mir/pve-libspice-server
2
0
Fork 0
mirror of git://git.proxmox.com/git/pve-libspice-server.git synced 2025-08-31 16:09:49 +00:00
Code Issues Releases Wiki Activity

upgrade to 0.14.1

Browse Source 
drop applied upstream fixes, rebase patches, fix download path

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
This commit is contained in:
Dominik Csapak
2018-10-04 13:17:03 +02:00
committed by Thomas Lamprecht
parent 7b0e217ee0
commit 1636a5dee9
5 changed files with 8 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Makefile
View File

@@ -1,7 +1,7 @@
RELEASE=4.0
PACKAGE=pve-libspice-server1
PKGVERSION=0.12.8
PKGVERSION=0.14.1
PKGRELEASE=3
PKGDIR=spice-${PKGVERSION}
@@ -40,7 +40,7 @@ $(DEB): ${PKGSRC}
.PHONY: download
download:
rm -f ${PKGSRC}
wget http://spice-space.org/download/releases/spice-${PKGVERSION}.tar.bz2
wget http://spice-space.org/download/releases/spice-server/spice-${PKGVERSION}.tar.bz2
.PHONY: upload
upload: ${DEBS}

54
debian/patches/CVE-2016-9577-and-CVE-2016-9578.patch vendored
View File

@@ -1,54 +0,0 @@
From: Markus Koschany <apo@debian.org>
Date: Mon, 13 Feb 2017 21:38:02 +0100
Subject: CVE-2016-9577 and CVE-2016-9578
Bug-Debian: https://bugs.debian.org/854336
Origin: http://pkgs.fedoraproject.org/cgit/rpms/spice.git/commit/?id=d919d639ae5f83a9735a04d843eed675f9357c0d
---
server/main_channel.c | 3 +++
server/reds.c | 11 ++++++++++-
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/server/main_channel.c b/server/main_channel.c
index 0ecc9df..1fc3915 100644
--- a/server/main_channel.c
+++ b/server/main_channel.c
@@ -1026,6 +1026,9 @@ static uint8_t *main_channel_alloc_msg_rcv_buf(RedChannelClient *rcc,
if (type == SPICE_MSGC_MAIN_AGENT_DATA) {
return reds_get_agent_data_buffer(mcc, size);
+ } else if (size > sizeof(main_chan->recv_buf)) {
+ /* message too large, caller will log a message and close the connection */
+ return NULL;
} else {
return main_chan->recv_buf;
}
diff --git a/server/reds.c b/server/reds.c
index 61bf735..4c60f58 100644
--- a/server/reds.c
+++ b/server/reds.c
@@ -2110,6 +2110,14 @@ static void reds_handle_read_link_done(void *opaque)
link_mess->num_channel_caps = GUINT32_FROM_LE(link_mess->num_channel_caps);
link_mess->num_common_caps = GUINT32_FROM_LE(link_mess->num_common_caps);
+ /* Prevent DoS. Currently we defined only 13 capabilities,
+ * I expect 1024 to be valid for quite a lot time */
+ if (link_mess->num_channel_caps > 1024 || link_mess->num_common_caps > 1024) {
+ reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
+ reds_link_free(link);
+ return;
+ }
+
num_caps = link_mess->num_common_caps + link_mess->num_channel_caps;
caps = (uint32_t *)((uint8_t *)link_mess + link_mess->caps_offset);
@@ -2202,7 +2210,8 @@ static void reds_handle_read_header_done(void *opaque)
reds->peer_minor_version = header->minor_version;
- if (header->size < sizeof(SpiceLinkMess)) {
+ /* the check for 4096 is to avoid clients to cause arbitrary big memory allocations */
+ if (header->size < sizeof(SpiceLinkMess) || header->size > 4096) {
reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
spice_warning("bad size %u", header->size);
reds_link_free(link);

10
debian/patches/allow-to-set-sasl-callbacks.patch vendored
View File

@@ -22,10 +22,10 @@ Index: new/server/spice-server.h
int spice_server_set_ticket(SpiceServer *s, const char *passwd, int lifetime,
int fail_if_connected, int disconnect_if_connected);
int spice_server_set_tls(SpiceServer *s, int port,
Index: new/server/reds_stream.c
Index: new/server/red-stream.c
===================================================================
--- new.orig/server/reds_stream.c
+++ new/server/reds_stream.c
--- new.orig/server/red-stream.c
+++ new/server/red-stream.c
@@ -48,6 +48,18 @@ extern SpiceCoreInterface *core;
#if HAVE_SASL
#include <sasl/sasl.h>
@@ -42,10 +42,10 @@ Index: new/server/reds_stream.c
+#endif
+}
+
typedef struct RedsSASL {
typedef struct RedSASL {
sasl_conn_t *conn;
@@ -976,7 +988,7 @@ bool reds_sasl_start_auth(RedsStream *st
@@ -976,7 +988,7 @@ bool red_sasl_start_auth(RedsStream *st
NULL, /* User realm */
localAddr,
remoteAddr,

1
debian/patches/series vendored
View File

@@ -1,2 +1 @@
allow-to-set-sasl-callbacks.patch
CVE-2016-9577-and-CVE-2016-9578.patch

2
debian/rules vendored
View File

@@ -4,7 +4,7 @@
#export DH_VERBOSE=1
override_dh_auto_configure:
CELT051_CFLAGS="-I$(CURDIR)" CELT051_LIBS="-L$(CURDIR)/celt051/.libs -lcelt051 -lm" ./configure --prefix=/usr --with-sasl --disable-smartcard
CELT051_CFLAGS="-I$(CURDIR)" CELT051_LIBS="-L$(CURDIR)/celt051/.libs -lcelt051 -lm" ./configure --prefix=/usr --with-sasl --disable-smartcard --enable-celt051
%:
dh $@ -with quilt --with autotools-dev