[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 46/52] ui/vnc-enc-hextile: Use static rather than dynamic length s
From: |
marcandre . lureau |
Subject: |
[PULL 46/52] ui/vnc-enc-hextile: Use static rather than dynamic length stack array |
Date: |
Mon, 4 Sep 2023 15:52:43 +0400 |
From: Peter Maydell <peter.maydell@linaro.org>
In the send_hextile_tile_* function we create a variable length array
data[]. In fact we know that the client_pf.bytes_per_pixel is at
most 4 (enforced by set_pixel_format()), so we can make the array a
compile-time fixed length of 1536 bytes.
The codebase has very few VLAs, and if we can get rid of them all we
can make the compiler error on new additions. This is a defensive
measure against security bugs where an on-stack dynamic allocation
isn't correctly size-checked (e.g. CVE-2021-3527).
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[ Marc-André - rename BPP to MAX_BYTES_PER_PIXEL ]
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20230818151057.1541189-3-peter.maydell@linaro.org>
---
ui/vnc-enc-hextile-template.h | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/ui/vnc-enc-hextile-template.h b/ui/vnc-enc-hextile-template.h
index 0c56262aff..8ee92086ac 100644
--- a/ui/vnc-enc-hextile-template.h
+++ b/ui/vnc-enc-hextile-template.h
@@ -7,6 +7,8 @@
#define NAME BPP
#endif
+#define MAX_BYTES_PER_PIXEL 4
+
static void CONCAT(send_hextile_tile_, NAME)(VncState *vs,
int x, int y, int w, int h,
void *last_bg_,
@@ -25,10 +27,13 @@ static void CONCAT(send_hextile_tile_, NAME)(VncState *vs,
int bg_count = 0;
int fg_count = 0;
int flags = 0;
- uint8_t data[(vs->client_pf.bytes_per_pixel + 2) * 16 * 16];
+ uint8_t data[(MAX_BYTES_PER_PIXEL + 2) * 16 * 16];
int n_data = 0;
int n_subtiles = 0;
+ /* Enforced by set_pixel_format() */
+ assert(vs->client_pf.bytes_per_pixel <= MAX_BYTES_PER_PIXEL);
+
for (j = 0; j < h; j++) {
for (i = 0; i < w; i++) {
switch (n_colors) {
@@ -205,6 +210,7 @@ static void CONCAT(send_hextile_tile_, NAME)(VncState *vs,
}
}
+#undef MAX_BYTES_PER_PIXEL
#undef NAME
#undef pixel_t
#undef CONCAT_I
--
2.41.0
- [PULL 34/52] ui/vc: use common text console surface creation, (continued)
- [PULL 34/52] ui/vc: use common text console surface creation, marcandre . lureau, 2023/09/04
- [PULL 36/52] ui/console: use QEMU_PIXMAN_COLOR helpers, marcandre . lureau, 2023/09/04
- [PULL 38/52] ui/console: assert(surface) where appropriate, marcandre . lureau, 2023/09/04
- [PULL 39/52] ui/console: fold text_console_update_cursor_timer, marcandre . lureau, 2023/09/04
- [PULL 40/52] ui/vc: skip text console resize when possible, marcandre . lureau, 2023/09/04
- [PULL 41/52] ui/console: minor stylistic changes, marcandre . lureau, 2023/09/04
- [PULL 43/52] ui/vc: do not parse VC-specific options in Spice and GTK, marcandre . lureau, 2023/09/04
- [PULL 42/52] ui/vc: move text console invalidate in helper, marcandre . lureau, 2023/09/04
- [PULL 44/52] ui/vc: change the argument for QemuTextConsole, marcandre . lureau, 2023/09/04
- [PULL 45/52] ui/spice-display: Avoid dynamic stack allocation, marcandre . lureau, 2023/09/04
- [PULL 46/52] ui/vnc-enc-hextile: Use static rather than dynamic length stack array,
marcandre . lureau <=
- [PULL 47/52] ui/vnc-enc-tight: Avoid dynamic stack allocation, marcandre . lureau, 2023/09/04
- [PULL 48/52] ui/dbus: Properly dispose touch/mouse dbus objects, marcandre . lureau, 2023/09/04
- [PULL 49/52] ui/dbus: implement damage regions for GL, marcandre . lureau, 2023/09/04
- [PULL 50/52] ui/vdagent: call vdagent_disconnect() when agent connection is lost, marcandre . lureau, 2023/09/04
- [PULL 51/52] ui/vdagent: Unregister input handler of mouse during finalization, marcandre . lureau, 2023/09/04
- [PULL 52/52] ui/gtk: fix leaks found wtih fuzzing, marcandre . lureau, 2023/09/04
- Re: [PULL 00/52] UI patches, Stefan Hajnoczi, 2023/09/06