diff --git a/pkgs/development/libraries/spice/0001-Adapting-the-following-patch-from-http-pkgs.fedorapr.patch b/pkgs/development/libraries/spice/0001-Adapting-the-following-patch-from-http-pkgs.fedorapr.patch new file mode 100644 index 00000000000..8098f568e21 --- /dev/null +++ b/pkgs/development/libraries/spice/0001-Adapting-the-following-patch-from-http-pkgs.fedorapr.patch @@ -0,0 +1,56 @@ +From 75e8685740199537bfefcbd9996ec3ff9f6342e6 Mon Sep 17 00:00:00 2001 +From: Graham Christensen +Date: Wed, 8 Feb 2017 21:58:43 -0500 +Subject: [PATCH] Adapting the following patch, from + http://pkgs.fedoraproject.org/cgit/rpms/spice.git/plain/0003-main-channel-Prevent-overflow-reading-messages-from-.patch?id=d919d639ae5f83a9735a04d843eed675f9357c0d + +> From: Frediano Ziglio +> Date: Tue, 29 Nov 2016 16:46:56 +0000 +> Subject: [spice-server 3/3] main-channel: Prevent overflow reading messages +> from client +> +> Caller is supposed the function return a buffer able to store +> size bytes. +> +> Signed-off-by: Frediano Ziglio +> Acked-by: Christophe Fergeau +> --- +> server/main-channel.c | 3 +++ +> 1 file changed, 3 insertions(+) +> +> diff --git a/server/main-channel.c b/server/main-channel.c +> index 24dd448..1124506 100644 +> --- a/server/main-channel.c +> +++ b/server/main-channel.c +> @@ -258,6 +258,9 @@ static uint8_t *main_channel_alloc_msg_rcv_buf(RedChannelClient *rcc, +> +> if (type == SPICE_MSGC_MAIN_AGENT_DATA) { +> return reds_get_agent_data_buffer(red_channel_get_server(channel), mcc, size); +> + } else if (size > sizeof(main_chan->recv_buf)) { +> + /* message too large, caller will log a message and close the connection */ +> + return NULL; +> } else { +> return main_chan->recv_buf; +> } +> -- +> 2.9.3 +> --- + server/main_channel.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/server/main_channel.c b/server/main_channel.c +index 0ecc9df..1fc3915 100644 +--- a/server/main_channel.c ++++ b/server/main_channel.c +@@ -1026,6 +1026,9 @@ static uint8_t *main_channel_alloc_msg_rcv_buf(RedChannelClient *rcc, + + if (type == SPICE_MSGC_MAIN_AGENT_DATA) { + return reds_get_agent_data_buffer(mcc, size); ++ } else if (size > sizeof(main_chan->recv_buf)) { ++ /* message too large, caller will log a message and close the connection */ ++ return NULL; + } else { + return main_chan->recv_buf; + } +-- +2.10.0 diff --git a/pkgs/development/libraries/spice/default.nix b/pkgs/development/libraries/spice/default.nix index c0145f4f776..61952c3b323 100644 --- a/pkgs/development/libraries/spice/default.nix +++ b/pkgs/development/libraries/spice/default.nix @@ -1,6 +1,7 @@ -{ stdenv, fetchurl, pkgconfig, pixman, celt, alsaLib, openssl -, libXrandr, libXfixes, libXext, libXrender, libXinerama, libjpeg, zlib -, spice_protocol, python, pyparsing, glib, cyrus_sasl, lz4 }: +{ stdenv, fetchurl, fetchpatch, pkgconfig, pixman, celt, alsaLib +, openssl, libXrandr, libXfixes, libXext, libXrender, libXinerama +, libjpeg, zlib, spice_protocol, python, pyparsing, glib, cyrus_sasl +, lz4 }: with stdenv.lib; @@ -12,6 +13,22 @@ stdenv.mkDerivation rec { sha256 = "0za03i77j8i3g5l2np2j7vy8cqsdbkm9wbv4hjnaqq9xhz2sa0gr"; }; + patches = [ + (fetchpatch { + name = "0001-Prevent-possible-DoS-attempts-during-protocol-handsh.patch"; + url = "http://pkgs.fedoraproject.org/cgit/rpms/spice.git/plain/0001-Prevent-possible-DoS-attempts-during-protocol-handsh.patch?id=d919d639ae5f83a9735a04d843eed675f9357c0d"; + sha256 = "11x5566lx5zyl7f39glwsgpzkxb7hpcshx8va5ab3imrns07130q"; + }) + (fetchpatch { + name = "0002-Prevent-integer-overflows-in-capability-checks.patch"; + url = "http://pkgs.fedoraproject.org/cgit/rpms/spice.git/plain/0002-Prevent-integer-overflows-in-capability-checks.patch?id=d919d639ae5f83a9735a04d843eed675f9357c0d"; + sha256 = "1r1bhq98w93cvvrlrz6jwdfsy261xl3xqs0ppchaa2igyxvxv5z5"; + }) + # Originally from http://pkgs.fedoraproject.org/cgit/rpms/spice.git/plain/0003-main-channel-Prevent-overflow-reading-messages-from-.patch?id=d919d639ae5f83a9735a04d843eed675f9357c0d + # but main-channel.c was renamed to main_channel.c + ./0001-Adapting-the-following-patch-from-http-pkgs.fedorapr.patch + ]; + buildInputs = [ pixman celt alsaLib openssl libjpeg zlib libXrandr libXfixes libXrender libXext libXinerama python pyparsing glib cyrus_sasl lz4 ];