From patchwork Mon Sep 4 11:52:42 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Patchwork-Id: 719964 Delivered-To: patch@linaro.org Received: by 2002:adf:d08b:0:b0:31d:da82:a3b4 with SMTP id y11csp1564046wrh; Mon, 4 Sep 2023 05:13:08 -0700 (PDT) X-Google-Smtp-Source: AGHT+IEJ2QUgkmOG7MtP1mSgnCOJPfoufDCU/r98wlWZ5zM+bNidOxHeQjkW5hqfw7qlr2riA+ws X-Received: by 2002:a05:6808:10d5:b0:3a4:2485:85a1 with SMTP id s21-20020a05680810d500b003a4248585a1mr13311293ois.3.1693829588098; Mon, 04 Sep 2023 05:13:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1693829588; cv=none; d=google.com; s=arc-20160816; b=q5TvvAmE8ESubySkKNLH3OApkkqzc6k3p+xLcjKcbsfnvfNNB0Sjrp2VFLpZhJnC19 zsUV/9p89gzklO6QF+c9tWcW7ZvAYLXebAF5G1Ozb7QozUOHffaYU1m7VL9Kl8T/H/jo IMd/TVf7OUjnkZs0W6N5Mfx1CdhRpT3ar1ODjZQhVwwOUPESGRKlCbmXYQi4rZFXIxwI dZpdfml5blPWYJ1tQ2JXA8hV7X1pEskAvosy7+G2E0dUnCfO9rRcab8JT5OXdS3sQ30t NxcLk60sspkq+qBAHw/8MA0lXygl5T4HpJYkhXvvSFtUNKVmXBpngdAOYsrGl/y55mi9 OsHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=4tZfSsnhfezWbR25O9bGbK3oCf6AjZ5e+y9iHI+/Jts=; fh=5PZBcdtZx454qz9UmyVnLY0j4UW3ePIPJwbF/2jeTFQ=; b=WmE49c2JWbvDsYhu21txvlIttpbzDfEjMlQecyB0Fc2xKd5taobYMb+/fDeTlr4mP4 9su7SGbHZyGQhPrq2W1aQXA9yHBL85bYBnPwMQwkCG7G+Pol8AGoEo3ALU0Swlua10u2 sr5uEjc3iGNGmUtEwi2Hm7Q4VltdMFLHxAwdZdycgS1Y6blwNpVcBa7RqAKeen0Ikzw4 aIbjC01OQi6zb9nQMVy9iqUvrrtScTQTDsoQ7Fg09Dwjtutx74H/N11wkWMyJBnzHr3m Kn0EZdRCgSjetw5FH+IWQt/BsldRoaPfaHT3B+Uj2LSHVAieiEFZ/nPzT+3V/qqvpOh+ cCUw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=S374vXqe; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id m19-20020a0cf193000000b0063f7d73dd87si6365970qvl.584.2023.09.04.05.13.07 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 04 Sep 2023 05:13:08 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=S374vXqe; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qd8BZ-0000pn-Go; Mon, 04 Sep 2023 07:56:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qd8BQ-0000ZA-8W for qemu-devel@nongnu.org; Mon, 04 Sep 2023 07:55:56 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qd8BO-0000oP-1a for qemu-devel@nongnu.org; Mon, 04 Sep 2023 07:55:55 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1693828553; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4tZfSsnhfezWbR25O9bGbK3oCf6AjZ5e+y9iHI+/Jts=; b=S374vXqeh41dRfqu100DJdgn6n9uKLMXR5gmhJFjsNGytyNtsT256Hn9Z+giBn9TP18JLz lVQ607IV3nhlbsw8hklTVJZD2A+/nZoZr0IBB9ttkNkfMmaghweAm8a2NCVK5hWCa36xG5 2K5N678PnfaAR3Dp9onPAn44fMDNmX4= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-343-rYUzNEOlPr-rtncGciB39A-1; Mon, 04 Sep 2023 07:55:51 -0400 X-MC-Unique: rYUzNEOlPr-rtncGciB39A-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 7981184AF9D; Mon, 4 Sep 2023 11:55:51 +0000 (UTC) Received: from localhost (unknown [10.39.208.42]) by smtp.corp.redhat.com (Postfix) with ESMTP id 8E186493110; Mon, 4 Sep 2023 11:55:50 +0000 (UTC) From: marcandre.lureau@redhat.com To: qemu-devel@nongnu.org Cc: stefanha@redhat.com, Peter Maydell , Gerd Hoffmann , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= Subject: [PULL 45/52] ui/spice-display: Avoid dynamic stack allocation Date: Mon, 4 Sep 2023 15:52:42 +0400 Message-ID: <20230904115251.4161397-46-marcandre.lureau@redhat.com> In-Reply-To: <20230904115251.4161397-1-marcandre.lureau@redhat.com> References: <20230904115251.4161397-1-marcandre.lureau@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.9 Received-SPF: pass client-ip=170.10.129.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell Use an autofree heap allocation instead of a variable-length array on the stack in qemu_spice_create_update(). The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Marc-André Lureau Message-Id: <20230818151057.1541189-2-peter.maydell@linaro.org> --- ui/spice-display.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ui/spice-display.c b/ui/spice-display.c index 3f3f8013d8..0e2fbfb17c 100644 --- a/ui/spice-display.c +++ b/ui/spice-display.c @@ -189,7 +189,7 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd) { static const int blksize = 32; int blocks = DIV_ROUND_UP(surface_width(ssd->ds), blksize); - int dirty_top[blocks]; + g_autofree int *dirty_top = NULL; int y, yoff1, yoff2, x, xoff, blk, bw; int bpp = surface_bytes_per_pixel(ssd->ds); uint8_t *guest, *mirror; @@ -198,6 +198,7 @@ static void qemu_spice_create_update(SimpleSpiceDisplay *ssd) return; }; + dirty_top = g_new(int, blocks); for (blk = 0; blk < blocks; blk++) { dirty_top[blk] = -1; } From patchwork Mon Sep 4 11:52:43 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Marc-Andr=C3=A9_Lureau?= X-Patchwork-Id: 719963 Delivered-To: patch@linaro.org Received: by 2002:adf:d08b:0:b0:31d:da82:a3b4 with SMTP id y11csp1558868wrh; Mon, 4 Sep 2023 05:04:09 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFcDCsKg8WTQWbAICxWpT+6T3/HXncQpWtvRMOGzqIFaBtaKdgMeV84wb1tdeiluKLPgZ83 X-Received: by 2002:a0c:e08c:0:b0:64f:60e9:9285 with SMTP id l12-20020a0ce08c000000b0064f60e99285mr9812126qvk.30.1693829049285; Mon, 04 Sep 2023 05:04:09 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1693829049; cv=none; d=google.com; s=arc-20160816; b=ZsogtPkEVjDyu2OF3A1gG/UBNQ7tBkwIEfd1QyhwqM22PrvQA3bKmmgPPlZp3gXdrl iJIUqMEYiGDkI6AgSQMfb0J6VBPSlYzaAKjBdYVrs5IRLSbzEp/hTvpgJJr+HWgj5opg Dl20gFTU6pCAxr1KJl0anRoRXDEbrahJLBtAsyNrz6UZzgxv1seXrJVr0zwMYwDlhenm QCpdYzbrgHdNAxLevPNnatjBNa180ji+EtKx2tWcod8ZtIf6cgkcaQYCHDct0xbTutgh kN2kOxDYhxitV1hyNyf3kSAspxVUi+5TSm3b7rk2jEzMm6rcYi4hjwrYHODcTurVGTyD FXwA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=tjGC2ML3L2cd08LhzVrXNPJbEDWvTfhWKeJntBP1e6U=; fh=4XV5jQjy/ijC9SccLOW2hPOobeaBcoMCw8X0gAGGlcA=; b=ZcoXLWRkKzpozz+wmaMGoaJzmcav1aCrY1pdI/CmYGKiIee6ptXAQA5K9wdPerYpZC 0VzS4OFaKjNrpmQYPUD6yiw0aEcoisTzcVtzArGEAvDE12H0w7DNdK8gBZYryUg7ZRbt kQqlLhWHynSds9xwIYpO+cmHXvEMbs/BtfS5oqvgbYRpxXALB+ieQvX7fW6ZrOC/pb6R qnOozEFSFTB/z23FRIYV7v85TcrtHR0/KtdYt4k1TtpFVRdBv7CirZOWtA7voeNPPrD0 A+8ZYY1mDhd/B8COD2I4cNqRJqaU83Y13Xfa8SwZ4DzqcoD/TAq/PY8mIZTlUrIg4kWe ZPdQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=BtSFcIkV; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id u18-20020a05620a431200b0076ca246d4easi6592279qko.612.2023.09.04.05.04.09 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 04 Sep 2023 05:04:09 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=BtSFcIkV; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qd8Bb-0000sh-Be; Mon, 04 Sep 2023 07:56:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qd8BZ-0000ph-8T for qemu-devel@nongnu.org; Mon, 04 Sep 2023 07:56:05 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qd8BX-0000qq-2Z for qemu-devel@nongnu.org; Mon, 04 Sep 2023 07:56:04 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1693828562; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tjGC2ML3L2cd08LhzVrXNPJbEDWvTfhWKeJntBP1e6U=; b=BtSFcIkV6D72tnZuWGhrHHEAFRAHIxiaTVVntT7DCzdczvhKezbMditRjiyd/iR36crUtK JQdVA+w8Rkmk0rb2EThcWkblLWSbiNUOQSJPBx//qTG/p6b8Ssyb1wo4dK56yKoBBzkjJN A8g70T13C10DAJhRj+ulWixaUJmK0JM= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-88-NbbM8DGbNgu22cgBSfmu8Q-1; Mon, 04 Sep 2023 07:56:01 -0400 X-MC-Unique: NbbM8DGbNgu22cgBSfmu8Q-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 0427410264C1; Mon, 4 Sep 2023 11:56:01 +0000 (UTC) Received: from localhost (unknown [10.39.208.42]) by smtp.corp.redhat.com (Postfix) with ESMTP id 318AA2013570; Mon, 4 Sep 2023 11:55:59 +0000 (UTC) From: marcandre.lureau@redhat.com To: qemu-devel@nongnu.org Cc: stefanha@redhat.com, Peter Maydell , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Gerd Hoffmann Subject: [PULL 46/52] ui/vnc-enc-hextile: Use static rather than dynamic length stack array Date: Mon, 4 Sep 2023 15:52:43 +0400 Message-ID: <20230904115251.4161397-47-marcandre.lureau@redhat.com> In-Reply-To: <20230904115251.4161397-1-marcandre.lureau@redhat.com> References: <20230904115251.4161397-1-marcandre.lureau@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.6 Received-SPF: pass client-ip=170.10.133.124; envelope-from=marcandre.lureau@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell In the send_hextile_tile_* function we create a variable length array data[]. In fact we know that the client_pf.bytes_per_pixel is at most 4 (enforced by set_pixel_format()), so we can make the array a compile-time fixed length of 1536 bytes. The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé [ Marc-André - rename BPP to MAX_BYTES_PER_PIXEL ] Signed-off-by: Marc-André Lureau Message-Id: <20230818151057.1541189-3-peter.maydell@linaro.org> --- ui/vnc-enc-hextile-template.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/ui/vnc-enc-hextile-template.h b/ui/vnc-enc-hextile-template.h index 0c56262aff..8ee92086ac 100644 --- a/ui/vnc-enc-hextile-template.h +++ b/ui/vnc-enc-hextile-template.h @@ -7,6 +7,8 @@ #define NAME BPP #endif +#define MAX_BYTES_PER_PIXEL 4 + static void CONCAT(send_hextile_tile_, NAME)(VncState *vs, int x, int y, int w, int h, void *last_bg_, @@ -25,10 +27,13 @@ static void CONCAT(send_hextile_tile_, NAME)(VncState *vs, int bg_count = 0; int fg_count = 0; int flags = 0; - uint8_t data[(vs->client_pf.bytes_per_pixel + 2) * 16 * 16]; + uint8_t data[(MAX_BYTES_PER_PIXEL + 2) * 16 * 16]; int n_data = 0; int n_subtiles = 0; + /* Enforced by set_pixel_format() */ + assert(vs->client_pf.bytes_per_pixel <= MAX_BYTES_PER_PIXEL); + for (j = 0; j < h; j++) { for (i = 0; i < w; i++) { switch (n_colors) { @@ -205,6 +210,7 @@ static void CONCAT(send_hextile_tile_, NAME)(VncState *vs, } } +#undef MAX_BYTES_PER_PIXEL #undef NAME #undef pixel_t #undef CONCAT_I