summaryrefslogtreecommitdiffstats
path: root/server/red_parse_qxl.c
Commit message (Collapse)AuthorAgeFilesLines
* worker s/surfaces_dest/surface_depsMarc-André Lureau2015-11-101-5/+5
| | | | | Acked-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
* server: move bitmap related to spice-bitmap-utilsMarc-André Lureau2015-11-031-0/+1
| | | | | | | Also remove some unused function parameters from bitmap_get_graduality_level() Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
* Prevent leak if size from red_get_data_chunks don't match in red_get_imageFrediano Ziglio2015-10-061-0/+2
| | | | Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
* Prevent data_size to be set independently from dataFrediano Ziglio2015-10-061-0/+1
| | | | | | | | There was not check for data_size field so one could set data to a small set of data and data_size much bigger than size of data leading to buffer overflow. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
* Avoid race condition copying segments in red_get_pathFrediano Ziglio2015-10-061-1/+1
| | | | | | | | | The guest can attempt to increase the number of segments while spice-server is reading them. Make sure we don't copy more then the allocated segments. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Make sure we can read QXLPathSeg structuresFrediano Ziglio2015-10-061-2/+2
| | | | | | | | | start pointer points to a QXLPathSeg structure. Before reading from the structure, make sure the structure is contained in the memory range checked. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Fix some possible overflows in red_get_string for 32 bitFrediano Ziglio2015-10-061-1/+7
| | | | | Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Prevent DoS from guest trying to allocate too much data on host for chunksFrediano Ziglio2015-10-061-8/+41
| | | | | | | | | | Limit number of chunks to a given amount to avoid guest trying to allocate too much memory. Using circular or nested chunks lists guest could try to allocate huge amounts of memory. Considering the list can be infinite and guest can change data this also prevents strange security attacks from guest. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
* Prevent memory leak if red_get_data_chunks_ptr failsFrediano Ziglio2015-10-061-11/+20
| | | | | | | Free linked list if client tries to do nasty things Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Fix race condition in red_get_data_chunks_ptrFrediano Ziglio2015-10-061-7/+10
| | | | | | | | | | | | Do not read multiple times data from guest as this can be changed by other guest vcpus. This causes races and security problems if these data are used for buffer allocation or checks. Actually, the 'data' member can't change during read as it is just a pointer to a fixed array contained in qxl. However, this change will make it clear that there can be no race condition. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
* Fix integer overflow computing glyph_size in red_get_stringFrediano Ziglio2015-10-061-3/+5
| | | | | | | | | | | | | | | | | | | | If bpp is int the formula can lead to weird overflows. width and height are uint16_t so the formula is: size_t = u16 * (u16 * int + const_int) / const_int; so it became size_t = (int) u16 * ((int) u16 * int + const_int) / const_int; However the (int) u16 * (int) u16 can then became negative to overflow. Under 64 bit architectures size_t is 64 and int usually 32 so converting this negative 32 bit number to a unsigned 64 bit lead to a very big number as the signed is extended and then converted to unsigned. Using unsigned arithmetic prevent extending the sign. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Fix race condition in red_get_stringFrediano Ziglio2015-10-061-6/+9
| | | | | | | Do not read multiple time an array size that can be changed. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Fix race in red_get_imageFrediano Ziglio2015-10-061-8/+10
| | | | | | | | | | Do not read multiple times data from guest as this could be changed by other vcpu threads. This causes races and security problems if these data are used for buffer allocation or checks. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Fix race condition on red_get_clip_rectsFrediano Ziglio2015-10-061-3/+5
| | | | | | | Do not read multiple time an array size that can be changed. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Prevent 32 bit integer overflow in bitmap_consistentFrediano Ziglio2015-10-061-3/+4
| | | | | | | | | The overflow may lead to buffer overflow as the row size computed from width (bitmap->x) can be bigger than the size in bytes (bitmap->stride). This can make spice-server accept the invalid sizes. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Fix buffer reading overflowFrediano Ziglio2015-10-061-1/+8
| | | | | | | | | Not security risk as just for read. However, this could be used to attempt integer overflows in the following lines. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Check properly surface to be createdFrediano Ziglio2015-10-061-1/+34
| | | | | | | | Check format is valid. Check stride is at least the size of required bytes for a row. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
* Fix some integer overflow causing large memory allocationsFrediano Ziglio2015-10-061-4/+11
| | | | | | | | | | | | Prevent integer overflow when computing image sizes. Image index computations are done using 32 bit so this can cause easily security issues. MAX_DATA_CHUNK is larger than the virtual card limit, so this is not going to cause change in behaviours. Comparing size calculation results with MAX_DATA_CHUNK will allow us to catch overflows. Prevent guest from allocating large amount of memory. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
* Define a constant to limit data from guest.Frediano Ziglio2015-10-061-0/+11
| | | | | | This limit will prevent guest trying to do nasty things and DoS to host. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
* red_parse_qxl: Do not compute abs unsigned intVictor Toso2015-08-121-1/+1
| | | | | | | | | | | SpiceBitmap's stride is uint32_t. from clang: red_parse_qxl.c:452:41: error: taking the absolute value of unsigned type 'uint32_t' (aka 'unsigned int') has no effect bitmap_size = red->u.bitmap.y * abs(red->u.bitmap.stride); ^
* red_parse_qxl: remove unused variableVictor Toso2015-08-111-4/+0
|
* Fix indentation in red_get_opaque_ptrChristophe Fergeau2014-09-181-1/+1
| | | | This removes one extra space
* red_parse_qxl: Change spice_error() to spice_warning()Christophe Fergeau2013-09-021-3/+4
| | | | | | | | After eb09c25c, red_parse_qxl.c still has some spice_error() which will kill the server even though the code is trying to return an error when the spice_error() is hit. This commit replaces these occurrences with a spice_warning() which will not kill spice-server.
* server: bitmap_consistent: replace spice_error with spice_warningUri Lublin2013-09-021-1/+1
| | | | | | | | | bitmap_consistent should return true or false. Currently it aborts instead of returning false, due to spice_error. Replacing spice_error with spice_warning, provides information and returns false, as expected. This fixes Fedora bz#997932
* syntax-check: remove trailing whitespacesUri Lublin2013-07-161-3/+2
| | | | Only whitespace changes in this commit.
* syntax-check: fix avoid_if_before_freeUri Lublin2013-07-161-6/+2
|
* server/red_parse_qxl: two coding convention pointer cast fixAlon Levy2013-05-171-2/+2
|
* red_parse_qxl: fix throwing away drawables that have masksYonit Halperin2012-12-201-14/+13
| | | | | | | Non rgb bitmaps are allowed to not have a palette in case they are masks (which are 1BIT bitmaps). Related: rhbz#864982
* server/red_parse_qxl: fix bitmap_consistent againAlon Levy2012-09-051-2/+2
|
* server/red_parse_qxl: fix wrong bitmap_consistentAlon Levy2012-09-051-5/+26
| | | | | The bit calculation was wrong for all the paletted types by a factor of between 8 and 1 (SPICE_BITMAP_FMT_{1,4,8}BIT_PLT_{LE,BE})
* server/red_parse_qxl: add bitmap consistency checkAlon Levy2012-09-031-0/+17
| | | | | | | | | | | Just checks stride vs width times bpp. This fixes a potential abort on guest generated bad images in glz_encoder. Other files touched to move some consts to red_common, they are static so no problem to be defined in both red_worker.c and red_parse_qxl.c .
* Add support for QXLComposite to spice serverSøren Sandmann Pedersen2012-08-241-1/+58
| | | | | | In red-parse-qxl.c add support for parsing QXLComposite into SpiceComposite. In red-worker.c add support for marshalling SpiceComposite onto the wire.
* Add support for LZ compression of A8 imagesSøren Sandmann Pedersen2012-08-241-1/+1
| | | | | | Graduality is irrelevant for A8 images, so instead of using RGB-ness as a short-cut, add a new macro BITMAP_FMT_HAS_GRADUALITY() that returns true for the existing RGB images, but false for A8.
* server/red_parse_qxl: red_get_image: fix leaks on bad imageAlon Levy2012-07-221-8/+16
|
* server/red_parse_qxl: disallow zero area bitmapsAlon Levy2012-07-221-0/+4
| | | | | | prevents division by zero later (SIGFPE, Arithmetic exception) in spice-common code, at spice-common/common/canvas_base.c:646 for both client and server (server only upon rendering).
* server/red_parse_qxl: get_path: remove return NULLAlon Levy2012-07-221-1/+0
| | | | introduced by 2ec2dbc78a660ee4e3315f50c881d9e31a8e4fe2
* server: don't abort on guest images with missing palettesAlon Levy2012-07-221-0/+9
|
* server: move self_bitmap_image to RedDrawableAlon Levy2012-05-151-0/+3
| | | | | | | Simplify keeping count of self_bitmap_image by putting it in RedDrawable. It is allocated on reading from the command pipe and deallocated when the last reference to the RedDrawable is dropped, instead of keeping track of it in GlzDrawable and Drawable.
* server: allow failure in getvirtAlon Levy2012-04-051-53/+158
| | | | | | | This patch changed getvirt to continue working even if spice_critical doesn't abort (i.e. SPICE_ABORT_LEVEL != -1). This is in preparation to make getvirt not abort at all. The reason is that getvirt is run on guest provided memory, so a bad driver can crash the vm.
* Use the spice-common logging functionsMarc-André Lureau2012-03-251-23/+22
| | | | | It will abort by default for critical level messages. That behaviour can be tuned at runtime.
* Remove trailing blank linesDaniel P. Berrange2012-01-131-1/+0
| | | | Remove any blank lines at the end of all source files
* Remove useless if() before free()Daniel P. Berrange2012-01-131-3/+1
| | | | | The free() function allows NULL to be passed in, so any code which puts a if() before free() is wasting time
* server/red_parse_qxl.h: License should be LGPLv2+ rather then GPLv2+Hans de Goede2011-12-151-3/+3
| | | | | | | Also fixup the header of server/red_parse_qxl.c, which still contained some GPL (program rather then library) text in its header. Signed-off-by: Hans de Goede <hdegoede@redhat.com>
* server: add async io supportAlon Levy2011-07-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | The new _ASYNC io's in qxl_dev listed at the end get six new api functions, and an additional callback function "async_complete". When the async version of a specific io is used, completion is notified by calling async_complete, and no READY message is written or expected by the dispatcher. update_area has been changed to push QXLRects to the worker thread, where the conversion to SpiceRect takes place. A cookie has been added to each async call to QXLWorker, and is passed back via async_complete. Added api: QXLWorker: update_area_async add_memslot_async destroy_surfaces_async destroy_primary_surface_async create_primary_surface_async destroy_surface_wait_async QXLInterface: async_complete
* add #include <config.h> to all source filesChristophe Fergeau2011-05-031-0/+3
| | | | | | | | When using config.h, it must be the very first include in all source files since it contains #define that may change the compilation process (eg libc structure layout changes when it's used to enable large file support on 32 bit x86 archs). This commit adds it at the beginning of all .c and .cpp files
* client/server: warning fixes (gcc 4.6.0)Alon Levy2011-01-251-2/+1
| | | | | gcc 4.6.0 added "[-Werror=unused-but-set-variable]", this and the next few fixes tend to that. Mostly harmless.
* Update license header for server/red_parse_qxl.cHans de Goede2011-01-211-6/+6
| | | | This one mistakenly had a GPL header rather then an LGPL header.
* server: Don't leak QUIC image chunksAlexander Larsson2010-09-211-0/+3
| | | | | red_put_image() needs to free the chunks for QUIC images, as we allocate these when creating the image.
* fix palette handling for 0.4 compatGerd Hoffmann2010-09-141-43/+56
| | | | | spice 0.4 guests pass 16bpp palette colors when running in a 16bpp video mode. Convert them to 32bpp.
* fix brush handling for 0.4 compatGerd Hoffmann2010-09-141-23/+38
| | | | | spice 0.4 guests pass 16bpp colors for brushes when running in a 16bpp video mode. Convert them to 32bpp.
generated by cgit (git 2.34.1) at 2024-05-05 04:50:51 +0000