forked from pool/tigervnc
Stefan Dirsch
d26ec6dbd4
0001-Make-ZlibInStream-more-robust-against-failures.patch
0002-Encapsulate-PixelBuffer-internal-details.patch
0003-Restrict-PixelBuffer-dimensions-to-safe-values.patch
0004-Add-write-protection-to-OffsetPixelBuffer.patch
0005-Handle-empty-Tight-gradient-rects.patch
0006-Add-unit-test-for-PixelFormat-sanity-checks.patch
0007-Fix-depth-sanity-test-in-PixelFormat.patch
0008-Add-sanity-checks-for-PixelFormat-shift-values.patch
0009-Remove-unused-FixedMemOutStream.patch
0010-Use-size_t-for-lengths-in-stream-objects.patch
0011-Be-defensive-about-overflows-in-stream-objects.patch
0012-Add-unit-tests-for-PixelFormat.is888-detection.patch
0013-Handle-pixel-formats-with-odd-shift-values.patch
* stack use-after-return due to incorrect usage of stack memory
in ZRLEDecoder (CVE-2019-15691, bsc#1159856)
* improper value checks in CopyRectDecode may lead to heap
buffer overflow (CVE-2019-15692, bsc#1160250)
* heap buffer overflow in TightDecoder::FilterGradient
(CVE-2019-15693, bsc#1159858)
* improper error handling in processing MemOutStream may lead
to heap buffer overflow (CVE-2019-15694, bsc#1160251
* stack buffer overflow, which could be triggered from
CMsgReader::readSetCurso (CVE-2019-15695, bsc#1159860)
OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/tigervnc?expand=0&rev=168
55 lines
1.6 KiB
Diff
55 lines
1.6 KiB
Diff
From 9f615301aba1cc54a749950bf9462c5a85217bc4 Mon Sep 17 00:00:00 2001
|
|
From: Pierre Ossman <ossman@cendio.se>
|
|
Date: Tue, 10 Sep 2019 15:25:30 +0200
|
|
Subject: [PATCH] Add write protection to OffsetPixelBuffer
|
|
|
|
No one should every try to write to this buffer. Enforce that by
|
|
throwing an exception if any one tries to get a writeable pointer
|
|
to the data.
|
|
---
|
|
common/rfb/EncodeManager.cxx | 6 ++++++
|
|
common/rfb/EncodeManager.h | 3 +++
|
|
2 files changed, 9 insertions(+)
|
|
|
|
diff --git a/common/rfb/EncodeManager.cxx b/common/rfb/EncodeManager.cxx
|
|
index 54f7102b..92ac5676 100644
|
|
--- a/common/rfb/EncodeManager.cxx
|
|
+++ b/common/rfb/EncodeManager.cxx
|
|
@@ -28,6 +28,7 @@
|
|
#include <rfb/SMsgWriter.h>
|
|
#include <rfb/UpdateTracker.h>
|
|
#include <rfb/LogWriter.h>
|
|
+#include <rfb/Exception.h>
|
|
|
|
#include <rfb/RawEncoder.h>
|
|
#include <rfb/RREEncoder.h>
|
|
@@ -1053,6 +1054,11 @@ void EncodeManager::OffsetPixelBuffer::update(const PixelFormat& pf,
|
|
setBuffer(width, height, (rdr::U8*)data_, stride_);
|
|
}
|
|
|
|
+rdr::U8* EncodeManager::OffsetPixelBuffer::getBufferRW(const Rect& r, int* stride)
|
|
+{
|
|
+ throw rfb::Exception("Invalid write attempt to OffsetPixelBuffer");
|
|
+}
|
|
+
|
|
// Preprocessor generated, optimised methods
|
|
|
|
#define BPP 8
|
|
diff --git a/common/rfb/EncodeManager.h b/common/rfb/EncodeManager.h
|
|
index bdae9063..f8201c34 100644
|
|
--- a/common/rfb/EncodeManager.h
|
|
+++ b/common/rfb/EncodeManager.h
|
|
@@ -148,6 +148,9 @@ namespace rfb {
|
|
|
|
void update(const PixelFormat& pf, int width, int height,
|
|
const rdr::U8* data_, int stride);
|
|
+
|
|
+ private:
|
|
+ virtual rdr::U8* getBufferRW(const Rect& r, int* stride);
|
|
};
|
|
|
|
OffsetPixelBuffer offsetPixelBuffer;
|
|
--
|
|
2.16.4
|
|
|