starred/qemu-qemu
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-07-08 17:46:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

ui: fix validation of VNC extended clipboard data length

Browse Source 
QEMU's VNC extended clipboard handler inflates a client-controlled
compressed clipboard payload. The code checks the declared text size
against the total inflated buffer size:

    if (tsize < size)

but then copies from:

    tbuf = buf + 4;
    qemu_clipboard_set_data(..., tsize, tbuf, true);

The correct bound is the remaining data length after the 4-byte length
field, not the total inflated buffer length.

As a result, a VNC client can make QEMU copy up to 3 bytes past the end
of the inflated heap buffer. With a second VNC client, those copied
bytes are observable through the normal VNC extended clipboard PROVIDE
path.

Fixes: CVE-2026-8343
Reported-by: Heechan Kang <gganji11@naver.com>
Reported-by: Feifan Qian <bea1e@proton.me>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Heechan Kang <gganji11@naver.com>
[DB: added #include and 'return' statements]
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20260512095543.459949-1-berrange@redhat.com>
This commit is contained in:
Heechan Kang
2026-05-12 10:55:43 +01:00
committed by Marc-André Lureau
parent d0c7b82d3a
commit e56b4bbff1
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
ui/vnc-clipboard.c
View File

@@ -23,6 +23,7 @@
*/ */
#include "qemu/osdep.h" #include "qemu/osdep.h"
#include "qemu/error-report.h"
#include "vnc.h" #include "vnc.h"
#include "vnc-jobs.h" #include "vnc-jobs.h"
@@ -282,10 +283,16 @@ void vnc_client_cut_text_ext(VncState *vs, int32_t len, uint32_t flags, uint8_t
buf && size >= 4) { buf && size >= 4) {
uint32_t tsize = read_u32(buf, 0); uint32_t tsize = read_u32(buf, 0);
uint8_t *tbuf = buf + 4; uint8_t *tbuf = buf + 4;
if (tsize < size) { if (tsize <= size - 4) {
qemu_clipboard_set_data(&vs->cbpeer, vs->cbinfo, qemu_clipboard_set_data(&vs->cbpeer, vs->cbinfo,
QEMU_CLIPBOARD_TYPE_TEXT, QEMU_CLIPBOARD_TYPE_TEXT,
tsize, tbuf, true); tsize, tbuf, true);
} else {
error_report("vnc: malformed extended clipboard payload "
"with text length %u exceeding available %u",
tsize, size - 4);
vnc_client_error(vs);
return;
} }
} }
} }