From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 59B839C6ED for ; Wed, 22 Nov 2023 13:36:09 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 3C23217FD8 for ; Wed, 22 Nov 2023 13:36:09 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Wed, 22 Nov 2023 13:36:07 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 8FE8B42194 for ; Wed, 22 Nov 2023 13:36:07 +0100 (CET) From: Fiona Ebner To: pve-devel@lists.proxmox.com Date: Wed, 22 Nov 2023 13:36:00 +0100 Message-Id: <20231122123600.64440-1-f.ebner@proxmox.com> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.078 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pve-devel] [PATCH qemu] add fix for vnc clipboard X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Nov 2023 12:36:09 -0000 This fixes the host->guest direction with noNVC as a client (and likely others). Signed-off-by: Fiona Ebner --- ...-ui-vnc-clipboard-fix-inflate_buffer.patch | 33 +++++++++++++++++++ debian/patches/series | 1 + 2 files changed, 34 insertions(+) create mode 100644 debian/patches/extra/0010-ui-vnc-clipboard-fix-inflate_buffer.patch diff --git a/debian/patches/extra/0010-ui-vnc-clipboard-fix-inflate_buffer.patch b/debian/patches/extra/0010-ui-vnc-clipboard-fix-inflate_buffer.patch new file mode 100644 index 0000000..1a361d5 --- /dev/null +++ b/debian/patches/extra/0010-ui-vnc-clipboard-fix-inflate_buffer.patch @@ -0,0 +1,33 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Fiona Ebner +Date: Wed, 22 Nov 2023 13:17:25 +0100 +Subject: [PATCH] ui/vnc-clipboard: fix inflate_buffer + +Commit d921fea338 ("ui/vnc-clipboard: fix infinite loop in +inflate_buffer (CVE-2023-3255)") removed this hunk, but it is still +required, because it can happen that stream.avail_in becomes zero +before coming across a return value of Z_STREAM_END. + +This fixes the host->guest direction with noNVC. + +Signed-off-by: Fiona Ebner +--- + ui/vnc-clipboard.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/ui/vnc-clipboard.c b/ui/vnc-clipboard.c +index c759be3438..124b6fbd9c 100644 +--- a/ui/vnc-clipboard.c ++++ b/ui/vnc-clipboard.c +@@ -69,6 +69,11 @@ static uint8_t *inflate_buffer(uint8_t *in, uint32_t in_len, uint32_t *size) + } + } + ++ *size = stream.total_out; ++ inflateEnd(&stream); ++ ++ return out; ++ + err_end: + inflateEnd(&stream); + err: diff --git a/debian/patches/series b/debian/patches/series index 992299c..9938b8e 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -7,6 +7,7 @@ extra/0006-Revert-Revert-graph-lock-Disable-locking-for-now.patch extra/0007-migration-states-workaround-snapshot-performance-reg.patch extra/0008-Revert-x86-acpi-workaround-Windows-not-handling-name.patch extra/0009-hw-ide-ahci-fix-legacy-software-reset.patch +extra/0010-ui-vnc-clipboard-fix-inflate_buffer.patch bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch -- 2.39.2