From patchwork Mon Nov 21 17:25:15 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thomas Huth X-Patchwork-Id: 9439867 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0ED7760469 for ; Mon, 21 Nov 2016 17:25:46 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0DFF828B2E for ; Mon, 21 Nov 2016 17:25:46 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 007AF28B32; Mon, 21 Nov 2016 17:25:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 749C328B2E for ; Mon, 21 Nov 2016 17:25:45 +0000 (UTC) Received: from localhost ([::1]:50843 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c8sLf-0008C6-VL for patchwork-qemu-devel@patchwork.kernel.org; Mon, 21 Nov 2016 12:25:44 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59061) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c8sLL-0008Bf-Dl for qemu-devel@nongnu.org; Mon, 21 Nov 2016 12:25:24 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c8sLI-0006L0-5H for qemu-devel@nongnu.org; Mon, 21 Nov 2016 12:25:23 -0500 Received: from mx1.redhat.com ([209.132.183.28]:51204) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1c8sLH-0006Kq-VX; Mon, 21 Nov 2016 12:25:20 -0500 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id C6FB5C04B92E; Mon, 21 Nov 2016 17:25:17 +0000 (UTC) Received: from thh440s.str.redhat.com (dhcp-192-219.str.redhat.com [10.33.192.219]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id uALHPGGb029862; Mon, 21 Nov 2016 12:25:17 -0500 From: Thomas Huth To: qemu-devel@nongnu.org, Gerd Hoffmann Date: Mon, 21 Nov 2016 18:25:15 +0100 Message-Id: <1479749115-21932-1-git-send-email-thuth@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Mon, 21 Nov 2016 17:25:18 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH] ui/vnc: Fix problem with sending too many bytes as server name X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: qemu-stable@nongnu.org Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP If the buffer is not big enough, snprintf() does not return the number of bytes that have been written to the buffer, but the number of bytes that would be needed for writing the whole string. By using this value for the following vnc_write() calls, we send some junk at the end of the name in case the qemu_name is longer than 1017 bytes, which could confuse the VNC clients. Fix this by adding an additional size check here. Buglink: https://bugs.launchpad.net/qemu/+bug/1637447 Signed-off-by: Thomas Huth Reviewed-by: Eric Blake --- ui/vnc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index 2c28a59..29aa9c4 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2459,10 +2459,14 @@ static int protocol_client_init(VncState *vs, uint8_t *data, size_t len) pixel_format_message(vs); - if (qemu_name) + if (qemu_name) { size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name); - else + if (size > sizeof(buf)) { + size = sizeof(buf); + } + } else { size = snprintf(buf, sizeof(buf), "QEMU"); + } vnc_write_u32(vs, size); vnc_write(vs, buf, size);