File 0003-Restrict-PixelBuffer-dimensions-to-safe-va... of Package tigervnc.20174

Overview Repositories Revisions Requests Users Attributes Meta

File 0003-Restrict-PixelBuffer-dimensions-to-safe-values.patch of Package tigervnc.20174

From 996356b6c65ca165ee1ea46a571c32a1dc3c3821 Mon Sep 17 00:00:00 2001
From: Pierre Ossman <ossman@cendio.se>
Date: Tue, 10 Sep 2019 15:21:03 +0200
Subject: [PATCH] Restrict PixelBuffer dimensions to safe values

We do a lot of calculations based on pixel coordinates and we need
to make sure they do not overflow. Restrict the maximum dimensions
we support rather than try to switch over all calculations to use
64 bit integers.

This prevents attackers from from injecting code by specifying a
huge framebuffer size and relying on the values overflowing to
access invalid areas of the heap.

This primarily affects the client which gets both the screen
dimensions and the pixel contents from the remote side. But the
server might also be affected as a client can adjust the screen
dimensions, as can applications inside the session.

Issue found by Pavel Cheremushkin from Kaspersky Lab.
---
 common/rfb/PixelBuffer.cxx | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

Index: tigervnc-1.6.0/common/rfb/PixelBuffer.cxx
===================================================================
--- tigervnc-1.6.0.orig/common/rfb/PixelBuffer.cxx
+++ tigervnc-1.6.0/common/rfb/PixelBuffer.cxx
@@ -31,6 +31,14 @@ using namespace rdr;
 
 static LogWriter vlog("PixelBuffer");
 
+// We do a lot of byte offset calculations that assume the result fits
+// inside a signed 32 bit integer. Limit the maximum size of pixel
+// buffers so that these calculations never overflow.
+
+const int maxPixelBufferWidth = 16384;
+const int maxPixelBufferHeight = 16384;
+const int maxPixelBufferStride = 16384;
+
 
 // -=- Generic pixel buffer class
 
@@ -452,6 +460,10 @@ ManagedPixelBuffer::setPF(const PixelFor
 };
 void
 ManagedPixelBuffer::setSize(int w, int h) {
+  if ((w < 0) || (w > maxPixelBufferWidth))
+    throw rfb::Exception("Invalid PixelBuffer width of %d pixels requested", w);
+  if ((h < 0) || (h > maxPixelBufferHeight))
+    throw rfb::Exception("Invalid PixelBuffer height of %d pixels requested", h);
   width_ = w; height_ = h; stride = w; checkDataSize();
 };

Places

File 0003-Restrict-PixelBuffer-dimensions-to-safe-values.patch of Package tigervnc.20174

Places