summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBruce Ashfield <bruce.ashfield@gmail.com>2024-10-12 01:40:06 +0000
committerBruce Ashfield <bruce.ashfield@gmail.com>2024-10-12 01:40:06 +0000
commit12538d64862366eb365ed5f8a67fbb082bae1620 (patch)
treeb8c84a351545aafe56e861d63c7f30bf0488db3e
parenta35cc3d3aac992362f77d7ed0bbedf473a9aab13 (diff)
downloadmeta-cloud-services-12538d64862366eb365ed5f8a67fbb082bae1620.tar.gz
spice: remove recipe
meta-oe has a more updated version. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
-rw-r--r--recipes-support/spice/files/0001-Use-PRI-macros-in-printf-to-keep-compatibility-betwe.patch72
-rw-r--r--recipes-support/spice/files/0001-red_parse_qxl-Fix-BITMAP_FMT_IS_RGB-defined-but-not-.patch29
-rw-r--r--recipes-support/spice/files/CVE-2017-7506-1.patch81
-rw-r--r--recipes-support/spice/files/CVE-2017-7506-2.patch37
-rw-r--r--recipes-support/spice/files/CVE-2017-7506-3.patch54
-rw-r--r--recipes-support/spice/files/Fix-build-issues-with-gcc-7.patch59
-rw-r--r--recipes-support/spice/files/build-allow-separated-src-and-build-dirs.patch62
-rw-r--r--recipes-support/spice/files/configure.ac-add-subdir-objects-to-AM_INIT_AUTOMAKE.patch29
-rw-r--r--recipes-support/spice/files/spice-fix-CVE-2013-4282.patch100
-rw-r--r--recipes-support/spice/spice_git.bb79
10 files changed, 0 insertions, 602 deletions
diff --git a/recipes-support/spice/files/0001-Use-PRI-macros-in-printf-to-keep-compatibility-betwe.patch b/recipes-support/spice/files/0001-Use-PRI-macros-in-printf-to-keep-compatibility-betwe.patch
deleted file mode 100644
index 18fa8fa..0000000
--- a/recipes-support/spice/files/0001-Use-PRI-macros-in-printf-to-keep-compatibility-betwe.patch
+++ /dev/null
@@ -1,72 +0,0 @@
1From 3cb746329ea4846bd9c65e0198e69423379b6f62 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?=EC=86=8C=EB=B3=91=EC=B2=A0?= <byungchul.so@samsung.com>
3Date: Thu, 24 Apr 2014 12:26:32 +0000
4Subject: [PATCH] Use PRI macros in printf to keep compatibility between
5 32/64bit system
6
7gcc's some integer type definitions are different between 32/64bit system.
8This causes platform dependency problem with printf function. However,
9we can avoid this problem by using PRI macros that supports platform
10independent printf.
11---
12 server/mjpeg_encoder.c | 7 ++++---
13 server/red_worker.c | 4 ++--
14 2 files changed, 6 insertions(+), 5 deletions(-)
15
16diff --git a/server/mjpeg_encoder.c b/server/mjpeg_encoder.c
17index aea4964..f465d88 100644
18--- a/server/mjpeg_encoder.c
19+++ b/server/mjpeg_encoder.c
20@@ -23,6 +23,7 @@
21 #include "mjpeg_encoder.h"
22 #include <jerror.h>
23 #include <jpeglib.h>
24+#include <inttypes.h>
25
26 #define MJPEG_MAX_FPS 25
27 #define MJPEG_MIN_FPS 1
28@@ -66,7 +67,7 @@ static const int mjpeg_quality_samples[MJPEG_QUALITY_SAMPLE_NUM] = {20, 30, 40,
29 * are not necessarily related to mis-estimation of the bit rate, and we would
30 * like to wait till the stream stabilizes.
31 */
32-#define MJPEG_WARMUP_TIME 3000L // 3 sec
33+#define MJPEG_WARMUP_TIME 3000LL // 3 sec
34
35 enum {
36 MJPEG_QUALITY_EVAL_TYPE_SET,
37@@ -638,7 +639,7 @@ static void mjpeg_encoder_adjust_params_to_bit_rate(MJpegEncoder *encoder)
38
39 spice_debug("cur-fps=%u new-fps=%u (new/old=%.2f) |"
40 "bit-rate=%.2f (Mbps) latency=%u (ms) quality=%d |"
41- " new-size-avg %lu , base-size %lu, (new/old=%.2f) ",
42+ " new-size-avg %"PRIu64" , base-size %"PRIu64", (new/old=%.2f) ",
43 rate_control->fps, new_fps, ((double)new_fps)/rate_control->fps,
44 ((double)rate_control->byte_rate*8)/1024/1024,
45 latency,
46@@ -703,7 +704,7 @@ static void mjpeg_encoder_adjust_fps(MJpegEncoder *encoder, uint64_t now)
47
48 avg_fps = ((double)rate_control->adjusted_fps_num_frames*1000) /
49 adjusted_fps_time_passed;
50- spice_debug("#frames-adjust=%lu #adjust-time=%lu avg-fps=%.2f",
51+ spice_debug("#frames-adjust=%"PRIu64" #adjust-time=%"PRIu64" avg-fps=%.2f",
52 rate_control->adjusted_fps_num_frames, adjusted_fps_time_passed, avg_fps);
53 spice_debug("defined=%u old-adjusted=%.2f", rate_control->fps, rate_control->adjusted_fps);
54 fps_ratio = avg_fps / rate_control->fps;
55diff --git a/server/red_worker.c b/server/red_worker.c
56index 619f7bc..1871e13 100644
57--- a/server/red_worker.c
58+++ b/server/red_worker.c
59@@ -2594,8 +2594,8 @@ static void red_print_stream_stats(DisplayChannelClient *dcc, StreamAgent *agent
60 mjpeg_encoder_get_stats(agent->mjpeg_encoder, &encoder_stats);
61 }
62
63- spice_debug("stream=%ld dim=(%dx%d) #in-frames=%lu #in-avg-fps=%.2f #out-frames=%lu "
64- "out/in=%.2f #drops=%lu (#pipe=%lu #fps=%lu) out-avg-fps=%.2f "
65+ spice_debug("stream=%"PRIdPTR" dim=(%dx%d) #in-frames=%"PRIu64" #in-avg-fps=%.2f #out-frames=%"PRIu64" "
66+ "out/in=%.2f #drops=%"PRIu64" (#pipe=%"PRIu64" #fps=%"PRIu64") out-avg-fps=%.2f "
67 "passed-mm-time(sec)=%.2f size-total(MB)=%.2f size-per-sec(Mbps)=%.2f "
68 "size-per-frame(KBpf)=%.2f avg-quality=%.2f "
69 "start-bit-rate(Mbps)=%.2f end-bit-rate(Mbps)=%.2f",
70--
712.10.2
72
diff --git a/recipes-support/spice/files/0001-red_parse_qxl-Fix-BITMAP_FMT_IS_RGB-defined-but-not-.patch b/recipes-support/spice/files/0001-red_parse_qxl-Fix-BITMAP_FMT_IS_RGB-defined-but-not-.patch
deleted file mode 100644
index ccae5f5..0000000
--- a/recipes-support/spice/files/0001-red_parse_qxl-Fix-BITMAP_FMT_IS_RGB-defined-but-not-.patch
+++ /dev/null
@@ -1,29 +0,0 @@
1From 85838d4c9f2322aedb99b38fffd7da95a494d8ed Mon Sep 17 00:00:00 2001
2From: He Zhe <zhe.he@windriver.com>
3Date: Thu, 29 Jun 2017 08:26:35 +0000
4Subject: [PATCH] red_parse_qxl: Fix BITMAP_FMT_IS_RGB defined but not used
5
6| ../../git/server/red_parse_qxl.c:367:18: error: 'BITMAP_FMT_IS_RGB'
7defined but not used [-Werror=unused-const-variable=]
8| static const int BITMAP_FMT_IS_RGB[] = {0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1};
9
10Signed-off-by: He Zhe <zhe.he@windriver.com>
11---
12 server/red_parse_qxl.c | 1 -
13 1 file changed, 1 deletion(-)
14
15diff --git a/server/red_parse_qxl.c b/server/red_parse_qxl.c
16index 6c0b0658..cfc2da95 100644
17--- a/server/red_parse_qxl.c
18+++ b/server/red_parse_qxl.c
19@@ -364,7 +364,6 @@ static int bitmap_consistent(SpiceBitmap *bitmap)
20
21 // This is based on SPICE_BITMAP_FMT_*, copied from server/red_worker.c
22 // to avoid a possible unoptimization from making it non static.
23-static const int BITMAP_FMT_IS_RGB[] = {0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1};
24
25 static SpiceImage *red_get_image(RedMemSlotInfo *slots, int group_id,
26 QXLPHYSICAL addr, uint32_t flags, int is_mask)
27--
282.11.0
29
diff --git a/recipes-support/spice/files/CVE-2017-7506-1.patch b/recipes-support/spice/files/CVE-2017-7506-1.patch
deleted file mode 100644
index 1975aca..0000000
--- a/recipes-support/spice/files/CVE-2017-7506-1.patch
+++ /dev/null
@@ -1,81 +0,0 @@
1From 2e521a9db27e1ed31bf5fbed437208bf7f1c77a1 Mon Sep 17 00:00:00 2001
2From: Frediano Ziglio <fziglio@redhat.com>
3Date: Mon, 15 May 2017 15:57:28 +0100
4Subject: [PATCH 1/3] reds: Disconnect when receiving overly big
5 ClientMonitorsConfig
6
7Total message size received from the client was unlimited. There is
8a 2kiB size check on individual agent messages, but the MonitorsConfig
9message can be split in multiple chunks, and the size of the
10non-chunked MonitorsConfig message was never checked. This could easily
11lead to memory exhaustion on the host.
12
13Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
14
15Upstream-Status: Backport
16[https://cgit.freedesktop.org/spice/spice/commit/?h=0.12&id=f1e7ec03e26ab6b8ca9b7ec060846a5b706a963d]
17
18CVE: CVE-2017-7506
19
20Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
21---
22 server/reds.c | 25 +++++++++++++++++++++++--
23 1 file changed, 23 insertions(+), 2 deletions(-)
24
25diff --git a/server/reds.c b/server/reds.c
26index 30d0652..701d5d8 100644
27--- a/server/reds.c
28+++ b/server/reds.c
29@@ -1086,19 +1086,34 @@ static void reds_client_monitors_config_cleanup(void)
30 static void reds_on_main_agent_monitors_config(
31 MainChannelClient *mcc, void *message, size_t size)
32 {
33+ const unsigned int MAX_MONITORS = 256;
34+ const unsigned int MAX_MONITOR_CONFIG_SIZE =
35+ sizeof(VDAgentMonitorsConfig) + MAX_MONITORS * sizeof(VDAgentMonConfig);
36+
37 VDAgentMessage *msg_header;
38 VDAgentMonitorsConfig *monitors_config;
39 RedsClientMonitorsConfig *cmc = &reds->client_monitors_config;
40
41+ // limit size of message sent by the client as this can cause a DoS through
42+ // memory exhaustion, or potentially some integer overflows
43+ if (sizeof(VDAgentMessage) + MAX_MONITOR_CONFIG_SIZE - cmc->buffer_size < size) {
44+ goto overflow;
45+ }
46 cmc->buffer_size += size;
47 cmc->buffer = realloc(cmc->buffer, cmc->buffer_size);
48 spice_assert(cmc->buffer);
49 cmc->mcc = mcc;
50 memcpy(cmc->buffer + cmc->buffer_pos, message, size);
51 cmc->buffer_pos += size;
52+ if (sizeof(VDAgentMessage) > cmc->buffer_size) {
53+ spice_debug("not enough data yet. %d", cmc->buffer_size);
54+ return;
55+ }
56 msg_header = (VDAgentMessage *)cmc->buffer;
57- if (sizeof(VDAgentMessage) > cmc->buffer_size ||
58- msg_header->size > cmc->buffer_size - sizeof(VDAgentMessage)) {
59+ if (msg_header->size > MAX_MONITOR_CONFIG_SIZE) {
60+ goto overflow;
61+ }
62+ if (msg_header->size > cmc->buffer_size - sizeof(VDAgentMessage)) {
63 spice_debug("not enough data yet. %d\n", cmc->buffer_size);
64 return;
65 }
66@@ -1106,6 +1121,12 @@ static void reds_on_main_agent_monitors_config(
67 spice_debug("%s: %d\n", __func__, monitors_config->num_of_monitors);
68 red_dispatcher_client_monitors_config(monitors_config);
69 reds_client_monitors_config_cleanup();
70+ return;
71+
72+overflow:
73+ spice_warning("received invalid MonitorsConfig request from client, disconnecting");
74+ red_channel_client_disconnect(main_channel_client_get_base(mcc));
75+ reds_client_monitors_config_cleanup();
76 }
77
78 void reds_on_main_agent_data(MainChannelClient *mcc, void *message, size_t size)
79--
802.7.4
81
diff --git a/recipes-support/spice/files/CVE-2017-7506-2.patch b/recipes-support/spice/files/CVE-2017-7506-2.patch
deleted file mode 100644
index a517b08..0000000
--- a/recipes-support/spice/files/CVE-2017-7506-2.patch
+++ /dev/null
@@ -1,37 +0,0 @@
1From 6934f036240753a14514a71ede8bb44af2043f24 Mon Sep 17 00:00:00 2001
2From: Frediano Ziglio <fziglio@redhat.com>
3Date: Mon, 15 May 2017 15:57:28 +0100
4Subject: [PATCH 2/3] reds: Avoid integer overflows handling monitor
5 configuration
6
7Avoid VDAgentMessage::size integer overflows.
8
9Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
10
11Upstream-Status: Backport
12[https://cgit.freedesktop.org/spice/spice/commit/?h=0.12&id=ec6229c79abe05d731953df5f7e9a05ec9f6df79]
13
14CVE: CVE-2017-7506
15
16Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
17---
18 server/reds.c | 3 +++
19 1 file changed, 3 insertions(+)
20
21diff --git a/server/reds.c b/server/reds.c
22index 701d5d8..62b1164 100644
23--- a/server/reds.c
24+++ b/server/reds.c
25@@ -1117,6 +1117,9 @@ static void reds_on_main_agent_monitors_config(
26 spice_debug("not enough data yet. %d\n", cmc->buffer_size);
27 return;
28 }
29+ if (msg_header->size < sizeof(VDAgentMonitorsConfig)) {
30+ goto overflow;
31+ }
32 monitors_config = (VDAgentMonitorsConfig *)(cmc->buffer + sizeof(*msg_header));
33 spice_debug("%s: %d\n", __func__, monitors_config->num_of_monitors);
34 red_dispatcher_client_monitors_config(monitors_config);
35--
362.7.4
37
diff --git a/recipes-support/spice/files/CVE-2017-7506-3.patch b/recipes-support/spice/files/CVE-2017-7506-3.patch
deleted file mode 100644
index d55502f..0000000
--- a/recipes-support/spice/files/CVE-2017-7506-3.patch
+++ /dev/null
@@ -1,54 +0,0 @@
1From daedc2e2bb70f7cb0eafd65fd37fd73af12df770 Mon Sep 17 00:00:00 2001
2From: Frediano Ziglio <fziglio@redhat.com>
3Date: Mon, 15 May 2017 15:57:28 +0100
4Subject: [PATCH 3/3] reds: Avoid buffer overflows handling monitor
5 configuration
6
7It was also possible for a malicious client to set
8VDAgentMonitorsConfig::num_of_monitors to a number larger
9than the actual size of VDAgentMOnitorsConfig::monitors.
10This would lead to buffer overflows, which could allow the guest to
11read part of the host memory. This might cause write overflows in the
12host as well, but controlling the content of such buffers seems
13complicated.
14
15Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
16
17Upstream-Status: Backport
18[https://cgit.freedesktop.org/spice/spice/commit/?h=0.12&id=a957a90baf2c62d31f3547e56bba7d0e812d2331]
19
20CVE: CVE-2017-7506
21
22Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
23---
24 server/reds.c | 7 +++++++
25 1 file changed, 7 insertions(+)
26
27diff --git a/server/reds.c b/server/reds.c
28index 62b1164..ee36dec 100644
29--- a/server/reds.c
30+++ b/server/reds.c
31@@ -1093,6 +1093,7 @@ static void reds_on_main_agent_monitors_config(
32 VDAgentMessage *msg_header;
33 VDAgentMonitorsConfig *monitors_config;
34 RedsClientMonitorsConfig *cmc = &reds->client_monitors_config;
35+ uint32_t max_monitors;
36
37 // limit size of message sent by the client as this can cause a DoS through
38 // memory exhaustion, or potentially some integer overflows
39@@ -1121,6 +1122,12 @@ static void reds_on_main_agent_monitors_config(
40 goto overflow;
41 }
42 monitors_config = (VDAgentMonitorsConfig *)(cmc->buffer + sizeof(*msg_header));
43+ // limit the monitor number to avoid buffer overflows
44+ max_monitors = (msg_header->size - sizeof(VDAgentMonitorsConfig)) /
45+ sizeof(VDAgentMonConfig);
46+ if (monitors_config->num_of_monitors > max_monitors) {
47+ goto overflow;
48+ }
49 spice_debug("%s: %d\n", __func__, monitors_config->num_of_monitors);
50 red_dispatcher_client_monitors_config(monitors_config);
51 reds_client_monitors_config_cleanup();
52--
532.7.4
54
diff --git a/recipes-support/spice/files/Fix-build-issues-with-gcc-7.patch b/recipes-support/spice/files/Fix-build-issues-with-gcc-7.patch
deleted file mode 100644
index 7fcafdc..0000000
--- a/recipes-support/spice/files/Fix-build-issues-with-gcc-7.patch
+++ /dev/null
@@ -1,59 +0,0 @@
1From 9f001b6818ac4baa1df010ccf4200ca56bfb11b2 Mon Sep 17 00:00:00 2001
2From: Mark Asselstine <mark.asselstine@windriver.com>
3Date: Wed, 23 Aug 2017 13:47:29 -0400
4Subject: [PATCH] Fix build issues with gcc 7
5
6gcc 7 checks for when a switch statement doesn't break between
7cases. When a break is not found you will see
8
9| ../../git/server/reds.c: In function 'vdi_port_read_one_msg_from_device':
10| ../../git/server/reds.c:797:31: error: this statement may fall through [-Werror=implicit-fallthrough=]
11| state->read_state = VDI_PORT_READ_STATE_GET_BUFF;
12| ~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
13| ../../git/server/reds.c:798:9: note: here
14| case VDI_PORT_READ_STATE_GET_BUFF: {
15| ^~~~
16
17The 'fallthrough' comment will let gcc know this is done on purpose.
18
19Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
20---
21 server/inputs_channel.c | 1 +
22 server/reds.c | 2 ++
23 2 files changed, 3 insertions(+)
24
25diff --git a/server/inputs_channel.c b/server/inputs_channel.c
26index 931dac1..534ab66 100644
27--- a/server/inputs_channel.c
28+++ b/server/inputs_channel.c
29@@ -321,6 +321,7 @@ static int inputs_channel_handle_parsed(RedChannelClient *rcc, uint32_t size, ui
30 activate_modifiers_watch();
31 }
32 }
33+ /* fallthrough */
34 case SPICE_MSGC_INPUTS_KEY_UP: {
35 SpiceMsgcKeyDown *key_down = (SpiceMsgcKeyDown *)buf;
36 for (i = 0; i < 4; i++) {
37diff --git a/server/reds.c b/server/reds.c
38index 30d0652..8c80eb6 100644
39--- a/server/reds.c
40+++ b/server/reds.c
41@@ -795,6 +795,7 @@ static SpiceCharDeviceMsgToClient *vdi_port_read_one_msg_from_device(SpiceCharDe
42 }
43 state->message_recive_len = state->vdi_chunk_header.size;
44 state->read_state = VDI_PORT_READ_STATE_GET_BUFF;
45+ /* fallthrough */
46 case VDI_PORT_READ_STATE_GET_BUFF: {
47 if (!(state->current_read_buf = vdi_port_read_buf_get())) {
48 return NULL;
49@@ -806,6 +807,7 @@ static SpiceCharDeviceMsgToClient *vdi_port_read_one_msg_from_device(SpiceCharDe
50 state->message_recive_len -= state->recive_len;
51 state->read_state = VDI_PORT_READ_STATE_READ_DATA;
52 }
53+ /* fallthrough */
54 case VDI_PORT_READ_STATE_READ_DATA:
55 n = sif->read(vdagent, state->recive_pos, state->recive_len);
56 if (!n) {
57--
582.7.4
59
diff --git a/recipes-support/spice/files/build-allow-separated-src-and-build-dirs.patch b/recipes-support/spice/files/build-allow-separated-src-and-build-dirs.patch
deleted file mode 100644
index 9cbbff9..0000000
--- a/recipes-support/spice/files/build-allow-separated-src-and-build-dirs.patch
+++ /dev/null
@@ -1,62 +0,0 @@
1From 7d0d0ff080b159e647ebb26c337cb75314d64b52 Mon Sep 17 00:00:00 2001
2From: Mark Asselstine <mark.asselstine@windriver.com>
3Date: Thu, 1 May 2014 12:09:16 -0400
4Subject: [PATCH] build: allow separated src and build dirs
5
6We need to expland the list of include dirs to include the build dir since
7generated files will be created there instead of in the src dir.
8
9We also don't want to force using $srcdir for generated files as this will
10allow them to be created in the build dir. We account for the slight
11deviation in the generated files with expanded include paths.
12
13Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
14---
15 configure.ac | 2 +-
16 spice-common/common/Makefile.am | 14 +++++++-------
17 2 file changed, 8 insertions(+), 8 deletions(-)
18
19diff --git a/configure.ac b/configure.ac
20index edda8e9..9151fcb 100644
21--- a/configure.ac
22+++ b/configure.ac
23@@ -165,7 +165,7 @@ dnl =========================================================================
24 dnl Check deps
25
26 AC_CONFIG_SUBDIRS([spice-common])
27-COMMON_CFLAGS='-I ${top_srcdir}/spice-common/ -I ${top_srcdir}/spice-common/spice-protocol/'
28+COMMON_CFLAGS='-I ${top_srcdir}/spice-common/ -I ${top_srcdir}/spice-common/common/ -I ${top_srcdir}/spice-common/spice-protocol/ -I ${top_builddir}/spice-common/'
29 AC_SUBST(COMMON_CFLAGS)
30
31 AC_CHECK_LIBM
32diff --git a/spice-common/common/Makefile.am b/spice-common/common/Makefile.am
33index 45568c6..4c65ac4 100644
34--- a/spice-common/common/Makefile.am
35+++ b/spice-common/common/Makefile.am
36@@ -2,16 +2,16 @@ NULL =
37
38 # Avoid need for python(pyparsing) by end users
39 CLIENT_MARSHALLERS = \
40- $(srcdir)/generated_client_demarshallers.c \
41- $(srcdir)/generated_client_demarshallers1.c \
42- $(srcdir)/generated_client_marshallers.c \
43- $(srcdir)/generated_client_marshallers1.c \
44+ generated_client_demarshallers.c \
45+ generated_client_demarshallers1.c \
46+ generated_client_marshallers.c \
47+ generated_client_marshallers1.c \
48 $(NULL)
49
50 SERVER_MARSHALLERS = \
51- $(srcdir)/generated_server_demarshallers.c \
52- $(srcdir)/generated_server_marshallers.c \
53- $(srcdir)/generated_server_marshallers.h \
54+ generated_server_demarshallers.c \
55+ generated_server_marshallers.c \
56+ generated_server_marshallers.h \
57 $(NULL)
58
59 BUILT_SOURCES = $(CLIENT_MARSHALLERS) $(SERVER_MARSHALLERS) $(top_srcdir)/spice-protocol/spice/enums.h
60--
611.8.3.2
62
diff --git a/recipes-support/spice/files/configure.ac-add-subdir-objects-to-AM_INIT_AUTOMAKE.patch b/recipes-support/spice/files/configure.ac-add-subdir-objects-to-AM_INIT_AUTOMAKE.patch
deleted file mode 100644
index 323ef52..0000000
--- a/recipes-support/spice/files/configure.ac-add-subdir-objects-to-AM_INIT_AUTOMAKE.patch
+++ /dev/null
@@ -1,29 +0,0 @@
1From 36efb79076420975f7fa7aa0b03a1fc282291b05 Mon Sep 17 00:00:00 2001
2From: Mark Asselstine <mark.asselstine@windriver.com>
3Date: Tue, 25 Mar 2014 15:23:25 -0400
4Subject: [PATCH] configure.ac: add subdir-objects to AM_INIT_AUTOMAKE
5
6Without this you will get subdir-objects error which will cause
7autoreconf to complete successfully.
8
9Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
10---
11 spice-common/configure.ac | 2 +-
12 1 file changed, 1 insertion(+), 1 deletion(-)
13
14diff --git a/spice-common/configure.ac b/spice-common/configure.ac
15index b5cb960..78f1360 100644
16--- a/spice-common/configure.ac
17+++ b/spice-common/configure.ac
18@@ -13,7 +13,7 @@ AC_CONFIG_AUX_DIR([build-aux])
19 m4_ifdef([AM_PROG_AR], [AM_PROG_AR])
20
21 # Checks for programs
22-AM_INIT_AUTOMAKE([1.11 dist-xz no-dist-gzip tar-ustar foreign -Wall -Werror])
23+AM_INIT_AUTOMAKE([1.11 dist-xz no-dist-gzip tar-ustar foreign subdir-objects -Wall -Werror])
24 AM_MAINTAINER_MODE
25 AM_SILENT_RULES([yes])
26 LT_INIT
27--
281.8.3.2
29
diff --git a/recipes-support/spice/files/spice-fix-CVE-2013-4282.patch b/recipes-support/spice/files/spice-fix-CVE-2013-4282.patch
deleted file mode 100644
index 1a00a85..0000000
--- a/recipes-support/spice/files/spice-fix-CVE-2013-4282.patch
+++ /dev/null
@@ -1,100 +0,0 @@
1Fix buffer overflow when decrypting client SPICE ticket
2
3commit 8af619009660b24e0b41ad26b30289eea288fcc2 upstream
4
5reds_handle_ticket uses a fixed size 'password' buffer for the decrypted
6password whose size is SPICE_MAX_PASSWORD_LENGTH. However,
7RSA_private_decrypt which we call for the decryption expects the
8destination buffer to be at least RSA_size(link->tiTicketing.rsa)
9bytes long. On my spice-server build, SPICE_MAX_PASSWORD_LENGTH
10is 60 while RSA_size() is 128, so we end up overflowing 'password'
11when using long passwords (this was reproduced using the string:
12'fullscreen=1proxy=#enter proxy here; e.g spice_proxy = http://[proxy]:[port]'
13as a password).
14
15When the overflow occurs, QEMU dies with:
16*** stack smashing detected ***: qemu-system-x86_64 terminated
17
18This commit ensures we use a corectly sized 'password' buffer,
19and that it's correctly nul-terminated so that we can use strcmp
20instead of strncmp. To keep using strncmp, we'd need to figure out
21which one of 'password' and 'taTicket.password' is the smaller buffer,
22and use that size.
23
24This fixes rhbz#999839
25diff --git a/server/reds.c b/server/reds.c
26index 30d0652..6f262b0 100644
27--- a/server/reds.c
28+++ b/server/reds.c
29@@ -1931,39 +1931,59 @@ static void reds_handle_link(RedLinkInfo *link)
30 static void reds_handle_ticket(void *opaque)
31 {
32 RedLinkInfo *link = (RedLinkInfo *)opaque;
33- char password[SPICE_MAX_PASSWORD_LENGTH];
34+ char *password;
35 time_t ltime;
36+ int password_size;
37
38 //todo: use monotonic time
39 time(&ltime);
40- RSA_private_decrypt(link->tiTicketing.rsa_size,
41- link->tiTicketing.encrypted_ticket.encrypted_data,
42- (unsigned char *)password, link->tiTicketing.rsa, RSA_PKCS1_OAEP_PADDING);
43+ if (RSA_size(link->tiTicketing.rsa) < SPICE_MAX_PASSWORD_LENGTH) {
44+ spice_warning("RSA modulus size is smaller than SPICE_MAX_PASSWORD_LENGTH (%d < %d), "
45+ "SPICE ticket sent from client may be truncated",
46+ RSA_size(link->tiTicketing.rsa), SPICE_MAX_PASSWORD_LENGTH);
47+ }
48+
49+ password = g_malloc0(RSA_size(link->tiTicketing.rsa) + 1);
50+ password_size = RSA_private_decrypt(link->tiTicketing.rsa_size,
51+ link->tiTicketing.encrypted_ticket.encrypted_data,
52+ (unsigned char *)password,
53+ link->tiTicketing.rsa,
54+ RSA_PKCS1_OAEP_PADDING);
55+ if (password_size == -1) {
56+ spice_warning("failed to decrypt RSA encrypted password: %s",
57+ ERR_error_string(ERR_get_error(), NULL));
58+ goto error;
59+ }
60+ password[password_size] = '\0';
61
62 if (ticketing_enabled && !link->skip_auth) {
63 int expired = taTicket.expiration_time < ltime;
64
65 if (strlen(taTicket.password) == 0) {
66- reds_send_link_result(link, SPICE_LINK_ERR_PERMISSION_DENIED);
67 spice_warning("Ticketing is enabled, but no password is set. "
68- "please set a ticket first");
69- reds_link_free(link);
70- return;
71+ "please set a ticket first");
72+ goto error;
73 }
74
75- if (expired || strncmp(password, taTicket.password, SPICE_MAX_PASSWORD_LENGTH) != 0) {
76+ if (expired || strcmp(password, taTicket.password) != 0) {
77 if (expired) {
78 spice_warning("Ticket has expired");
79 } else {
80 spice_warning("Invalid password");
81 }
82- reds_send_link_result(link, SPICE_LINK_ERR_PERMISSION_DENIED);
83- reds_link_free(link);
84- return;
85+ goto error;
86 }
87 }
88
89 reds_handle_link(link);
90+ goto end;
91+
92+error:
93+ reds_send_link_result(link, SPICE_LINK_ERR_PERMISSION_DENIED);
94+ reds_link_free(link);
95+
96+end:
97+ g_free(password);
98 }
99
100 static inline void async_read_clear_handlers(AsyncRead *obj)
diff --git a/recipes-support/spice/spice_git.bb b/recipes-support/spice/spice_git.bb
deleted file mode 100644
index 44e7ce1..0000000
--- a/recipes-support/spice/spice_git.bb
+++ /dev/null
@@ -1,79 +0,0 @@
1#
2# Copyright (C) 2013 Wind River Systems, Inc.
3#
4
5SUMMARY = "Simple Protocol for Independent Computing Environments"
6DESCRIPTION = "SPICE (the Simple Protocol for Independent Computing \
7Environments) is a remote-display system built for virtual \
8environments which allows users to view a computing 'desktop' \
9environment - not only on its computer-server machine, but also from \
10anywhere on the Internet and using a wide variety of machine \
11architectures."
12
13LICENSE = "BSD & LGPL-2.1-or-later"
14LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"
15
16PR = "r0"
17PV = "0.12.4"
18
19# Actual versions based on the checkouts below
20# spice = "0.12.4"
21# common = "0.12.6"
22# protocol = "0.12.6"
23SRCREV_spice = "b270fb010a3ddb432dfe6b15e4bdffa6ac086cd0"
24SRCREV_spice-common = "fe93908238196bd632287fc9875e6f2e11105d04"
25SRCREV_spice-protocol = "784407f248e7f99d2bfcc9368f9acd1efb2b9617"
26
27SRCREV_FORMAT = "spice_spice-common_spice-protocol"
28
29SRC_URI = "git://anongit.freedesktop.org/spice/spice;name=spice;branch=master \
30 git://anongit.freedesktop.org/spice/spice-common;destsuffix=git/spice-common;name=spice-common;branch=master \
31 git://anongit.freedesktop.org/spice/spice-protocol;destsuffix=git/spice-common/spice-protocol;name=spice-protocol;branch=master \
32 "
33
34SRC_URI += " \
35 file://spice-fix-CVE-2013-4282.patch \
36 file://configure.ac-add-subdir-objects-to-AM_INIT_AUTOMAKE.patch \
37 file://build-allow-separated-src-and-build-dirs.patch \
38 file://0001-red_parse_qxl-Fix-BITMAP_FMT_IS_RGB-defined-but-not-.patch \
39 file://0001-Use-PRI-macros-in-printf-to-keep-compatibility-betwe.patch \
40 file://Fix-build-issues-with-gcc-7.patch \
41 file://CVE-2017-7506-1.patch \
42 file://CVE-2017-7506-2.patch \
43 file://CVE-2017-7506-3.patch \
44 "
45
46S = "${WORKDIR}/git"
47
48inherit autotools gettext python3native python3-dir pkgconfig
49
50DEPENDS += "python3-native celt051 python3-pyparsing jpeg pixman alsa-lib glib-2.0"
51
52export PYTHON="${STAGING_BINDIR_NATIVE}/python-native/python"
53export PYTHONPATH="${PKG_CONFIG_SYSROOT_DIR}${libdir}/python${PYTHON_BASEVERSION}/site-packages"
54
55PACKAGECONFIG ?= "sasl"
56
57PACKAGECONFIG[smartcard] = "--enable-smartcard,--disable-smartcard,libcacard,"
58PACKAGECONFIG[sasl] = "--with-sasl,--without-sasl,cyrus-sasl,"
59PACKAGECONFIG[client] = "--enable-client,--disable-client,,"
60PACKAGECONFIG[gui] = "--enable-gui,--disable-gui,,"
61PACKAGECONFIG[opengl] = "--enable-opengl,--disable-opengl,,"
62PACKAGECONFIG[xinerama] = "--enable-xinerama,--disable-xinerama,libxinerama,"
63
64PACKAGES =+ "${PN}-protocol"
65LICENSE:${PN}-protocol = "BSD"
66FILES:${PN}-protocol += "${includedir}/spice-1"
67FILES:${PN}-protocol += "${datadir}/pkgconfig"
68
69do_configure:prepend() {
70 mkdir -p ${S}/spice-common/spice-protocol/m4
71}
72
73do_install:append() {
74 cd ${B}/spice-common/spice-protocol
75 oe_runmake DESTDIR="${D}" install
76 cd -
77}
78
79COMPATIBLE_HOST = '(x86_64|i.86).*-linux'