Rebase to latest upstream: 0.12.0
Related: rhbz#2020215 Signed-off-by: Victor Toso <victortoso@redhat.com>
This commit is contained in:
Victor Toso
parent
50274d5d0c
commit
ce440cf432
1
.gitignore
vendored
1
.gitignore
vendored
@ -13,3 +13,4 @@
|
||||
/usbredir-0.7.tar.bz2
|
||||
/usbredir-0.7.1.tar.bz2
|
||||
/usbredir-0.8.0.tar.bz2
|
||||
/usbredir-0.12.0.tar.xz
|
||||
|
||||
@ -1,74 +0,0 @@
|
||||
From 3b7e51c005a55f89f8a2e168853a96674ea52c11 Mon Sep 17 00:00:00 2001
|
||||
From: Michael Hanselmann <public@hansmi.ch>
|
||||
Date: Sun, 8 Aug 2021 15:35:58 +0200
|
||||
Subject: [PATCH 1/1] Avoid use-after-free in serialization
|
||||
|
||||
Serializing parsers with large amounts of buffered write data (e.g. in case of
|
||||
a slow or blocked write destination) would cause "serialize_data" to reallocate
|
||||
the state buffer whose default size is 64kB (USBREDIRPARSER_SERIALIZE_BUF_SIZE).
|
||||
The pointer to the position for the write buffer count would then point to
|
||||
a location outside the buffer where the number of write buffers would be written
|
||||
as a 32-bit value.
|
||||
|
||||
As of QEMU 5.2.0 the serializer is invoked for migrations. Serializations for
|
||||
migrations may happen regularily such as when using the COLO feature[1].
|
||||
Serialization happens under QEMU's I/O lock. The guest can't control the state
|
||||
while the serialization is happening. The value written is the number of
|
||||
outstanding buffers which would be suceptible to timing and host system system
|
||||
load. The guest would have to continously groom the write buffers. A useful
|
||||
value needs to be allocated in the exact position freed during the buffer size
|
||||
increase, but before the buffer count is written. The author doesn't consider it
|
||||
realistic to exploit this use-after-free reliably.
|
||||
|
||||
[1] https://wiki.qemu.org/Features/COLO
|
||||
|
||||
Signed-off-by: Michael Hanselmann <public@hansmi.ch>
|
||||
(cherry picked from commit 03c519ff5831ba75120e00ebebbf1d5a1f7220ab)
|
||||
---
|
||||
usbredirparser/usbredirparser.c | 8 +++++---
|
||||
1 file changed, 5 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/usbredirparser/usbredirparser.c b/usbredirparser/usbredirparser.c
|
||||
index 8f239cc..edfdfd2 100644
|
||||
--- a/usbredirparser/usbredirparser.c
|
||||
+++ b/usbredirparser/usbredirparser.c
|
||||
@@ -20,6 +20,7 @@
|
||||
*/
|
||||
#include "config.h"
|
||||
|
||||
+#include <stddef.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <stdarg.h>
|
||||
@@ -1581,8 +1582,9 @@ int usbredirparser_serialize(struct usbredirparser *parser_pub,
|
||||
struct usbredirparser_priv *parser =
|
||||
(struct usbredirparser_priv *)parser_pub;
|
||||
struct usbredirparser_buf *wbuf;
|
||||
- uint8_t *write_buf_count_pos, *state = NULL, *pos = NULL;
|
||||
+ uint8_t *state = NULL, *pos = NULL;
|
||||
uint32_t write_buf_count = 0, len, remain = 0;
|
||||
+ ptrdiff_t write_buf_count_pos;
|
||||
|
||||
*state_dest = NULL;
|
||||
*state_len = 0;
|
||||
@@ -1627,7 +1629,7 @@ int usbredirparser_serialize(struct usbredirparser *parser_pub,
|
||||
parser->data, parser->data_read, "packet-data"))
|
||||
return -1;
|
||||
|
||||
- write_buf_count_pos = pos;
|
||||
+ write_buf_count_pos = pos - state;
|
||||
/* To be replaced with write_buf_count later */
|
||||
if (serialize_int(parser, &state, &pos, &remain, 0, "write_buf_count"))
|
||||
return -1;
|
||||
@@ -1642,7 +1644,7 @@ int usbredirparser_serialize(struct usbredirparser *parser_pub,
|
||||
wbuf = wbuf->next;
|
||||
}
|
||||
/* Patch in write_buf_count */
|
||||
- memcpy(write_buf_count_pos, &write_buf_count, sizeof(int32_t));
|
||||
+ memcpy(state + write_buf_count_pos, &write_buf_count, sizeof(int32_t));
|
||||
|
||||
/* Patch in length */
|
||||
len = pos - state;
|
||||
--
|
||||
2.31.1
|
||||
|
||||
2
sources
2
sources
@ -1 +1 @@
|
||||
SHA512 (usbredir-0.8.0.tar.bz2) = 976274adf08f8691b0961f5238021e988a4347873d0c67576038f44cbdaf25c2bb325d8cede0a507933b719f9715b1508ccd1d8f52fccd36f13a7640553dc108
|
||||
SHA512 (usbredir-0.12.0.tar.xz) = f509a6b5d410fec53efbdc186b80376d6b7f5b34c6c33f2037a83bf105743667c5a18a6d1ef33d6b3c57c1ed6a52b94536369ca768eddb70fda7b436d35fe6ab
|
||||
|
||||
@ -1,15 +1,15 @@
|
||||
Name: usbredir
|
||||
Version: 0.8.0
|
||||
Release: 9%{?dist}
|
||||
Version: 0.12.0
|
||||
Release: 1%{?dist}
|
||||
Summary: USB network redirection protocol libraries
|
||||
License: LGPLv2+
|
||||
URL: http://spice-space.org/page/UsbRedir
|
||||
Source0: http://spice-space.org/download/%{name}/%{name}-%{version}.tar.bz2
|
||||
Patch0001: 0001-Avoid-use-after-free-in-serialization.patch
|
||||
BuildRequires: make
|
||||
URL: https://spice-space.org/usbredir.html
|
||||
Source0: http://spice-space.org/download/%{name}/%{name}-%{version}.tar.xz
|
||||
BuildRequires: gcc
|
||||
BuildRequires: git-core
|
||||
BuildRequires: glib2-devel
|
||||
BuildRequires: libusb1-devel >= 1.0.9
|
||||
BuildRequires: git-core
|
||||
BuildRequires: meson
|
||||
|
||||
%description
|
||||
The usbredir libraries allow USB devices to be used on remote and/or virtual
|
||||
@ -49,13 +49,15 @@ A simple USB host TCP server, using libusbredirhost.
|
||||
|
||||
|
||||
%build
|
||||
%configure --disable-static
|
||||
make %{?_smp_mflags} V=1
|
||||
%meson \
|
||||
-Dgit_werror=disabled \
|
||||
-Dtools=enabled \
|
||||
-Dfuzzing=disabled
|
||||
|
||||
%meson_build
|
||||
|
||||
%install
|
||||
%make_install
|
||||
rm $RPM_BUILD_ROOT%{_libdir}/libusbredir*.la
|
||||
%meson_install
|
||||
|
||||
|
||||
%ldconfig_scriptlets
|
||||
@ -67,7 +69,7 @@ rm $RPM_BUILD_ROOT%{_libdir}/libusbredir*.la
|
||||
%{_libdir}/libusbredir*.so.*
|
||||
|
||||
%files devel
|
||||
%doc usb-redirection-protocol.txt README.multi-thread ChangeLog TODO
|
||||
%doc docs/usb-redirection-protocol.md docs/multi-thread.md ChangeLog.md TODO
|
||||
%{_includedir}/usbredir*.h
|
||||
%{_libdir}/libusbredir*.so
|
||||
%{_libdir}/pkgconfig/libusbredir*.pc
|
||||
@ -75,11 +77,17 @@ rm $RPM_BUILD_ROOT%{_libdir}/libusbredir*.la
|
||||
%files server
|
||||
%{!?_licensedir:%global license %%doc}
|
||||
%license COPYING
|
||||
%{_bindir}/usbredirect
|
||||
%{_sbindir}/usbredirserver
|
||||
%{_mandir}/man1/usbredirect.1*
|
||||
%{_mandir}/man1/usbredirserver.1*
|
||||
|
||||
|
||||
%changelog
|
||||
* Mon Nov 15 2021 Victor Toso <victortoso@redhat.com> - 0.12.0-1
|
||||
- Rebase to latest upstream: 0.12.0
|
||||
Related: rhbz#2020215
|
||||
|
||||
* Wed Sep 15 2021 Victor Toso <victortoso@redhat.com> - 0.8.0-9
|
||||
- Avoid use-after-free in serialization
|
||||
Related: rhbz#1992873
|
||||
|
||||
Loading…
Reference in New Issue
Block a user