The VNC server websockets decoder will read and buffer data from websockets clients until it sees the end of the HTTP headers, as indicated by \r\n\r\n. In theory this allows a malicious to trick QEMU into consuming an arbitrary amount of RAM. In practice, because QEMU runs g_strstr_len() across the buffered header data, it will spend increasingly long burning CPU time searching for the substring match and less & less time reading data. So while this does cause arbitrary memory growth, the bigger problem is that QEMU will be burning 100% of available CPU time. A novnc websockets client typically sends headers of around 512 bytes in length. As such it is reasonable to place a 4096 byte limit on the amount of data buffered while searching for the end of HTTP headers. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> |
||
---|---|---|
.. | ||
cocoa.m | ||
console.c | ||
curses.c | ||
curses_keys.h | ||
cursor.c | ||
cursor_hidden.xpm | ||
cursor_left_ptr.xpm | ||
d3des.c | ||
d3des.h | ||
gtk.c | ||
input-keymap.c | ||
input-legacy.c | ||
input.c | ||
keymaps.c | ||
keymaps.h | ||
Makefile.objs | ||
qemu-pixman.c | ||
qemu-x509.h | ||
sdl.c | ||
sdl2-2d.c | ||
sdl2-input.c | ||
sdl2-keymap.h | ||
sdl2.c | ||
sdl_keysym.h | ||
sdl_zoom.c | ||
sdl_zoom.h | ||
sdl_zoom_template.h | ||
spice-core.c | ||
spice-display.c | ||
spice-input.c | ||
vgafont.h | ||
vnc-auth-sasl.c | ||
vnc-auth-sasl.h | ||
vnc-auth-vencrypt.c | ||
vnc-auth-vencrypt.h | ||
vnc-enc-hextile-template.h | ||
vnc-enc-hextile.c | ||
vnc-enc-tight.c | ||
vnc-enc-tight.h | ||
vnc-enc-zlib.c | ||
vnc-enc-zrle-template.c | ||
vnc-enc-zrle.c | ||
vnc-enc-zrle.h | ||
vnc-enc-zywrle-template.c | ||
vnc-enc-zywrle.h | ||
vnc-jobs.c | ||
vnc-jobs.h | ||
vnc-palette.c | ||
vnc-palette.h | ||
vnc-tls.c | ||
vnc-tls.h | ||
vnc-ws.c | ||
vnc-ws.h | ||
vnc.c | ||
vnc.h | ||
vnc_keysym.h | ||
x_keymap.c | ||
x_keymap.h |