From 7bbf04e5484129037d29018352ab6d3333fddf05 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Fri, 22 Mar 2019 15:20:13 +0100 Subject: [PATCH 5/6] clipboard: pre-condition on selection value < 256 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The protocol uses a u8 for the selection value. Make sure the given argument value fits there, or throw a critical. The other places seem to use u8 variables already. Signed-off-by: Marc-André Lureau --- src/channel-main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/channel-main.c b/src/channel-main.c index adf6bab..8574ae6 100644 --- a/src/channel-main.c +++ b/src/channel-main.c @@ -1354,6 +1354,7 @@ static void agent_clipboard_grab(SpiceMainChannel *channel, guint selection, if (!c->agent_connected) return; + g_return_if_fail(selection < 256); g_return_if_fail(test_agent_cap(channel, VD_AGENT_CAP_CLIPBOARD_BY_DEMAND)); size = sizeof(VDAgentClipboardGrab) + sizeof(uint32_t) * ntypes; -- 2.23.0