Re: [PATCH][Take 3] VNC authentification

[Anthony Liguori <aliguori@us.ibm.com>]

Masami Watanabe wrote:
> +static int vnc_auth(VncState *vs)
> +{
> +    extern char vncpasswd[64];
> +    extern unsigned char challenge[AUTHCHALLENGESIZE];
> +
> +    if (*vncpasswd == '\0') {
> +	/* AuthType is None */
> +	vnc_write_u32(vs, 1);
> +	vnc_flush(vs);
> +	vnc_read_when(vs, protocol_client_init, 1);
> +    } else {
> +	/* AuthType is VncAuth */
> +	vnc_write_u32(vs, 2);
> +	vnc_flush(vs);
> +
> +	/* Read AuthType */
> +	vnc_read_when(vs, protocol_authtype, 1);
>   

As I mentioned before, you cannot have to vnc_read_when()'s execution 
path without returning the the mainloop.

protocol_authtype() cannot possibly be invoked.  If the code is working 
now, it's pure luck.

There was just a very high profile RealVNC vulnerability that was due to 
improper authtype handling.  It's very important we do this right so we 
don't duplicate this bug.

Regards,

Anthony Liguori

> +	/* Send Challenge */
> +	make_challenge(challenge, AUTHCHALLENGESIZE);
> +	vnc_write(vs, challenge, AUTHCHALLENGESIZE);
> +	vnc_flush(vs);
> +
> +	/* Read Responce */
> +	vnc_read_when(vs, protocol_response, AUTHCHALLENGESIZE);
> +    }
> +
> +    return 0;
> +}
>   


> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xensource.com
> http://lists.xensource.com/xen-devel
>
>