From: Daniel P. Berrangé Date: Mon, 16 Sep 2024 12:47:11 +0000 (+0100) Subject: ui: fix handling of NULL SASL server data X-Git-Tag: v9.2.0-rc0~38^2~2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=829cb3d0eab08e4fea768926f06db1c411a2767f;p=thirdparty%2Fqemu.git ui: fix handling of NULL SASL server data The code is supposed to distinguish between SASL server data that is NULL, vs non-NULL but zero-length. It was incorrectly checking the 'serveroutlen' variable, rather than 'serverout' though, so failing to distinguish the cases. Fortunately we can fix this without breaking compatibility with clients, as clients already know how to decode the input data correctly. Reviewed-by: Marc-André Lureau Signed-off-by: Daniel P. Berrangé --- diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c index 25f6b4b7765..a04feeb429f 100644 --- a/ui/vnc-auth-sasl.c +++ b/ui/vnc-auth-sasl.c @@ -289,9 +289,10 @@ static int protocol_client_auth_sasl_step(VncState *vs, uint8_t *data, size_t le goto authabort; } - if (serveroutlen) { + if (serverout) { vnc_write_u32(vs, serveroutlen + 1); - vnc_write(vs, serverout, serveroutlen + 1); + vnc_write(vs, serverout, serveroutlen); + vnc_write_u8(vs, '\0'); } else { vnc_write_u32(vs, 0); } @@ -410,9 +411,10 @@ static int protocol_client_auth_sasl_start(VncState *vs, uint8_t *data, size_t l goto authabort; } - if (serveroutlen) { + if (serverout) { vnc_write_u32(vs, serveroutlen + 1); - vnc_write(vs, serverout, serveroutlen + 1); + vnc_write(vs, serverout, serveroutlen); + vnc_write_u8(vs, '\0'); } else { vnc_write_u32(vs, 0); }