From ce440cf432a98c66de153b374ea51365899c64f6 Mon Sep 17 00:00:00 2001 From: Victor Toso Date: Mon, 15 Nov 2021 11:51:09 +0100 Subject: [PATCH] Rebase to latest upstream: 0.12.0 Related: rhbz#2020215 Signed-off-by: Victor Toso --- .gitignore | 1 + ...void-use-after-free-in-serialization.patch | 74 ------------------- sources | 2 +- usbredir.spec | 32 +++++--- 4 files changed, 22 insertions(+), 87 deletions(-) delete mode 100644 0001-Avoid-use-after-free-in-serialization.patch diff --git a/.gitignore b/.gitignore index 804a74e..af8493a 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ /usbredir-0.7.tar.bz2 /usbredir-0.7.1.tar.bz2 /usbredir-0.8.0.tar.bz2 +/usbredir-0.12.0.tar.xz diff --git a/0001-Avoid-use-after-free-in-serialization.patch b/0001-Avoid-use-after-free-in-serialization.patch deleted file mode 100644 index cea1397..0000000 --- a/0001-Avoid-use-after-free-in-serialization.patch +++ /dev/null @@ -1,74 +0,0 @@ -From 3b7e51c005a55f89f8a2e168853a96674ea52c11 Mon Sep 17 00:00:00 2001 -From: Michael Hanselmann -Date: Sun, 8 Aug 2021 15:35:58 +0200 -Subject: [PATCH 1/1] Avoid use-after-free in serialization - -Serializing parsers with large amounts of buffered write data (e.g. in case of -a slow or blocked write destination) would cause "serialize_data" to reallocate -the state buffer whose default size is 64kB (USBREDIRPARSER_SERIALIZE_BUF_SIZE). -The pointer to the position for the write buffer count would then point to -a location outside the buffer where the number of write buffers would be written -as a 32-bit value. - -As of QEMU 5.2.0 the serializer is invoked for migrations. Serializations for -migrations may happen regularily such as when using the COLO feature[1]. -Serialization happens under QEMU's I/O lock. The guest can't control the state -while the serialization is happening. The value written is the number of -outstanding buffers which would be suceptible to timing and host system system -load. The guest would have to continously groom the write buffers. A useful -value needs to be allocated in the exact position freed during the buffer size -increase, but before the buffer count is written. The author doesn't consider it -realistic to exploit this use-after-free reliably. - -[1] https://wiki.qemu.org/Features/COLO - -Signed-off-by: Michael Hanselmann -(cherry picked from commit 03c519ff5831ba75120e00ebebbf1d5a1f7220ab) ---- - usbredirparser/usbredirparser.c | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - -diff --git a/usbredirparser/usbredirparser.c b/usbredirparser/usbredirparser.c -index 8f239cc..edfdfd2 100644 ---- a/usbredirparser/usbredirparser.c -+++ b/usbredirparser/usbredirparser.c -@@ -20,6 +20,7 @@ - */ - #include "config.h" - -+#include - #include - #include - #include -@@ -1581,8 +1582,9 @@ int usbredirparser_serialize(struct usbredirparser *parser_pub, - struct usbredirparser_priv *parser = - (struct usbredirparser_priv *)parser_pub; - struct usbredirparser_buf *wbuf; -- uint8_t *write_buf_count_pos, *state = NULL, *pos = NULL; -+ uint8_t *state = NULL, *pos = NULL; - uint32_t write_buf_count = 0, len, remain = 0; -+ ptrdiff_t write_buf_count_pos; - - *state_dest = NULL; - *state_len = 0; -@@ -1627,7 +1629,7 @@ int usbredirparser_serialize(struct usbredirparser *parser_pub, - parser->data, parser->data_read, "packet-data")) - return -1; - -- write_buf_count_pos = pos; -+ write_buf_count_pos = pos - state; - /* To be replaced with write_buf_count later */ - if (serialize_int(parser, &state, &pos, &remain, 0, "write_buf_count")) - return -1; -@@ -1642,7 +1644,7 @@ int usbredirparser_serialize(struct usbredirparser *parser_pub, - wbuf = wbuf->next; - } - /* Patch in write_buf_count */ -- memcpy(write_buf_count_pos, &write_buf_count, sizeof(int32_t)); -+ memcpy(state + write_buf_count_pos, &write_buf_count, sizeof(int32_t)); - - /* Patch in length */ - len = pos - state; --- -2.31.1 - diff --git a/sources b/sources index 0b58e99..af70fd0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (usbredir-0.8.0.tar.bz2) = 976274adf08f8691b0961f5238021e988a4347873d0c67576038f44cbdaf25c2bb325d8cede0a507933b719f9715b1508ccd1d8f52fccd36f13a7640553dc108 +SHA512 (usbredir-0.12.0.tar.xz) = f509a6b5d410fec53efbdc186b80376d6b7f5b34c6c33f2037a83bf105743667c5a18a6d1ef33d6b3c57c1ed6a52b94536369ca768eddb70fda7b436d35fe6ab diff --git a/usbredir.spec b/usbredir.spec index 0ca9f03..1cc2c32 100644 --- a/usbredir.spec +++ b/usbredir.spec @@ -1,15 +1,15 @@ Name: usbredir -Version: 0.8.0 -Release: 9%{?dist} +Version: 0.12.0 +Release: 1%{?dist} Summary: USB network redirection protocol libraries License: LGPLv2+ -URL: http://spice-space.org/page/UsbRedir -Source0: http://spice-space.org/download/%{name}/%{name}-%{version}.tar.bz2 -Patch0001: 0001-Avoid-use-after-free-in-serialization.patch -BuildRequires: make +URL: https://spice-space.org/usbredir.html +Source0: http://spice-space.org/download/%{name}/%{name}-%{version}.tar.xz BuildRequires: gcc -BuildRequires: git-core +BuildRequires: glib2-devel BuildRequires: libusb1-devel >= 1.0.9 +BuildRequires: git-core +BuildRequires: meson %description The usbredir libraries allow USB devices to be used on remote and/or virtual @@ -49,13 +49,15 @@ A simple USB host TCP server, using libusbredirhost. %build -%configure --disable-static -make %{?_smp_mflags} V=1 +%meson \ + -Dgit_werror=disabled \ + -Dtools=enabled \ + -Dfuzzing=disabled +%meson_build %install -%make_install -rm $RPM_BUILD_ROOT%{_libdir}/libusbredir*.la +%meson_install %ldconfig_scriptlets @@ -67,7 +69,7 @@ rm $RPM_BUILD_ROOT%{_libdir}/libusbredir*.la %{_libdir}/libusbredir*.so.* %files devel -%doc usb-redirection-protocol.txt README.multi-thread ChangeLog TODO +%doc docs/usb-redirection-protocol.md docs/multi-thread.md ChangeLog.md TODO %{_includedir}/usbredir*.h %{_libdir}/libusbredir*.so %{_libdir}/pkgconfig/libusbredir*.pc @@ -75,11 +77,17 @@ rm $RPM_BUILD_ROOT%{_libdir}/libusbredir*.la %files server %{!?_licensedir:%global license %%doc} %license COPYING +%{_bindir}/usbredirect %{_sbindir}/usbredirserver +%{_mandir}/man1/usbredirect.1* %{_mandir}/man1/usbredirserver.1* %changelog +* Mon Nov 15 2021 Victor Toso - 0.12.0-1 +- Rebase to latest upstream: 0.12.0 + Related: rhbz#2020215 + * Wed Sep 15 2021 Victor Toso - 0.8.0-9 - Avoid use-after-free in serialization Related: rhbz#1992873