main/spice: security fixes (CVE-2016-9577, CVE-2016-9578)

4 files changed, 135 insertions, 5 deletions

diff --git a/main/spice/APKBUILD b/main/spice/APKBUILD
index 4d05087f3d..6bc85302b6 100644
--- a/main/spice/APKBUILD
+++ b/main/spice/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=spice
 pkgver=0.12.8
-pkgrel=2
+pkgrel=3
 pkgdesc="Implements the SPICE protocol"
 url="http://www.spice-space.org/"
 arch="all"
@@ -15,9 +15,17 @@ makedepends="$depends_dev alsa-lib-dev libjpeg-turbo-dev libxrandr-dev
 install=""
 subpackages="$pkgname-dev $pkgname-server"
 source="http://www.spice-space.org/download/releases/$pkgname-$pkgver.tar.bz2
+	CVE-2016-9577.patch
+	CVE-2016-9578-1.patch
+	CVE-2016-9578-2.patch
 	"
-
 builddir="$srcdir"/$pkgname-$pkgver
+
+# secfixes:
+#   0.12.8-r3:
+#     - CVE-2016-9577
+#     - CVE-2016-9578
+
 build() {
 	cd "$builddir"
 	./configure \
@@ -48,6 +56,7 @@ server() {
 	mv "$pkgdir"/usr/lib/*server.so.* "$subpkgdir"/usr/lib/
 }
 
-md5sums="376853d11b9921aa34a06c4dbef81874  spice-0.12.8.tar.bz2"
-sha256sums="f901a5c5873d61acac84642f9eea5c4d6386fc3e525c2b68792322794e1c407d  spice-0.12.8.tar.bz2"
-sha512sums="6485d3522af1cde93d2c0abad7f7ef9f2e4d3e5049314fb93b6dd4b86e33d67d353a3ff42a355c8fd991bad447bbde1e6320c083bbc6f02b576bd9cebe7269ed  spice-0.12.8.tar.bz2"
+sha512sums="6485d3522af1cde93d2c0abad7f7ef9f2e4d3e5049314fb93b6dd4b86e33d67d353a3ff42a355c8fd991bad447bbde1e6320c083bbc6f02b576bd9cebe7269ed  spice-0.12.8.tar.bz2
+51c38766c9582376c95e63515d0c009f8c3e95cc03a1751c01974cab9295159eb74d35a08157e1eaa44e99a7bb5b2fdad83d9a8c7e38850741d9b5d534133bc7  CVE-2016-9577.patch
+ffae544784bd98da10cd86db3f5c5753c4833aee6b16e4e671160e92103d84a3dbc4da9f132f35e3b3b71a515e09b68b689c49e5f4265363b9eef39c42d70719  CVE-2016-9578-1.patch
+62ba3844fa11c65eba7d013c209962e39af051885bdf55943410f9122d99135ce30495263f34580ce959355eb60a6026125b181f6b10f0bfab19bbd4ff54f92b  CVE-2016-9578-2.patch"
diff --git a/main/spice/CVE-2016-9577.patch b/main/spice/CVE-2016-9577.patch
new file mode 100644
index 0000000000..0d0a9ae4b1
--- /dev/null
+++ b/main/spice/CVE-2016-9577.patch
@@ -0,0 +1,28 @@
+From 5f96b596353d73bdf4bb3cd2de61e48a7fd5b4c3 Mon Sep 17 00:00:00 2001
+From: Frediano Ziglio <fziglio@redhat.com>
+Date: Tue, 29 Nov 2016 16:46:56 +0000
+Subject: [PATCH] main-channel: Prevent overflow reading messages from client
+
+Caller is supposed the function return a buffer able to store
+size bytes.
+
+Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
+Acked-by: Christophe Fergeau <cfergeau@redhat.com>
+---
+ server/main_channel.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/server/main_channel.c b/server/main_channel.c
+index 0ecc9df8..1fc39155 100644
+--- a/server/main_channel.c
++++ b/server/main_channel.c
+@@ -1026,6 +1026,9 @@ static uint8_t *main_channel_alloc_msg_rcv_buf(RedChannelClient *rcc,
+ 
+     if (type == SPICE_MSGC_MAIN_AGENT_DATA) {
+         return reds_get_agent_data_buffer(mcc, size);
++    } else if (size > sizeof(main_chan->recv_buf)) {
++        /* message too large, caller will log a message and close the connection */
++        return NULL;
+     } else {
+         return main_chan->recv_buf;
+     }
diff --git a/main/spice/CVE-2016-9578-1.patch b/main/spice/CVE-2016-9578-1.patch
new file mode 100644
index 0000000000..bc289a4243
--- /dev/null
+++ b/main/spice/CVE-2016-9578-1.patch
@@ -0,0 +1,55 @@
+From 1c6517973095a67c8cb57f3550fc1298404ab556 Mon Sep 17 00:00:00 2001
+From: Frediano Ziglio <fziglio@redhat.com>
+Date: Tue, 13 Dec 2016 14:39:48 +0000
+Subject: [PATCH] Prevent possible DoS attempts during protocol handshake
+
+The limit for link message is specified using a 32 bit unsigned integer.
+This could cause possible DoS due to excessive memory allocations and
+some possible crashes.
+For instance a value >= 2^31 causes a spice_assert to be triggered in
+async_read_handler (reds-stream.c) due to an integer overflow at this
+line:
+
+   int n = async->end - async->now;
+
+This could be easily triggered with a program like
+
+  #!/usr/bin/env python
+
+  import socket
+  import time
+  from struct import pack
+
+  server = '127.0.0.1'
+  port = 5900
+
+  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+  s.connect((server, port))
+  data = pack('<4sIII', 'REDQ', 2, 2, 0xaaaaaaaa)
+  s.send(data)
+
+  time.sleep(1)
+
+without requiring any authentication (the same can be done
+with TLS).
+
+Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
+Acked-by: Christophe Fergeau <cfergeau@redhat.com>
+---
+ server/reds.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/server/reds.c b/server/reds.c
+index f40b65c1..86a33d53 100644
+--- a/server/reds.c
++++ b/server/reds.c
+@@ -2202,7 +2202,8 @@ static void reds_handle_read_header_done(void *opaque)
+ 
+     reds->peer_minor_version = header->minor_version;
+ 
+-    if (header->size < sizeof(SpiceLinkMess)) {
++    /* the check for 4096 is to avoid clients to cause arbitrary big memory allocations */
++    if (header->size < sizeof(SpiceLinkMess) || header->size > 4096) {
+         reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
+         spice_warning("bad size %u", header->size);
+         reds_link_free(link);
diff --git a/main/spice/CVE-2016-9578-2.patch b/main/spice/CVE-2016-9578-2.patch
new file mode 100644
index 0000000000..78fb1eb811
--- /dev/null
+++ b/main/spice/CVE-2016-9578-2.patch
@@ -0,0 +1,38 @@
+From f66dc643635518e53dfbe5262f814a64eec54e4a Mon Sep 17 00:00:00 2001
+From: Frediano Ziglio <fziglio@redhat.com>
+Date: Tue, 13 Dec 2016 14:40:10 +0000
+Subject: [PATCH] Prevent integer overflows in capability checks
+
+The limits for capabilities are specified using 32 bit unsigned integers.
+This could cause possible integer overflows causing buffer overflows.
+For instance the sum of num_common_caps and num_caps can be 0 avoiding
+additional checks.
+As the link message is now capped to 4096 and the capabilities are
+contained in the link message limit the capabilities to 1024
+(capabilities are expressed in number of uint32_t items).
+
+Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
+Acked-by: Christophe Fergeau <cfergeau@redhat.com>
+---
+ server/reds.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/server/reds.c b/server/reds.c
+index 86a33d53..91504544 100644
+--- a/server/reds.c
++++ b/server/reds.c
+@@ -2110,6 +2110,14 @@ static void reds_handle_read_link_done(void *opaque)
+     link_mess->num_channel_caps = GUINT32_FROM_LE(link_mess->num_channel_caps);
+     link_mess->num_common_caps = GUINT32_FROM_LE(link_mess->num_common_caps);
+ 
++    /* Prevent DoS. Currently we defined only 13 capabilities,
++     * I expect 1024 to be valid for quite a lot time */
++    if (link_mess->num_channel_caps > 1024 || link_mess->num_common_caps > 1024) {
++        reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
++        reds_link_free(link);
++        return;
++    }
++
+     num_caps = link_mess->num_common_caps + link_mess->num_channel_caps;
+     caps = (uint32_t *)((uint8_t *)link_mess + link_mess->caps_offset);
+