[pve-devel] applied: [PATCH libspice-server 1/2] fix CVE-2016-9577 and CVE-2016-9578

[Fabian Grünbichler]

Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
---
 .../patches/CVE-2016-9577-and-CVE-2016-9578.patch  | 54 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 2 files changed, 55 insertions(+)
 create mode 100644 debian/patches/CVE-2016-9577-and-CVE-2016-9578.patch

diff --git a/debian/patches/CVE-2016-9577-and-CVE-2016-9578.patch b/debian/patches/CVE-2016-9577-and-CVE-2016-9578.patch
new file mode 100644
index 0000000..343e67a
--- /dev/null
+++ b/debian/patches/CVE-2016-9577-and-CVE-2016-9578.patch
@@ -0,0 +1,54 @@
+From: Markus Koschany <apo at debian.org>
+Date: Mon, 13 Feb 2017 21:38:02 +0100
+Subject: CVE-2016-9577 and CVE-2016-9578
+
+Bug-Debian: https://bugs.debian.org/854336
+Origin: http://pkgs.fedoraproject.org/cgit/rpms/spice.git/commit/?id=d919d639ae5f83a9735a04d843eed675f9357c0d
+---
+ server/main_channel.c |  3 +++
+ server/reds.c         | 11 ++++++++++-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/server/main_channel.c b/server/main_channel.c
+index 0ecc9df..1fc3915 100644
+--- a/server/main_channel.c
++++ b/server/main_channel.c
+@@ -1026,6 +1026,9 @@ static uint8_t *main_channel_alloc_msg_rcv_buf(RedChannelClient *rcc,
+ 
+     if (type == SPICE_MSGC_MAIN_AGENT_DATA) {
+         return reds_get_agent_data_buffer(mcc, size);
++    } else if (size > sizeof(main_chan->recv_buf)) {
++        /* message too large, caller will log a message and close the connection */
++        return NULL;
+     } else {
+         return main_chan->recv_buf;
+     }
+diff --git a/server/reds.c b/server/reds.c
+index 61bf735..4c60f58 100644
+--- a/server/reds.c
++++ b/server/reds.c
+@@ -2110,6 +2110,14 @@ static void reds_handle_read_link_done(void *opaque)
+     link_mess->num_channel_caps = GUINT32_FROM_LE(link_mess->num_channel_caps);
+     link_mess->num_common_caps = GUINT32_FROM_LE(link_mess->num_common_caps);
+ 
++    /* Prevent DoS. Currently we defined only 13 capabilities,
++     * I expect 1024 to be valid for quite a lot time */
++    if (link_mess->num_channel_caps > 1024 || link_mess->num_common_caps > 1024) {
++        reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
++        reds_link_free(link);
++        return;
++    }
++
+     num_caps = link_mess->num_common_caps + link_mess->num_channel_caps;
+     caps = (uint32_t *)((uint8_t *)link_mess + link_mess->caps_offset);
+ 
+@@ -2202,7 +2210,8 @@ static void reds_handle_read_header_done(void *opaque)
+ 
+     reds->peer_minor_version = header->minor_version;
+ 
+-    if (header->size < sizeof(SpiceLinkMess)) {
++    /* the check for 4096 is to avoid clients to cause arbitrary big memory allocations */
++    if (header->size < sizeof(SpiceLinkMess) || header->size > 4096) {
+         reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
+         spice_warning("bad size %u", header->size);
+         reds_link_free(link);
diff --git a/debian/patches/series b/debian/patches/series
index 247f05d..27122e5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,2 @@
 allow-to-set-sasl-callbacks.patch
+CVE-2016-9577-and-CVE-2016-9578.patch
-- 
2.1.4