From e16eee1d8be00b186437bf61e4e1871cd8d0211a Mon Sep 17 00:00:00 2001 From: Frediano Ziglio Date: Tue, 13 Dec 2016 14:40:10 +0000 Subject: [spice-server 2/3] Prevent integer overflows in capability checks The limits for capabilities are specified using 32 bit unsigned integers. This could cause possible integer overflows causing buffer overflows. For instance the sum of num_common_caps and num_caps can be 0 avoiding additional checks. As the link message is now capped to 4096 and the capabilities are contained in the link message limit the capabilities to 1024 (capabilities are expressed in number of uint32_t items). Signed-off-by: Frediano Ziglio Acked-by: Christophe Fergeau --- server/reds.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/server/reds.c b/server/reds.c index e7ebc43..953a95a 100644 --- a/server/reds.c +++ b/server/reds.c @@ -2186,6 +2186,14 @@ static void reds_handle_read_link_done(void *opaque) link_mess->num_channel_caps = GUINT32_FROM_LE(link_mess->num_channel_caps); link_mess->num_common_caps = GUINT32_FROM_LE(link_mess->num_common_caps); + /* Prevent DoS. Currently we defined only 13 capabilities, + * I expect 1024 to be valid for quite a lot time */ + if (link_mess->num_channel_caps > 1024 || link_mess->num_common_caps > 1024) { + reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA); + reds_link_free(link); + return; + } + num_caps = link_mess->num_common_caps + link_mess->num_channel_caps; caps = (uint32_t *)((uint8_t *)link_mess + link_mess->caps_offset); -- 2.9.3