From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52452) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cOjdN-0001lr-4h for qemu-devel@nongnu.org; Wed, 04 Jan 2017 06:21:34 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cOjdJ-0001tz-M0 for qemu-devel@nongnu.org; Wed, 04 Jan 2017 06:21:33 -0500 Received: from mx1.redhat.com ([209.132.183.28]:57708) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cOjdJ-0001t8-Fh for qemu-devel@nongnu.org; Wed, 04 Jan 2017 06:21:29 -0500 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id A5F0780F8D for ; Wed, 4 Jan 2017 11:21:29 +0000 (UTC) From: Gerd Hoffmann Date: Wed, 4 Jan 2017 12:21:22 +0100 Message-Id: <1483528883-1753-11-git-send-email-kraxel@redhat.com> In-Reply-To: <1483528883-1753-1-git-send-email-kraxel@redhat.com> References: <1483528883-1753-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PULL 10/11] ui/vnc: Fix problem with sending too many bytes as server name List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Thomas Huth , Gerd Hoffmann From: Thomas Huth If the buffer is not big enough, snprintf() does not return the number of bytes that have been written to the buffer, but the number of bytes that would be needed for writing the whole string. By using this value for the following vnc_write() calls, we send some junk at the end of the name in case the qemu_name is longer than 1017 bytes, which could confuse the VNC clients. Fix this by adding an additional size check here. Buglink: https://bugs.launchpad.net/qemu/+bug/1637447 Signed-off-by: Thomas Huth Reviewed-by: Eric Blake Message-id: 1479749115-21932-1-git-send-email-thuth@redhat.com Signed-off-by: Gerd Hoffmann --- ui/vnc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index 2c28a59..29aa9c4 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2459,10 +2459,14 @@ static int protocol_client_init(VncState *vs, uint8_t *data, size_t len) pixel_format_message(vs); - if (qemu_name) + if (qemu_name) { size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name); - else + if (size > sizeof(buf)) { + size = sizeof(buf); + } + } else { size = snprintf(buf, sizeof(buf), "QEMU"); + } vnc_write_u32(vs, size); vnc_write(vs, buf, size); -- 1.8.3.1