From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50504) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YzT3J-0004B1-Ky for qemu-devel@nongnu.org; Mon, 01 Jun 2015 12:59:07 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YzT3F-0001PG-LE for qemu-devel@nongnu.org; Mon, 01 Jun 2015 12:59:05 -0400 Received: from mx1.redhat.com ([209.132.183.28]:40425) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YzT3F-0001OZ-Fa for qemu-devel@nongnu.org; Mon, 01 Jun 2015 12:59:01 -0400 Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) by mx1.redhat.com (Postfix) with ESMTPS id 10FF72EBD12 for ; Mon, 1 Jun 2015 16:59:01 +0000 (UTC) Date: Mon, 1 Jun 2015 17:58:56 +0100 From: "Daniel P. Berrange" Message-ID: <20150601165856.GF17374@redhat.com> References: <1432205817-16414-1-git-send-email-berrange@redhat.com> <1432205817-16414-11-git-send-email-berrange@redhat.com> <555DD4B7.5040904@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <555DD4B7.5040904@redhat.com> Subject: Re: [Qemu-devel] [PATCH 10/10] ui: convert VNC to use generic cipher API Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eric Blake Cc: Kevin Wolf , Paolo Bonzini , qemu-devel@nongnu.org, Gerd Hoffmann On Thu, May 21, 2015 at 06:51:03AM -0600, Eric Blake wrote: > On 05/21/2015 04:56 AM, Daniel P. Berrange wrote: > > Switch the VNC server over to use the generic cipher API, this > > allows it to use the pluggable DES implementations, instead of > > being hardcoded to use QEMU's built-in impl. > > > > Signed-off-by: Daniel P. Berrange > > --- > > ui/vnc.c | 52 +++++++++++++++++++++++++++++++++++++++++----------- > > 1 file changed, 41 insertions(+), 11 deletions(-) > > > > > @@ -2515,9 +2515,11 @@ static void make_challenge(VncState *vs) > > static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len) > > { > > unsigned char response[VNC_AUTH_CHALLENGE_SIZE]; > > - int i, j, pwlen; > > + size_t i, pwlen; > > unsigned char key[8]; > > time_t now = time(NULL); > > + QCryptoCipher *cipher; > > + Error *err; > > Leaving this uninitialized... > > > > > if (!vs->vd->password) { > > VNC_DEBUG("No password configured on server"); > > @@ -2534,9 +2536,29 @@ static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len) > > pwlen = strlen(vs->vd->password); > > for (i=0; i > key[i] = ivd->password[i] : 0; > > - deskey(key, EN0); > > - for (j = 0; j < VNC_AUTH_CHALLENGE_SIZE; j += 8) > > - des(response+j, response+j); > > + > > + cipher = qcrypto_cipher_new( > > + QCRYPTO_CIPHER_ALG_DES_RFB, > > + QCRYPTO_CIPHER_MODE_ECB, > > + key, G_N_ELEMENTS(key), > > + &err); > > means that gcrypto_cipher_new may assert if it tries to set an error but > dereferences bogus memory. Local errors must always start life at NULL. Opps, yes, missed that. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|