35 lines
1.0 KiB
Diff
35 lines
1.0 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Fiona Ebner <f.ebner@proxmox.com>
|
|
Date: Wed, 22 Nov 2023 13:17:25 +0100
|
|
Subject: [PATCH] ui/vnc-clipboard: fix inflate_buffer
|
|
|
|
Commit d921fea338 ("ui/vnc-clipboard: fix infinite loop in
|
|
inflate_buffer (CVE-2023-3255)") removed this hunk, but it is still
|
|
required, because it can happen that stream.avail_in becomes zero
|
|
before coming across a return value of Z_STREAM_END.
|
|
|
|
This fixes the host->guest direction with noNVC.
|
|
|
|
Reported-by: Friedrich Weber <f.weber@proxmox.com>
|
|
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
|
|
---
|
|
ui/vnc-clipboard.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/ui/vnc-clipboard.c b/ui/vnc-clipboard.c
|
|
index c759be3438..124b6fbd9c 100644
|
|
--- a/ui/vnc-clipboard.c
|
|
+++ b/ui/vnc-clipboard.c
|
|
@@ -69,6 +69,11 @@ static uint8_t *inflate_buffer(uint8_t *in, uint32_t in_len, uint32_t *size)
|
|
}
|
|
}
|
|
|
|
+ *size = stream.total_out;
|
|
+ inflateEnd(&stream);
|
|
+
|
|
+ return out;
|
|
+
|
|
err_end:
|
|
inflateEnd(&stream);
|
|
err:
|