haraldwolff
/
qemu-patch-raspberry4
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ui/vnc: Fix problem with sending too many bytes as server name 

If the buffer is not big enough, snprintf() does not return the number
of bytes that have been written to the buffer, but the number of bytes
that would be needed for writing the whole string. By using this value
for the following vnc_write() calls, we send some junk at the end of
the name in case the qemu_name is longer than 1017 bytes, which could
confuse the VNC clients. Fix this by adding an additional size check
here.

Buglink: https://bugs.launchpad.net/qemu/+bug/1637447
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 1479749115-21932-1-git-send-email-thuth@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
stable-2.9
Thomas Huth 2016-11-21 18:25:15 +01:00 committed by Gerd Hoffmann
parent c952b71582
commit 97efe4f961
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ui/vnc.c
View File

@ -2459,10 +2459,14 @@ static int protocol_client_init(VncState *vs, uint8_t *data, size_t len)
pixel_format_message(vs);
if (qemu_name)
if (qemu_name) {
size = snprintf(buf, sizeof(buf), "QEMU (%s)", qemu_name);
else
if (size > sizeof(buf)) {
size = sizeof(buf);
}
} else {
size = snprintf(buf, sizeof(buf), "QEMU");
}
vnc_write_u32(vs, size);
vnc_write(vs, buf, size);