From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Frediano Ziglio <fziglio@redhat.com>
Date: Mon, 29 Feb 2016 14:34:49 +0000
Subject: [PATCH] improve primary surface parameter checks

Primary surface, as additional surfaces, can be used to access
host memory from the guest using invalid parameters.

Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
---
 server/red_worker.c | 9 +++++++++
 1 file changed, 9 insertions(+)

Index: spice-0.12.4/server/red_worker.c
===================================================================
--- spice-0.12.4.orig/server/red_worker.c	2016-06-10 10:58:22.081707787 -0400
+++ spice-0.12.4/server/red_worker.c	2016-06-10 10:58:22.077707741 -0400
@@ -11426,6 +11426,15 @@
     spice_warn_if(((uint64_t)abs(surface.stride) * (uint64_t)surface.height) !=
              abs(surface.stride) * surface.height);
 
+     /* surface can arrive from guest unchecked so make sure
+      * guest is not a malicious one and drop invalid requests
+      */
+     if (!red_validate_surface(surface.width, surface.height,
+                               surface.stride, surface.format)) {
+         spice_warning("wrong primary surface creation request");
+         return;
+     }
+
     line_0 = (uint8_t*)get_virt(&worker->mem_slots, surface.mem,
                                 surface.height * abs(surface.stride),
                                 surface.group_id, &error);
