Hello community, here is the log from the commit of package xorg-x11-Xvnc for openSUSE:Factory checked in at 2013-09-17 15:07:28 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xorg-x11-Xvnc (Old) and /work/SRC/openSUSE:Factory/.xorg-x11-Xvnc.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xorg-x11-Xvnc" Changes: -------- --- /work/SRC/openSUSE:Factory/xorg-x11-Xvnc/xorg-x11-Xvnc.changes 2013-09-11 13:25:17.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.xorg-x11-Xvnc.new/xorg-x11-Xvnc.changes 2013-09-17 15:07:29.000000000 +0200 @@ -1,0 +2,6 @@ +Mon Sep 16 21:24:29 UTC 2013 - [email protected] + +- u_tigervnc-1.3.0-fix-use-after-free.patch + * Fix use after free. (bnc#840433) + +------------------------------------------------------------------- New: ---- u_tigervnc-1.3.0-fix-use-after-free.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xorg-x11-Xvnc.spec ++++++ --- /var/tmp/diff_new_pack.F0IJE2/_old 2013-09-17 15:07:29.000000000 +0200 +++ /var/tmp/diff_new_pack.F0IJE2/_new 2013-09-17 15:07:29.000000000 +0200 @@ -64,6 +64,7 @@ Patch1: tigervnc-1.2.80-fix-int-to-pointer.patch Patch2: u_aarch64-support.patch Patch3: N_xorg-server-xdmcp.patch +Patch4: u_tigervnc-1.3.0-fix-use-after-free.patch %else Source0: Xvnc.pl %endif @@ -84,6 +85,9 @@ %patch1 -p1 %patch2 -p1 %patch3 -p1 +pushd ../.. +%patch4 -p1 +popd %endif %build ++++++ u_tigervnc-1.3.0-fix-use-after-free.patch ++++++ Author: Michal Srb <[email protected]> Subject: Fix use after free in ZRLEEncoder. Patch-Mainline: To be upstreamed References: bnc#840433 There is use after free crash when client using zrle disconnects: ZRLEEncoder contains zos variable (rdr::ZlibOutStream) and mos variable (pointer to rdr::MemOutStream). mos is always allocated in constructor (it could be a copy of static sharedMos pointer if sharedMos != 0, but it is always 0). When ZRLEEncoder::writeRect is called, any of zrleEncode* functions sets mos as an underlying stream of zos. When ZRLEEncoder is destructed, mos is deleted (sharedMos is always 0), then zos is implicitly destructed, but zos accesses it's underlying stream in it's destructor! We need to destruct mos first and zos second when ZRLEEncoder is destructed. As sharedMos is never used, we can remove that, simplify ZRLEEncoder and turn zos into a member variable same as mos. They will be both implicitly destructed in reverse order of declaration. diff -ur tigervnc-1.3.0-orig/common/rfb/ZRLEEncoder.cxx tigervnc-1.3.0/common/rfb/ZRLEEncoder.cxx --- tigervnc-1.3.0-orig/common/rfb/ZRLEEncoder.cxx 2013-09-17 00:18:28.557911306 +0300 +++ tigervnc-1.3.0/common/rfb/ZRLEEncoder.cxx 2013-09-17 00:19:57.487915741 +0300 @@ -26,7 +26,6 @@ using namespace rfb; -rdr::MemOutStream* ZRLEEncoder::sharedMos = 0; int ZRLEEncoder::maxLen = 4097 * 1024; // enough for width 16384 32-bit pixels IntParameter zlibLevel("ZlibLevel","Zlib compression level",-1); @@ -55,33 +54,27 @@ } ZRLEEncoder::ZRLEEncoder(SMsgWriter* writer_) - : writer(writer_), zos(0,0,zlibLevel) + : writer(writer_), zos(0,0,zlibLevel), mos(129*1024) { - if (sharedMos) - mos = sharedMos; - else - mos = new rdr::MemOutStream(129*1024); } ZRLEEncoder::~ZRLEEncoder() { - if (!sharedMos) - delete mos; } bool ZRLEEncoder::writeRect(const Rect& r, TransImageGetter* ig, Rect* actual) { rdr::U8* imageBuf = writer->getImageBuf(64 * 64 * 4 + 4); - mos->clear(); + mos.clear(); bool wroteAll = true; *actual = r; switch (writer->bpp()) { case 8: - wroteAll = zrleEncode8(r, mos, &zos, imageBuf, maxLen, actual, ig); + wroteAll = zrleEncode8(r, &mos, &zos, imageBuf, maxLen, actual, ig); break; case 16: - wroteAll = zrleEncode16(r, mos, &zos, imageBuf, maxLen, actual, ig); + wroteAll = zrleEncode16(r, &mos, &zos, imageBuf, maxLen, actual, ig); break; case 32: { @@ -94,16 +87,16 @@ if ((fitsInLS3Bytes && pf.isLittleEndian()) || (fitsInMS3Bytes && pf.isBigEndian())) { - wroteAll = zrleEncode24A(r, mos, &zos, imageBuf, maxLen, actual, ig); + wroteAll = zrleEncode24A(r, &mos, &zos, imageBuf, maxLen, actual, ig); } else if ((fitsInLS3Bytes && pf.isBigEndian()) || (fitsInMS3Bytes && pf.isLittleEndian())) { - wroteAll = zrleEncode24B(r, mos, &zos, imageBuf, maxLen, actual, ig); + wroteAll = zrleEncode24B(r, &mos, &zos, imageBuf, maxLen, actual, ig); } else { - wroteAll = zrleEncode32(r, mos, &zos, imageBuf, maxLen, actual, ig); + wroteAll = zrleEncode32(r, &mos, &zos, imageBuf, maxLen, actual, ig); } break; } @@ -111,8 +104,8 @@ writer->startRect(*actual, encodingZRLE); rdr::OutStream* os = writer->getOutStream(); - os->writeU32(mos->length()); - os->writeBytes(mos->data(), mos->length()); + os->writeU32(mos.length()); + os->writeBytes(mos.data(), mos.length()); writer->endRect(); return wroteAll; } diff -ur tigervnc-1.3.0-orig/common/rfb/ZRLEEncoder.h tigervnc-1.3.0/common/rfb/ZRLEEncoder.h --- tigervnc-1.3.0-orig/common/rfb/ZRLEEncoder.h 2013-09-17 00:18:28.558911306 +0300 +++ tigervnc-1.3.0/common/rfb/ZRLEEncoder.h 2013-09-17 00:20:34.372917581 +0300 @@ -38,16 +38,11 @@ // width, in this example about 128 bytes). static void setMaxLen(int m) { maxLen = m; } - // setSharedMos() sets a MemOutStream to be shared amongst all - // ZRLEEncoders. Should be called before any ZRLEEncoders are created. - static void setSharedMos(rdr::MemOutStream* mos_) { sharedMos = mos_; } - private: ZRLEEncoder(SMsgWriter* writer); SMsgWriter* writer; + rdr::MemOutStream mos; rdr::ZlibOutStream zos; - rdr::MemOutStream* mos; - static rdr::MemOutStream* sharedMos; static int maxLen; }; } -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
