[Spice-commits] server/red-parse-qxl.c

[GitLab Mirror]

 server/red-parse-qxl.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

New commits:
commit 94611ac175490fa27fb74e050c67b62084d2ad4d
Author: Frediano Ziglio <fziglio at redhat.com>
Date:   Sat Jun 1 22:03:07 2019 +0100

    red-parse-qxl: Reset mask attributes if brush image is missing
    
    The attributes in this case are not used to apply the mask.
    Doing so avoid sending garbage from the guest which usually
    don't initialise the memory in case the mask is missing.
    Guest should have cleared these bytes by its own however doing so
    on the server fixes the problem too. Considering that these
    command should not appears in newer OSes it's surely not a hot path
    code.
    These garbage came from video memory of the guest so they don't
    contain sensitive data.
    
    This fixes https://gitlab.freedesktop.org/spice/spice-server/issues/25.
    
    Signed-off-by: Frediano Ziglio <fziglio at redhat.com>
    Acked-by: Snir Sheriber <ssheribe at redhat.com>

diff --git a/server/red-parse-qxl.c b/server/red-parse-qxl.c
index cfef9e6d..eb2c0b53 100644
--- a/server/red-parse-qxl.c
+++ b/server/red-parse-qxl.c
@@ -626,9 +626,15 @@ static void red_put_brush(SpiceBrush *red)
 static void red_get_qmask_ptr(RedMemSlotInfo *slots, int group_id,
                               SpiceQMask *red, QXLQMask *qxl, uint32_t flags)
 {
-    red->flags  = qxl->flags;
-    red_get_point_ptr(&red->pos, &qxl->pos);
     red->bitmap = red_get_image(slots, group_id, qxl->bitmap, flags, true);
+    if (red->bitmap) {
+        red->flags  = qxl->flags;
+        red_get_point_ptr(&red->pos, &qxl->pos);
+    } else {
+        red->flags  = 0;
+        red->pos.x = 0;
+        red->pos.y = 0;
+    }
 }
 
 static void red_put_qmask(SpiceQMask *red)