]> git.ipfire.org Git - thirdparty/qemu.git/commit
ui/vnc-clipboard: fix inflate_buffer
authorFiona Ebner <f.ebner@proxmox.com>
Wed, 22 Nov 2023 12:58:26 +0000 (13:58 +0100)
committerMichael Tokarev <mjt@tls.msk.ru>
Wed, 13 Dec 2023 15:51:00 +0000 (18:51 +0300)
commit4b2648356f337c1828d03898d38a68c8c3776c88
tree91abb6693ab7b9ffcb67f2964fc832af4e913840
parent5133410f8b0ccd873833bebcedf75f2cc60582ba
ui/vnc-clipboard: fix inflate_buffer

Commit d921fea338 ("ui/vnc-clipboard: fix infinite loop in
inflate_buffer (CVE-2023-3255)") removed this hunk, but it is still
required, because it can happen that stream.avail_in becomes zero
before coming across a return value of Z_STREAM_END in the loop.

This fixes the host->guest direction of the clipboard with noVNC and
TigerVNC as clients.

Fixes: d921fea338 ("ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255)")
Reported-by: Friedrich Weber <f.weber@proxmox.com>
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20231122125826.228189-1-f.ebner@proxmox.com>
(cherry picked from commit ebfbf394671163c14e2b24d98f3927a3151d1aff)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
ui/vnc-clipboard.c