Acked-by: Frediano Ziglio <fziglio@redhat.com>
* fix spelling mistakes in comments (reseting to resetting & dummym to dummy)snir sheriber2015-10-194-5/+5
| | | | Acked-by: Frediano Ziglio <fziglio@redhat.com>
* Update the .gitignore files for the new manual,Jeremy White2015-10-163-0/+7
| | | | for a few newly generated tests, and for the spice-server.h.
* Remove DRAW_ALLMarc-André Lureau2015-10-161-15/+0
| | | | Acked-by: Frediano Ziglio <fziglio@redhat.com>
* Remove PIPE_DEBUGMarc-André Lureau2015-10-151-122/+0
| | | | | Acked-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
* Remove ACYCLIC_SURFACE_DEBUGMarc-André Lureau2015-10-151-15/+0
| | | | | Acked-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
* Remove unfinished UPDATE_AREA_BY_TREEMarc-André Lureau2015-10-151-110/+0
| | | | | Acked-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
* server: small move to red_channelMarc-André Lureau2015-10-153-17/+18
| | | | | Acked-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
* worker: replace init with red_worker_newMarc-André Lureau2015-10-151-5/+5
| | | | | Acked-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
* red_worker: replace some abort()Marc-André Lureau2015-10-151-1/+2
| | | | | Acked-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
* Simplify pointer computationFrediano Ziglio2015-10-121-1/+1
| | | | | Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* build-sys: Remove client check from configure.acChristophe Fergeau2015-10-071-10/+0
| | | | | | | configure.ac is checking for pyparsing availability if client/generated_marshallers.cpp is missing. The client/ code is gone, and the python modules checks are done in spice-common/configure.ac nowadays, so we can get rid of this check.
* build-sys: bump libtool version informationFrediano Ziglio2015-10-061-2/+2
| | | | | | | As one interface was added bump the version and put a comment to avoid too much updates. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
* Mention the 2 recently fixed CVEs in NEWSChristophe Fergeau2015-10-061-1/+1
|
* Prevent leak if size from red_get_data_chunks don't match in red_get_imageFrediano Ziglio2015-10-061-0/+2
| | | | Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
* Prevent data_size to be set independently from dataFrediano Ziglio2015-10-061-0/+1
| | | | | | | | There was not check for data_size field so one could set data to a small set of data and data_size much bigger than size of data leading to buffer overflow. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
* Avoid race condition copying segments in red_get_pathFrediano Ziglio2015-10-061-1/+1
| | | | | | | | | The guest can attempt to increase the number of segments while spice-server is reading them. Make sure we don't copy more then the allocated segments. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Make sure we can read QXLPathSeg structuresFrediano Ziglio2015-10-061-2/+2
| | | | | | | | | start pointer points to a QXLPathSeg structure. Before reading from the structure, make sure the structure is contained in the memory range checked. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Fix some possible overflows in red_get_string for 32 bitFrediano Ziglio2015-10-061-1/+7
| | | | | Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Prevent DoS from guest trying to allocate too much data on host for chunksFrediano Ziglio2015-10-061-8/+41
| | | | | | | | | | Limit number of chunks to a given amount to avoid guest trying to allocate too much memory. Using circular or nested chunks lists guest could try to allocate huge amounts of memory. Considering the list can be infinite and guest can change data this also prevents strange security attacks from guest. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
* Prevent memory leak if red_get_data_chunks_ptr failsFrediano Ziglio2015-10-061-11/+20
| | | | | | | Free linked list if client tries to do nasty things Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Fix race condition in red_get_data_chunks_ptrFrediano Ziglio2015-10-061-7/+10
| | | | | | | | | | | | Do not read multiple times data from guest as this can be changed by other guest vcpus. This causes races and security problems if these data are used for buffer allocation or checks. Actually, the 'data' member can't change during read as it is just a pointer to a fixed array contained in qxl. However, this change will make it clear that there can be no race condition. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
* Fix integer overflow computing glyph_size in red_get_stringFrediano Ziglio2015-10-061-3/+5
| | | | | | | | | | | | | | | | | | | | If bpp is int the formula can lead to weird overflows. width and height are uint16_t so the formula is: size_t = u16 * (u16 * int + const_int) / const_int; so it became size_t = (int) u16 * ((int) u16 * int + const_int) / const_int; However the (int) u16 * (int) u16 can then became negative to overflow. Under 64 bit architectures size_t is 64 and int usually 32 so converting this negative 32 bit number to a unsigned 64 bit lead to a very big number as the signed is extended and then converted to unsigned. Using unsigned arithmetic prevent extending the sign. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Fix race condition in red_get_stringFrediano Ziglio2015-10-061-6/+9
| | | | | | | Do not read multiple time an array size that can be changed. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Fix race in red_get_imageFrediano Ziglio2015-10-061-8/+10
| | | | | | | | | | Do not read multiple times data from guest as this could be changed by other vcpu threads. This causes races and security problems if these data are used for buffer allocation or checks. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Fix race condition on red_get_clip_rectsFrediano Ziglio2015-10-061-3/+5
| | | | | | | Do not read multiple time an array size that can be changed. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Prevent 32 bit integer overflow in bitmap_consistentFrediano Ziglio2015-10-061-3/+4
| | | | | | | | | The overflow may lead to buffer overflow as the row size computed from width (bitmap->x) can be bigger than the size in bytes (bitmap->stride). This can make spice-server accept the invalid sizes. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Fix buffer reading overflowFrediano Ziglio2015-10-061-1/+8
| | | | | | | | | Not security risk as just for read. However, this could be used to attempt integer overflows in the following lines. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Check properly surface to be createdFrediano Ziglio2015-10-061-1/+34
| | | | | | | | Check format is valid. Check stride is at least the size of required bytes for a row. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Fix some integer overflow causing large memory allocationsFrediano Ziglio2015-10-061-4/+11
| | | | | | | | | | | | Prevent integer overflow when computing image sizes. Image index computations are done using 32 bit so this can cause easily security issues. MAX_DATA_CHUNK is larger than the virtual card limit, so this is not going to cause change in behaviours. Comparing size calculation results with MAX_DATA_CHUNK will allow us to catch overflows. Prevent guest from allocating large amount of memory. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
* Define a constant to limit data from guest.Frediano Ziglio2015-10-061-0/+11
| | | | | | This limit will prevent guest trying to do nasty things and DoS to host. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
* worker: avoid double free or double create of surfacesFrediano Ziglio2015-10-061-1/+8
| | | | | | | | | | A driver can overwrite surface state creating a surface with the same id of a previous one. Also can try to destroy surfaces that are not created. Both requests cause invalid internal states that could lead to crashes or memory corruptions. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
* worker: validate correctly surfacesFrediano Ziglio2015-10-061-15/+18
| | | | | | | | | | Do not just give warning and continue to use an invalid index into an array. Resolves: CVE-2015-5260 Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* worker: make it clear it returns from process when no cmdMarc-André Lureau2015-10-051-4/+4
| | | | Acked-by: Frediano Ziglio <fziglio@redhat.com>
* server: remove useless includesMarc-André Lureau2015-10-021-2/+1
| | | | Acked-by: Frediano Ziglio <fziglio@redhat.com>
* manual: Fix Arnon last nameChristophe Fergeau2015-10-011-1/+1
| | | | It's "Gilboa", not "Giloba"
* manual: Add section about debuggingChristophe Fergeau2015-10-011-0/+95
| | | | This details the basics for now, but can be detailed in the future.
* Update NEWSChristophe Fergeau2015-10-011-0/+14
|
* worker: count in drawable_new()Marc-André Lureau2015-09-291-3/+4
|
* PALLET -> PALETTEJonathon Jongsma2015-09-291-6/+6
| | | | Use the correct spelling for the enumeration
* tests: Fix -Werror=format-zero-length build failureChristophe Fergeau2015-09-291-2/+0
| | | | | | | replay.c: In function 'replay_channel_event': replay.c:226:16: error: zero-length gnu_printf format string [-Werror=format-zero-length] g_printerr("");
* display: Advertise preferred compression capChristophe Fergeau2015-09-241-0/+1
| | | | | | | | The patches adding a way for the client to set its preferred compression method added a new capability so that the server can indicate support for this feature. However, spice-server was not setting this capability on its display channel, which means clients are not going to try to send 'preferred-compression' messages even though the user request it.
* manual: add smartcard channel sectionMarc-André Lureau2015-09-151-0/+54
| | | | | | | Add some basic instructions to setup smartcard channel Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* manual: add missing spaceMarc-André Lureau2015-09-151-1/+1
| | | | | Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* manual: update webdav virt-manager sectionMarc-André Lureau2015-09-151-1/+3
| | | | | | | virt-manager can add webdav channel for a while now. Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Avoid race conditions reading monitor configs from guestFrediano Ziglio2015-09-081-13/+31
| | | | | | | | | | | | | For security reasons do not assume guest do not change structures it pass to Qemu. Guest could change count field while Qemu is copying QXLMonitorsConfig structure leading to heap corruption. This patch avoid it reading count only once. This patch solves CVE-2015-3247. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* replay: fix formatting stringFrediano Ziglio2015-09-081-1/+1
| | | | | Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-10 12:49:49 +0000