[Qemu-devel] [PULL 0/2] vnc patch queue

[Qemu-devel] [PULL 0/2] vnc patch queue

[Gerd Hoffmann]

  Hi,

Here comes the vnc patch queue with two fixes.

please pull,
  Gerd

The following changes since commit 3e9418e160cd8901c83a3c88967158084f5b5c03:

  Revert "main-loop.c: Handle SIGINT, SIGHUP and SIGTERM synchronously" (2014-10-27 15:05:09 +0000)

are available in the git repository at:

  git://git.kraxel.org/qemu tags/pull-vnc-20141028-1

for you to fetch changes up to 9d6b20704734fe1ab789400806ebd54f579d50a2:

  vnc: return directly if no vnc client connected (2014-10-28 11:51:04 +0100)

----------------------------------------------------------------
vnc: return directly if no vnc client connected
vnc: sanitize bits_per_pixel from the client (CVE-2014-7815)

----------------------------------------------------------------
ChenLiang (1):
      vnc: return directly if no vnc client connected

Petr Matousek (1):
      vnc: sanitize bits_per_pixel from the client

 ui/vnc.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

[Qemu-devel] [PULL 1/2] vnc: sanitize bits_per_pixel from the client

[Gerd Hoffmann]

From: Petr Matousek <pmatouse@redhat.com>

bits_per_pixel that are less than 8 could result in accessing
non-initialized buffers later in the code due to the expectation
that bytes_per_pixel value that is used to initialize these buffers is
never zero.

To fix this check that bits_per_pixel from the client is one of the
values that the rfb protocol specification allows.

This is CVE-2014-7815.

Signed-off-by: Petr Matousek <pmatouse@redhat.com>

[ kraxel: apply codestyle fix ]

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 ui/vnc.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/ui/vnc.c b/ui/vnc.c
index 0fe6eff..8bca597 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2026,6 +2026,16 @@ static void set_pixel_format(VncState *vs,
         return;
     }
 
+    switch (bits_per_pixel) {
+    case 8:
+    case 16:
+    case 32:
+        break;
+    default:
+        vnc_client_error(vs);
+        return;
+    }
+
     vs->client_pf.rmax = red_max;
     vs->client_pf.rbits = hweight_long(red_max);
     vs->client_pf.rshift = red_shift;
-- 
1.8.3.1

[Qemu-devel] [PULL 2/2] vnc: return directly if no vnc client connected

[Gerd Hoffmann]

From: ChenLiang <chenliang88@huawei.com>

graphic_hw_update and vnc_refresh_server_surface aren't
need to do when no vnc client connected. It can reduce
lock contention, because vnc_refresh will hold global big
lock two millisecond every three seconds.

Signed-off-by: ChenLiang <chenliang88@huawei.com>
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 ui/vnc.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/ui/vnc.c b/ui/vnc.c
index 8bca597..5707015 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -2778,6 +2778,11 @@ static void vnc_refresh(DisplayChangeListener *dcl)
     VncState *vs, *vn;
     int has_dirty, rects = 0;
 
+    if (QTAILQ_EMPTY(&vd->clients)) {
+        update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
+        return;
+    }
+
     graphic_hw_update(NULL);
 
     if (vnc_trylock_display(vd)) {
@@ -2793,11 +2798,6 @@ static void vnc_refresh(DisplayChangeListener *dcl)
         /* vs might be free()ed here */
     }
 
-    if (QTAILQ_EMPTY(&vd->clients)) {
-        update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_MAX);
-        return;
-    }
-
     if (has_dirty && rects) {
         vd->dcl.update_interval /= 2;
         if (vd->dcl.update_interval < VNC_REFRESH_INTERVAL_BASE) {
-- 
1.8.3.1

Re: [Qemu-devel] [PULL 0/2] vnc patch queue

[Peter Maydell]

On 28 October 2014 10:59, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> Here comes the vnc patch queue with two fixes.
>
> please pull,
>   Gerd
>
> The following changes since commit 3e9418e160cd8901c83a3c88967158084f5b5c03:
>
>   Revert "main-loop.c: Handle SIGINT, SIGHUP and SIGTERM synchronously" (2014-10-27 15:05:09 +0000)
>
> are available in the git repository at:
>
>   git://git.kraxel.org/qemu tags/pull-vnc-20141028-1
>
> for you to fetch changes up to 9d6b20704734fe1ab789400806ebd54f579d50a2:
>
>   vnc: return directly if no vnc client connected (2014-10-28 11:51:04 +0100)
>
> ----------------------------------------------------------------
> vnc: return directly if no vnc client connected
> vnc: sanitize bits_per_pixel from the client (CVE-2014-7815)
>
> ----------------------------------------------------------------

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 0/2] vnc patch queue

[Gerd Hoffmann]

  Hi,

Starting to flush queues after the 2.2 release, starting with two little
vnc fixes.  Well, keymap is strictly speaking not vnc, but vnc is the
major user of keymap support, so I sticked it in here.

please pull,
  Gerd

The following changes since commit 45e1611de8be0eae55967694dd6e627c2dc354f2:

  Update version for v2.2.0 release (2014-12-09 12:13:37 +0000)

are available in the git repository at:

  git://git.kraxel.org/qemu tags/pull-vnc-20141210-1

for you to fetch changes up to 43948386bb109b97b3de0bb48573f317bdcb5008:

  keymaps: correct keymaps.c following Qemu coding style (2014-12-10 10:08:12 +0100)

----------------------------------------------------------------
vnc-enc-tight fix, keymaps code style.

----------------------------------------------------------------
Gonglei (2):
      vnc-enc-tight: fix Arguments in wrong order
      keymaps: correct keymaps.c following Qemu coding style

 ui/keymaps.c       | 196 +++++++++++++++++++++++++++++------------------------
 ui/vnc-enc-tight.c |   2 +-
 2 files changed, 109 insertions(+), 89 deletions(-)

Re: [Qemu-devel] [PULL 0/2] vnc patch queue

[Peter Maydell]

On 10 December 2014 at 09:32, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> Starting to flush queues after the 2.2 release, starting with two little
> vnc fixes.  Well, keymap is strictly speaking not vnc, but vnc is the
> major user of keymap support, so I sticked it in here.
>
> please pull,
>   Gerd
>
> The following changes since commit 45e1611de8be0eae55967694dd6e627c2dc354f2:
>
>   Update version for v2.2.0 release (2014-12-09 12:13:37 +0000)
>
> are available in the git repository at:
>
>   git://git.kraxel.org/qemu tags/pull-vnc-20141210-1
>
> for you to fetch changes up to 43948386bb109b97b3de0bb48573f317bdcb5008:
>
>   keymaps: correct keymaps.c following Qemu coding style (2014-12-10 10:08:12 +0100)
>
> ----------------------------------------------------------------
> vnc-enc-tight fix, keymaps code style.
>
> ----------------------------------------------------------------

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 0/2] vnc patch queue

[Gerd Hoffmann]

  Hi,

Two little vnc patches.

please pull,
  Gerd

The following changes since commit e4d50d47a9eb15f42bdd561803a29a4d7c3eb8ec:

  qemu-char: Rename register_char_driver_qapi() to register_char_driver() (2014-09-16 23:36:32 +0100)

are available in the git repository at:

  git://git.kraxel.org/qemu tags/pull-vnc-20140918-1

for you to fetch changes up to 9d64fab42274fb50a39bab184f79d0239596ba4a:

  vnc-tls: Clean up dead store in vnc_set_x509_credential() (2014-09-18 08:01:53 +0200)

----------------------------------------------------------------
vnc: set TCP_NODELAY, cleanup in tlc code

----------------------------------------------------------------
Markus Armbruster (1):
      vnc-tls: Clean up dead store in vnc_set_x509_credential()

Peter Lieven (1):
      ui/vnc: set TCP_NODELAY

 ui/vnc-tls.c | 2 --
 ui/vnc.c     | 1 +
 2 files changed, 1 insertion(+), 2 deletions(-)

Re: [Qemu-devel] [PULL 0/2] vnc patch queue

[Peter Maydell]

On 17 September 2014 23:33, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> Two little vnc patches.
>
> please pull,
>   Gerd
>
> The following changes since commit e4d50d47a9eb15f42bdd561803a29a4d7c3eb8ec:
>
>   qemu-char: Rename register_char_driver_qapi() to register_char_driver() (2014-09-16 23:36:32 +0100)
>
> are available in the git repository at:
>
>   git://git.kraxel.org/qemu tags/pull-vnc-20140918-1
>
> for you to fetch changes up to 9d64fab42274fb50a39bab184f79d0239596ba4a:
>
>   vnc-tls: Clean up dead store in vnc_set_x509_credential() (2014-09-18 08:01:53 +0200)
>
> ----------------------------------------------------------------
> vnc: set TCP_NODELAY, cleanup in tlc code
>
> ----------------------------------------------------------------
> Markus Armbruster (1):
>       vnc-tls: Clean up dead store in vnc_set_x509_credential()
>
> Peter Lieven (1):
>       ui/vnc: set TCP_NODELAY
>
>  ui/vnc-tls.c | 2 --
>  ui/vnc.c     | 1 +
>  2 files changed, 1 insertion(+), 2 deletions(-)

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 0/2] vnc patch queue

[Gerd Hoffmann]

  Hi,

Carrying two bugfixes.

please pull,
  Gerd

The following changes since commit b3959efdbb2dc3d5959e3b0a8e188126930beca8:

  Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-2.1' into staging (2014-07-01 11:00:53 +0100)

are available in the git repository at:


  git://git.kraxel.org/qemu tags/pull-vnc-20140701-1

for you to fetch changes up to bea60dd7679364493a0d7f5b54316c767cf894ef:

  ui/vnc: fix potential memory corruption issues (2014-07-01 13:26:40 +0200)

----------------------------------------------------------------
vnc: two bugfixes (by Peter Lieven).

----------------------------------------------------------------
Peter Lieven (2):
      ui/vnc: limit client_cut_text msg payload size
      ui/vnc: fix potential memory corruption issues

 ui/vnc.c | 162 +++++++++++++++++++++++++++++++--------------------------------
 ui/vnc.h |  14 +++---
 2 files changed, 87 insertions(+), 89 deletions(-)

Re: [Qemu-devel] [PULL 0/2] vnc patch queue

[Peter Maydell]

On 1 July 2014 12:33, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> Carrying two bugfixes.
>
> please pull,
>   Gerd
>
> The following changes since commit b3959efdbb2dc3d5959e3b0a8e188126930beca8:
>
>   Merge remote-tracking branch 'remotes/afaerber/tags/qom-devices-for-2.1' into staging (2014-07-01 11:00:53 +0100)
>
> are available in the git repository at:
>
>
>   git://git.kraxel.org/qemu tags/pull-vnc-20140701-1
>
> for you to fetch changes up to bea60dd7679364493a0d7f5b54316c767cf894ef:
>
>   ui/vnc: fix potential memory corruption issues (2014-07-01 13:26:40 +0200)
>
> ----------------------------------------------------------------
> vnc: two bugfixes (by Peter Lieven).

Applied, thanks

-- PMM