[Spice-devel] [PATCH vdagent] Fixing buffer overflow when reloading wallpaper

[Christophe Fergeau]

Ah thanks for the expanded commit log!

Acked-by: Christophe Fergeau <cfergeau at redhat.com>

On Mon, Aug 01, 2016 at 01:22:40PM +0300, Sameeh Jubran wrote:
> The function "SystemParametersInfo" expects the size of the
> buffer in characters. When wchar is used instead of char - two
> bytes instead of one byte per character -, then "sizeof" returns wrong
> number of characters (twice as much). A suitable solution would be to use
> SPICE_N_ELEMENTS.
> 
> Based on patch by Sandy Stutsman <sstutsma at redhat.com>
> 
> Signed-off-by: Dmitry Fleytman <dfleytma at redhat.com>
> Signed-off-by: Sameeh Jubran <sameeh at daynix.com>
> ---
>  vdagent/display_setting.cpp | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/vdagent/display_setting.cpp b/vdagent/display_setting.cpp
> index 1ec7397..c261b67 100644
> --- a/vdagent/display_setting.cpp
> +++ b/vdagent/display_setting.cpp
> @@ -21,6 +21,7 @@
>  #include <tlhelp32.h>
>  #include "display_setting.h"
>  #include "vdlog.h"
> +#include "spice-protocol/spice/macros.h"
>  
>  enum DisplaySettingFlags {
>      DISPLAY_SETTING_FLAGS_DISABLE_WALLPAPER = (1 << 0),
> @@ -306,7 +307,7 @@ bool DisplaySetting::reload_wallpaper(HKEY desktop_reg_key)
>          wallpaper_path[value_size] = '\0';
>      }
>  
> -    if (SystemParametersInfo(SPI_GETDESKWALLPAPER, sizeof(cur_wallpaper), cur_wallpaper, 0)) {
> +    if (SystemParametersInfo(SPI_GETDESKWALLPAPER, SPICE_N_ELEMENTS(cur_wallpaper), cur_wallpaper, 0)) {
>          if (_tcscmp(cur_wallpaper, TEXT("")) != 0) {
>              vd_printf("wallpaper wasn't disabled");
>              return true;
> -- 
> 2.5.5
> 
> _______________________________________________
> Spice-devel mailing list
> Spice-devel at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/spice-devel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <https://lists.freedesktop.org/archives/spice-devel/attachments/20160801/d455080c/attachment.sig>