From 6934f036240753a14514a71ede8bb44af2043f24 Mon Sep 17 00:00:00 2001 From: Frediano Ziglio Date: Mon, 15 May 2017 15:57:28 +0100 Subject: [PATCH 2/3] reds: Avoid integer overflows handling monitor configuration Avoid VDAgentMessage::size integer overflows. Signed-off-by: Frediano Ziglio Upstream-Status: Backport [https://cgit.freedesktop.org/spice/spice/commit/?h=0.12&id=ec6229c79abe05d731953df5f7e9a05ec9f6df79] CVE: CVE-2017-7506 Signed-off-by: Yi Zhao --- server/reds.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/server/reds.c b/server/reds.c index 701d5d8..62b1164 100644 --- a/server/reds.c +++ b/server/reds.c @@ -1117,6 +1117,9 @@ static void reds_on_main_agent_monitors_config( spice_debug("not enough data yet. %d\n", cmc->buffer_size); return; } + if (msg_header->size < sizeof(VDAgentMonitorsConfig)) { + goto overflow; + } monitors_config = (VDAgentMonitorsConfig *)(cmc->buffer + sizeof(*msg_header)); spice_debug("%s: %d\n", __func__, monitors_config->num_of_monitors); red_dispatcher_client_monitors_config(monitors_config); -- 2.7.4