646cd8897b
Updated block-dmmd script - fate#310510 - fix xenpaging restore changes to integrate paging into xm/xend xenpaging.autostart.patch xenpaging.doc.patch - bnc#787163 - VUL-0: CVE-2012-4544: xen: Domain builder Out-of- memory due to malicious kernel/ramdisk (XSA 25) CVE-2012-4544-xsa25.patch - bnc#779212 - VUL-0: CVE-2012-4411: XEN / qemu: guest administrator can access qemu monitor console (XSA-19) CVE-2012-4411-xsa19.patch - bnc#786516 - VUL-0: CVE-2012-4535: xen: Timer overflow DoS vulnerability CVE-2012-4535-xsa20.patch - bnc#786518 - VUL-0: CVE-2012-4536: xen: pirq range check DoS vulnerability CVE-2012-4536-xsa21.patch - bnc#786517 - VUL-0: CVE-2012-4537: xen: Memory mapping failure DoS vulnerability CVE-2012-4537-xsa22.patch - bnc#786519 - VUL-0: CVE-2012-4538: xen: Unhooking empty PAE entries DoS vulnerability CVE-2012-4538-xsa23.patch - bnc#786520 - VUL-0: CVE-2012-4539: xen: Grant table hypercall infinite loop DoS vulnerability CVE-2012-4539-xsa24.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=212
31 lines
1.1 KiB
Diff
31 lines
1.1 KiB
Diff
Index: xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
|
|
===================================================================
|
|
--- xen-4.2.0-testing.orig/tools/qemu-xen-traditional-dir-remote/vnc.c
|
|
+++ xen-4.2.0-testing/tools/qemu-xen-traditional-dir-remote/vnc.c
|
|
@@ -1751,6 +1751,25 @@ static int protocol_client_msg(VncState
|
|
}
|
|
|
|
set_encodings(vs, (int32_t *)(data + 4), limit);
|
|
+
|
|
+ /*
|
|
+ * The initialization of a VNC connection can race with xenfb changing
|
|
+ * the resolution. This happens when the VNC connection is already
|
|
+ * established, but the client has not yet advertised has_resize, so it
|
|
+ * won't get notified of the switch.
|
|
+ *
|
|
+ * Therefore we resend the resolution as soon as the client has sent its
|
|
+ * encodings.
|
|
+ */
|
|
+ if (vs->has_resize) {
|
|
+ /* Resize the VNC window */
|
|
+ vnc_write_u8(vs, 0); /* msg id */
|
|
+ vnc_write_u8(vs, 0);
|
|
+ vnc_write_u16(vs, 1); /* number of rects */
|
|
+ vnc_framebuffer_update(vs, 0, 0, vs->serverds.width, vs->serverds.height, -223);
|
|
+
|
|
+ vnc_flush(vs);
|
|
+ }
|
|
break;
|
|
case 3:
|
|
if (len == 1)
|