[pve-devel] [PATCH/stable-3 kvm] added fix for CVE-2015-8504

[Wolfgang Bumiller]

---
 ...001-ui-vnc-avoid-floating-point-exception.patch | 44 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 2 files changed, 45 insertions(+)
 create mode 100644 debian/patches/0001-ui-vnc-avoid-floating-point-exception.patch

diff --git a/debian/patches/0001-ui-vnc-avoid-floating-point-exception.patch b/debian/patches/0001-ui-vnc-avoid-floating-point-exception.patch
new file mode 100644
index 0000000..f8adea7
--- /dev/null
+++ b/debian/patches/0001-ui-vnc-avoid-floating-point-exception.patch
@@ -0,0 +1,44 @@
+From 4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3 Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp at fedoraproject.org>
+Date: Thu, 3 Dec 2015 18:54:17 +0530
+Subject: [PATCH] ui: vnc: avoid floating point exception
+
+While sending 'SetPixelFormat' messages to a VNC server,
+the client could set the 'red-max', 'green-max' and 'blue-max'
+values to be zero. This leads to a floating point exception in
+write_png_palette while doing frame buffer updates.
+
+Reported-by: Lian Yihan <lianyihan at 360.cn>
+Signed-off-by: Prasad J Pandit <pjp at fedoraproject.org>
+Reviewed-by: Gerd Hoffmann <kraxel at redhat.com>
+Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
+---
+ ui/vnc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/ui/vnc.c b/ui/vnc.c
+index 7538405..cbe4d33 100644
+--- a/ui/vnc.c
++++ b/ui/vnc.c
+@@ -2198,15 +2198,15 @@ static void set_pixel_format(VncState *vs,
+         return;
+     }
+ 
+-    vs->client_pf.rmax = red_max;
++    vs->client_pf.rmax = red_max ? red_max : 0xFF;
+     vs->client_pf.rbits = hweight_long(red_max);
+     vs->client_pf.rshift = red_shift;
+     vs->client_pf.rmask = red_max << red_shift;
+-    vs->client_pf.gmax = green_max;
++    vs->client_pf.gmax = green_max ? green_max : 0xFF;
+     vs->client_pf.gbits = hweight_long(green_max);
+     vs->client_pf.gshift = green_shift;
+     vs->client_pf.gmask = green_max << green_shift;
+-    vs->client_pf.bmax = blue_max;
++    vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
+     vs->client_pf.bbits = hweight_long(blue_max);
+     vs->client_pf.bshift = blue_shift;
+     vs->client_pf.bmask = blue_max << blue_shift;
+-- 
+2.1.4
+
diff --git a/debian/patches/series b/debian/patches/series
index c266de3..5ee8bb8 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -41,3 +41,4 @@ virtio-scsi_fix_assert.patch
 net-add-checks-to-validate-ring-buffer-pointers.patch
 CVE-2015-1779-incrementally-decode-websocket-frames.patch
 CVE-2015-1779-limit-size-of-HTTP-headers-from-websockets-clients.patch
+0001-ui-vnc-avoid-floating-point-exception.patch
-- 
2.1.4