From 5aaaa5bd91261a6b61fcaa75585f8446b9eeb036 Mon Sep 17 00:00:00 2001 From: Uri Lublin Date: Tue, 31 Jul 2018 16:18:15 +0300 Subject: [PATCH 1/4] start streaming: check num_codecs The server sends StreamMsgStartStop to tell spice-streaming-agent to start streaming and a list of available codecs. The first uint8_t is the number of codecs. Each following uint8_t is a codec. This patch checks that the number of codecs in the message, as reported by the server, is not too large. --- src/spice-streaming-agent.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/spice-streaming-agent.cpp b/src/spice-streaming-agent.cpp index 1121f35..9ebbf5d 100644 --- a/src/spice-streaming-agent.cpp +++ b/src/spice-streaming-agent.cpp @@ -95,6 +95,11 @@ static void handle_stream_start_stop(StreamPort &stream_port, uint32_t len) syslog(LOG_INFO, "GOT START_STOP message -- request to %s streaming\n", streaming_requested ? "START" : "STOP"); client_codecs.clear(); + const int mnc = len - 1; /* max num codecs, see struct StreamMsgStartStop */ + if (msg[0] > mnc) { + throw std::runtime_error("num_codecs=" + std::to_string(msg[0]) + + " > max_num_codecs=" + std::to_string(mnc)); + } for (int i = 1; i <= msg[0]; ++i) { client_codecs.insert((SpiceVideoCodecType) msg[i]); } -- 2.17.1