Stefan Dirsch
d26ec6dbd4
0001-Make-ZlibInStream-more-robust-against-failures.patch
0002-Encapsulate-PixelBuffer-internal-details.patch
0003-Restrict-PixelBuffer-dimensions-to-safe-values.patch
0004-Add-write-protection-to-OffsetPixelBuffer.patch
0005-Handle-empty-Tight-gradient-rects.patch
0006-Add-unit-test-for-PixelFormat-sanity-checks.patch
0007-Fix-depth-sanity-test-in-PixelFormat.patch
0008-Add-sanity-checks-for-PixelFormat-shift-values.patch
0009-Remove-unused-FixedMemOutStream.patch
0010-Use-size_t-for-lengths-in-stream-objects.patch
0011-Be-defensive-about-overflows-in-stream-objects.patch
0012-Add-unit-tests-for-PixelFormat.is888-detection.patch
0013-Handle-pixel-formats-with-odd-shift-values.patch
* stack use-after-return due to incorrect usage of stack memory
in ZRLEDecoder (CVE-2019-15691, bsc#1159856)
* improper value checks in CopyRectDecode may lead to heap
buffer overflow (CVE-2019-15692, bsc#1160250)
* heap buffer overflow in TightDecoder::FilterGradient
(CVE-2019-15693, bsc#1159858)
* improper error handling in processing MemOutStream may lead
to heap buffer overflow (CVE-2019-15694, bsc#1160251
* stack buffer overflow, which could be triggered from
CMsgReader::readSetCurso (CVE-2019-15695, bsc#1159860)
OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/tigervnc?expand=0&rev=168
54 lines
1.6 KiB
Diff
54 lines
1.6 KiB
Diff
From 05e28490873a861379c943bf616614b78b558b89 Mon Sep 17 00:00:00 2001
|
|
From: Pierre Ossman <ossman@cendio.se>
|
|
Date: Wed, 2 Oct 2019 16:06:08 +0200
|
|
Subject: [PATCH] Handle pixel formats with odd shift values
|
|
|
|
Our fast paths assume that each channel fits in to a separate byte.
|
|
That means the shift needs to be a multiple of 8. Start actually
|
|
checking this so that a client cannot trip us up and possibly cause
|
|
incorrect code exection.
|
|
|
|
Issue found by Pavel Cheremushkin from Kaspersky Lab.
|
|
---
|
|
common/rfb/PixelFormat.cxx | 6 ++++++
|
|
tests/unit/pixelformat.cxx | 6 ++++++
|
|
2 files changed, 12 insertions(+)
|
|
|
|
diff --git a/common/rfb/PixelFormat.cxx b/common/rfb/PixelFormat.cxx
|
|
index 789c43ed..1b4ab1ba 100644
|
|
--- a/common/rfb/PixelFormat.cxx
|
|
+++ b/common/rfb/PixelFormat.cxx
|
|
@@ -206,6 +206,12 @@ bool PixelFormat::is888(void) const
|
|
return false;
|
|
if (blueMax != 255)
|
|
return false;
|
|
+ if ((redShift & 0x7) != 0)
|
|
+ return false;
|
|
+ if ((greenShift & 0x7) != 0)
|
|
+ return false;
|
|
+ if ((blueShift & 0x7) != 0)
|
|
+ return false;
|
|
|
|
return true;
|
|
}
|
|
diff --git a/tests/unit/pixelformat.cxx b/tests/unit/pixelformat.cxx
|
|
index cfae2f9d..2e0c0bbb 100644
|
|
--- a/tests/unit/pixelformat.cxx
|
|
+++ b/tests/unit/pixelformat.cxx
|
|
@@ -170,6 +170,12 @@ void is888Tests()
|
|
|
|
do888Test(false, 8, 8, false, false, 0, 0, 0, 0, 0, 0);
|
|
|
|
+ /* Odd shifts */
|
|
+
|
|
+ do888Test(false, 32, 24, false, true, 255, 255, 255, 0, 8, 18);
|
|
+ do888Test(false, 32, 24, false, true, 255, 255, 255, 0, 11, 24);
|
|
+ do888Test(false, 32, 24, false, true, 255, 255, 255, 4, 16, 24);
|
|
+
|
|
printf("\n");
|
|
}
|
|
|
|
--
|
|
2.16.4
|
|
|