From 64ffbe04eaafebf4045a3ace52a360c14959d196 Mon Sep 17 00:00:00 2001 From: Wolfgang Bumiller Date: Wed, 13 Jan 2016 09:09:58 +0100 Subject: hmp: fix sendkey out of bounds write (CVE-2015-8619) When processing 'sendkey' command, hmp_sendkey routine null terminates the 'keyname_buf' array. This results in an OOB write issue, if 'keyname_len' was to fall outside of 'keyname_buf' array. Since the keyname's length is known the keyname_buf can be removed altogether by adding a length parameter to index_from_key() and using it for the error output as well. Reported-by: Ling Liu Signed-off-by: Wolfgang Bumiller Message-Id: <20160113080958.GA18934@olga> [Comparison with "<" dumbed down, test for junk after strtoul() tweaked] Signed-off-by: Markus Armbruster --- include/ui/console.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include/ui') diff --git a/include/ui/console.h b/include/ui/console.h index adac36dd52..116bc2b2ad 100644 --- a/include/ui/console.h +++ b/include/ui/console.h @@ -448,7 +448,7 @@ static inline int vnc_display_pw_expire(const char *id, time_t expires) void curses_display_init(DisplayState *ds, int full_screen); /* input.c */ -int index_from_key(const char *key); +int index_from_key(const char *key, size_t key_length); /* gtk.c */ void early_gtk_display_init(int opengl); -- cgit v1.2.3-55-g7522