aboutsummaryrefslogtreecommitdiffstats
path: root/main/spice/CVE-2016-9577.patch
diff options
context:
space:
mode:
Diffstat (limited to 'main/spice/CVE-2016-9577.patch')
-rw-r--r--main/spice/CVE-2016-9577.patch28
1 files changed, 0 insertions, 28 deletions
diff --git a/main/spice/CVE-2016-9577.patch b/main/spice/CVE-2016-9577.patch
deleted file mode 100644
index 0d0a9ae4b1..0000000000
--- a/main/spice/CVE-2016-9577.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 5f96b596353d73bdf4bb3cd2de61e48a7fd5b4c3 Mon Sep 17 00:00:00 2001
-From: Frediano Ziglio <fziglio@redhat.com>
-Date: Tue, 29 Nov 2016 16:46:56 +0000
-Subject: [PATCH] main-channel: Prevent overflow reading messages from client
-
-Caller is supposed the function return a buffer able to store
-size bytes.
-
-Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
-Acked-by: Christophe Fergeau <cfergeau@redhat.com>
----
- server/main_channel.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/server/main_channel.c b/server/main_channel.c
-index 0ecc9df8..1fc39155 100644
---- a/server/main_channel.c
-+++ b/server/main_channel.c
-@@ -1026,6 +1026,9 @@ static uint8_t *main_channel_alloc_msg_rcv_buf(RedChannelClient *rcc,
-
- if (type == SPICE_MSGC_MAIN_AGENT_DATA) {
- return reds_get_agent_data_buffer(mcc, size);
-+ } else if (size > sizeof(main_chan->recv_buf)) {
-+ /* message too large, caller will log a message and close the connection */
-+ return NULL;
- } else {
- return main_chan->recv_buf;
- }