diff options
author | Bruce Ashfield <bruce.ashfield@gmail.com> | 2024-10-12 01:40:06 +0000 |
---|---|---|
committer | Bruce Ashfield <bruce.ashfield@gmail.com> | 2024-10-12 01:40:06 +0000 |
commit | 12538d64862366eb365ed5f8a67fbb082bae1620 (patch) | |
tree | b8c84a351545aafe56e861d63c7f30bf0488db3e | |
parent | a35cc3d3aac992362f77d7ed0bbedf473a9aab13 (diff) | |
download | meta-cloud-services-12538d64862366eb365ed5f8a67fbb082bae1620.tar.gz |
spice: remove recipe
meta-oe has a more updated version.
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
10 files changed, 0 insertions, 602 deletions
diff --git a/recipes-support/spice/files/0001-Use-PRI-macros-in-printf-to-keep-compatibility-betwe.patch b/recipes-support/spice/files/0001-Use-PRI-macros-in-printf-to-keep-compatibility-betwe.patch deleted file mode 100644 index 18fa8fa..0000000 --- a/recipes-support/spice/files/0001-Use-PRI-macros-in-printf-to-keep-compatibility-betwe.patch +++ /dev/null | |||
@@ -1,72 +0,0 @@ | |||
1 | From 3cb746329ea4846bd9c65e0198e69423379b6f62 Mon Sep 17 00:00:00 2001 | ||
2 | From: =?UTF-8?q?=EC=86=8C=EB=B3=91=EC=B2=A0?= <byungchul.so@samsung.com> | ||
3 | Date: Thu, 24 Apr 2014 12:26:32 +0000 | ||
4 | Subject: [PATCH] Use PRI macros in printf to keep compatibility between | ||
5 | 32/64bit system | ||
6 | |||
7 | gcc's some integer type definitions are different between 32/64bit system. | ||
8 | This causes platform dependency problem with printf function. However, | ||
9 | we can avoid this problem by using PRI macros that supports platform | ||
10 | independent printf. | ||
11 | --- | ||
12 | server/mjpeg_encoder.c | 7 ++++--- | ||
13 | server/red_worker.c | 4 ++-- | ||
14 | 2 files changed, 6 insertions(+), 5 deletions(-) | ||
15 | |||
16 | diff --git a/server/mjpeg_encoder.c b/server/mjpeg_encoder.c | ||
17 | index aea4964..f465d88 100644 | ||
18 | --- a/server/mjpeg_encoder.c | ||
19 | +++ b/server/mjpeg_encoder.c | ||
20 | @@ -23,6 +23,7 @@ | ||
21 | #include "mjpeg_encoder.h" | ||
22 | #include <jerror.h> | ||
23 | #include <jpeglib.h> | ||
24 | +#include <inttypes.h> | ||
25 | |||
26 | #define MJPEG_MAX_FPS 25 | ||
27 | #define MJPEG_MIN_FPS 1 | ||
28 | @@ -66,7 +67,7 @@ static const int mjpeg_quality_samples[MJPEG_QUALITY_SAMPLE_NUM] = {20, 30, 40, | ||
29 | * are not necessarily related to mis-estimation of the bit rate, and we would | ||
30 | * like to wait till the stream stabilizes. | ||
31 | */ | ||
32 | -#define MJPEG_WARMUP_TIME 3000L // 3 sec | ||
33 | +#define MJPEG_WARMUP_TIME 3000LL // 3 sec | ||
34 | |||
35 | enum { | ||
36 | MJPEG_QUALITY_EVAL_TYPE_SET, | ||
37 | @@ -638,7 +639,7 @@ static void mjpeg_encoder_adjust_params_to_bit_rate(MJpegEncoder *encoder) | ||
38 | |||
39 | spice_debug("cur-fps=%u new-fps=%u (new/old=%.2f) |" | ||
40 | "bit-rate=%.2f (Mbps) latency=%u (ms) quality=%d |" | ||
41 | - " new-size-avg %lu , base-size %lu, (new/old=%.2f) ", | ||
42 | + " new-size-avg %"PRIu64" , base-size %"PRIu64", (new/old=%.2f) ", | ||
43 | rate_control->fps, new_fps, ((double)new_fps)/rate_control->fps, | ||
44 | ((double)rate_control->byte_rate*8)/1024/1024, | ||
45 | latency, | ||
46 | @@ -703,7 +704,7 @@ static void mjpeg_encoder_adjust_fps(MJpegEncoder *encoder, uint64_t now) | ||
47 | |||
48 | avg_fps = ((double)rate_control->adjusted_fps_num_frames*1000) / | ||
49 | adjusted_fps_time_passed; | ||
50 | - spice_debug("#frames-adjust=%lu #adjust-time=%lu avg-fps=%.2f", | ||
51 | + spice_debug("#frames-adjust=%"PRIu64" #adjust-time=%"PRIu64" avg-fps=%.2f", | ||
52 | rate_control->adjusted_fps_num_frames, adjusted_fps_time_passed, avg_fps); | ||
53 | spice_debug("defined=%u old-adjusted=%.2f", rate_control->fps, rate_control->adjusted_fps); | ||
54 | fps_ratio = avg_fps / rate_control->fps; | ||
55 | diff --git a/server/red_worker.c b/server/red_worker.c | ||
56 | index 619f7bc..1871e13 100644 | ||
57 | --- a/server/red_worker.c | ||
58 | +++ b/server/red_worker.c | ||
59 | @@ -2594,8 +2594,8 @@ static void red_print_stream_stats(DisplayChannelClient *dcc, StreamAgent *agent | ||
60 | mjpeg_encoder_get_stats(agent->mjpeg_encoder, &encoder_stats); | ||
61 | } | ||
62 | |||
63 | - spice_debug("stream=%ld dim=(%dx%d) #in-frames=%lu #in-avg-fps=%.2f #out-frames=%lu " | ||
64 | - "out/in=%.2f #drops=%lu (#pipe=%lu #fps=%lu) out-avg-fps=%.2f " | ||
65 | + spice_debug("stream=%"PRIdPTR" dim=(%dx%d) #in-frames=%"PRIu64" #in-avg-fps=%.2f #out-frames=%"PRIu64" " | ||
66 | + "out/in=%.2f #drops=%"PRIu64" (#pipe=%"PRIu64" #fps=%"PRIu64") out-avg-fps=%.2f " | ||
67 | "passed-mm-time(sec)=%.2f size-total(MB)=%.2f size-per-sec(Mbps)=%.2f " | ||
68 | "size-per-frame(KBpf)=%.2f avg-quality=%.2f " | ||
69 | "start-bit-rate(Mbps)=%.2f end-bit-rate(Mbps)=%.2f", | ||
70 | -- | ||
71 | 2.10.2 | ||
72 | |||
diff --git a/recipes-support/spice/files/0001-red_parse_qxl-Fix-BITMAP_FMT_IS_RGB-defined-but-not-.patch b/recipes-support/spice/files/0001-red_parse_qxl-Fix-BITMAP_FMT_IS_RGB-defined-but-not-.patch deleted file mode 100644 index ccae5f5..0000000 --- a/recipes-support/spice/files/0001-red_parse_qxl-Fix-BITMAP_FMT_IS_RGB-defined-but-not-.patch +++ /dev/null | |||
@@ -1,29 +0,0 @@ | |||
1 | From 85838d4c9f2322aedb99b38fffd7da95a494d8ed Mon Sep 17 00:00:00 2001 | ||
2 | From: He Zhe <zhe.he@windriver.com> | ||
3 | Date: Thu, 29 Jun 2017 08:26:35 +0000 | ||
4 | Subject: [PATCH] red_parse_qxl: Fix BITMAP_FMT_IS_RGB defined but not used | ||
5 | |||
6 | | ../../git/server/red_parse_qxl.c:367:18: error: 'BITMAP_FMT_IS_RGB' | ||
7 | defined but not used [-Werror=unused-const-variable=] | ||
8 | | static const int BITMAP_FMT_IS_RGB[] = {0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1}; | ||
9 | |||
10 | Signed-off-by: He Zhe <zhe.he@windriver.com> | ||
11 | --- | ||
12 | server/red_parse_qxl.c | 1 - | ||
13 | 1 file changed, 1 deletion(-) | ||
14 | |||
15 | diff --git a/server/red_parse_qxl.c b/server/red_parse_qxl.c | ||
16 | index 6c0b0658..cfc2da95 100644 | ||
17 | --- a/server/red_parse_qxl.c | ||
18 | +++ b/server/red_parse_qxl.c | ||
19 | @@ -364,7 +364,6 @@ static int bitmap_consistent(SpiceBitmap *bitmap) | ||
20 | |||
21 | // This is based on SPICE_BITMAP_FMT_*, copied from server/red_worker.c | ||
22 | // to avoid a possible unoptimization from making it non static. | ||
23 | -static const int BITMAP_FMT_IS_RGB[] = {0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1}; | ||
24 | |||
25 | static SpiceImage *red_get_image(RedMemSlotInfo *slots, int group_id, | ||
26 | QXLPHYSICAL addr, uint32_t flags, int is_mask) | ||
27 | -- | ||
28 | 2.11.0 | ||
29 | |||
diff --git a/recipes-support/spice/files/CVE-2017-7506-1.patch b/recipes-support/spice/files/CVE-2017-7506-1.patch deleted file mode 100644 index 1975aca..0000000 --- a/recipes-support/spice/files/CVE-2017-7506-1.patch +++ /dev/null | |||
@@ -1,81 +0,0 @@ | |||
1 | From 2e521a9db27e1ed31bf5fbed437208bf7f1c77a1 Mon Sep 17 00:00:00 2001 | ||
2 | From: Frediano Ziglio <fziglio@redhat.com> | ||
3 | Date: Mon, 15 May 2017 15:57:28 +0100 | ||
4 | Subject: [PATCH 1/3] reds: Disconnect when receiving overly big | ||
5 | ClientMonitorsConfig | ||
6 | |||
7 | Total message size received from the client was unlimited. There is | ||
8 | a 2kiB size check on individual agent messages, but the MonitorsConfig | ||
9 | message can be split in multiple chunks, and the size of the | ||
10 | non-chunked MonitorsConfig message was never checked. This could easily | ||
11 | lead to memory exhaustion on the host. | ||
12 | |||
13 | Signed-off-by: Frediano Ziglio <fziglio@redhat.com> | ||
14 | |||
15 | Upstream-Status: Backport | ||
16 | [https://cgit.freedesktop.org/spice/spice/commit/?h=0.12&id=f1e7ec03e26ab6b8ca9b7ec060846a5b706a963d] | ||
17 | |||
18 | CVE: CVE-2017-7506 | ||
19 | |||
20 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> | ||
21 | --- | ||
22 | server/reds.c | 25 +++++++++++++++++++++++-- | ||
23 | 1 file changed, 23 insertions(+), 2 deletions(-) | ||
24 | |||
25 | diff --git a/server/reds.c b/server/reds.c | ||
26 | index 30d0652..701d5d8 100644 | ||
27 | --- a/server/reds.c | ||
28 | +++ b/server/reds.c | ||
29 | @@ -1086,19 +1086,34 @@ static void reds_client_monitors_config_cleanup(void) | ||
30 | static void reds_on_main_agent_monitors_config( | ||
31 | MainChannelClient *mcc, void *message, size_t size) | ||
32 | { | ||
33 | + const unsigned int MAX_MONITORS = 256; | ||
34 | + const unsigned int MAX_MONITOR_CONFIG_SIZE = | ||
35 | + sizeof(VDAgentMonitorsConfig) + MAX_MONITORS * sizeof(VDAgentMonConfig); | ||
36 | + | ||
37 | VDAgentMessage *msg_header; | ||
38 | VDAgentMonitorsConfig *monitors_config; | ||
39 | RedsClientMonitorsConfig *cmc = &reds->client_monitors_config; | ||
40 | |||
41 | + // limit size of message sent by the client as this can cause a DoS through | ||
42 | + // memory exhaustion, or potentially some integer overflows | ||
43 | + if (sizeof(VDAgentMessage) + MAX_MONITOR_CONFIG_SIZE - cmc->buffer_size < size) { | ||
44 | + goto overflow; | ||
45 | + } | ||
46 | cmc->buffer_size += size; | ||
47 | cmc->buffer = realloc(cmc->buffer, cmc->buffer_size); | ||
48 | spice_assert(cmc->buffer); | ||
49 | cmc->mcc = mcc; | ||
50 | memcpy(cmc->buffer + cmc->buffer_pos, message, size); | ||
51 | cmc->buffer_pos += size; | ||
52 | + if (sizeof(VDAgentMessage) > cmc->buffer_size) { | ||
53 | + spice_debug("not enough data yet. %d", cmc->buffer_size); | ||
54 | + return; | ||
55 | + } | ||
56 | msg_header = (VDAgentMessage *)cmc->buffer; | ||
57 | - if (sizeof(VDAgentMessage) > cmc->buffer_size || | ||
58 | - msg_header->size > cmc->buffer_size - sizeof(VDAgentMessage)) { | ||
59 | + if (msg_header->size > MAX_MONITOR_CONFIG_SIZE) { | ||
60 | + goto overflow; | ||
61 | + } | ||
62 | + if (msg_header->size > cmc->buffer_size - sizeof(VDAgentMessage)) { | ||
63 | spice_debug("not enough data yet. %d\n", cmc->buffer_size); | ||
64 | return; | ||
65 | } | ||
66 | @@ -1106,6 +1121,12 @@ static void reds_on_main_agent_monitors_config( | ||
67 | spice_debug("%s: %d\n", __func__, monitors_config->num_of_monitors); | ||
68 | red_dispatcher_client_monitors_config(monitors_config); | ||
69 | reds_client_monitors_config_cleanup(); | ||
70 | + return; | ||
71 | + | ||
72 | +overflow: | ||
73 | + spice_warning("received invalid MonitorsConfig request from client, disconnecting"); | ||
74 | + red_channel_client_disconnect(main_channel_client_get_base(mcc)); | ||
75 | + reds_client_monitors_config_cleanup(); | ||
76 | } | ||
77 | |||
78 | void reds_on_main_agent_data(MainChannelClient *mcc, void *message, size_t size) | ||
79 | -- | ||
80 | 2.7.4 | ||
81 | |||
diff --git a/recipes-support/spice/files/CVE-2017-7506-2.patch b/recipes-support/spice/files/CVE-2017-7506-2.patch deleted file mode 100644 index a517b08..0000000 --- a/recipes-support/spice/files/CVE-2017-7506-2.patch +++ /dev/null | |||
@@ -1,37 +0,0 @@ | |||
1 | From 6934f036240753a14514a71ede8bb44af2043f24 Mon Sep 17 00:00:00 2001 | ||
2 | From: Frediano Ziglio <fziglio@redhat.com> | ||
3 | Date: Mon, 15 May 2017 15:57:28 +0100 | ||
4 | Subject: [PATCH 2/3] reds: Avoid integer overflows handling monitor | ||
5 | configuration | ||
6 | |||
7 | Avoid VDAgentMessage::size integer overflows. | ||
8 | |||
9 | Signed-off-by: Frediano Ziglio <fziglio@redhat.com> | ||
10 | |||
11 | Upstream-Status: Backport | ||
12 | [https://cgit.freedesktop.org/spice/spice/commit/?h=0.12&id=ec6229c79abe05d731953df5f7e9a05ec9f6df79] | ||
13 | |||
14 | CVE: CVE-2017-7506 | ||
15 | |||
16 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> | ||
17 | --- | ||
18 | server/reds.c | 3 +++ | ||
19 | 1 file changed, 3 insertions(+) | ||
20 | |||
21 | diff --git a/server/reds.c b/server/reds.c | ||
22 | index 701d5d8..62b1164 100644 | ||
23 | --- a/server/reds.c | ||
24 | +++ b/server/reds.c | ||
25 | @@ -1117,6 +1117,9 @@ static void reds_on_main_agent_monitors_config( | ||
26 | spice_debug("not enough data yet. %d\n", cmc->buffer_size); | ||
27 | return; | ||
28 | } | ||
29 | + if (msg_header->size < sizeof(VDAgentMonitorsConfig)) { | ||
30 | + goto overflow; | ||
31 | + } | ||
32 | monitors_config = (VDAgentMonitorsConfig *)(cmc->buffer + sizeof(*msg_header)); | ||
33 | spice_debug("%s: %d\n", __func__, monitors_config->num_of_monitors); | ||
34 | red_dispatcher_client_monitors_config(monitors_config); | ||
35 | -- | ||
36 | 2.7.4 | ||
37 | |||
diff --git a/recipes-support/spice/files/CVE-2017-7506-3.patch b/recipes-support/spice/files/CVE-2017-7506-3.patch deleted file mode 100644 index d55502f..0000000 --- a/recipes-support/spice/files/CVE-2017-7506-3.patch +++ /dev/null | |||
@@ -1,54 +0,0 @@ | |||
1 | From daedc2e2bb70f7cb0eafd65fd37fd73af12df770 Mon Sep 17 00:00:00 2001 | ||
2 | From: Frediano Ziglio <fziglio@redhat.com> | ||
3 | Date: Mon, 15 May 2017 15:57:28 +0100 | ||
4 | Subject: [PATCH 3/3] reds: Avoid buffer overflows handling monitor | ||
5 | configuration | ||
6 | |||
7 | It was also possible for a malicious client to set | ||
8 | VDAgentMonitorsConfig::num_of_monitors to a number larger | ||
9 | than the actual size of VDAgentMOnitorsConfig::monitors. | ||
10 | This would lead to buffer overflows, which could allow the guest to | ||
11 | read part of the host memory. This might cause write overflows in the | ||
12 | host as well, but controlling the content of such buffers seems | ||
13 | complicated. | ||
14 | |||
15 | Signed-off-by: Frediano Ziglio <fziglio@redhat.com> | ||
16 | |||
17 | Upstream-Status: Backport | ||
18 | [https://cgit.freedesktop.org/spice/spice/commit/?h=0.12&id=a957a90baf2c62d31f3547e56bba7d0e812d2331] | ||
19 | |||
20 | CVE: CVE-2017-7506 | ||
21 | |||
22 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> | ||
23 | --- | ||
24 | server/reds.c | 7 +++++++ | ||
25 | 1 file changed, 7 insertions(+) | ||
26 | |||
27 | diff --git a/server/reds.c b/server/reds.c | ||
28 | index 62b1164..ee36dec 100644 | ||
29 | --- a/server/reds.c | ||
30 | +++ b/server/reds.c | ||
31 | @@ -1093,6 +1093,7 @@ static void reds_on_main_agent_monitors_config( | ||
32 | VDAgentMessage *msg_header; | ||
33 | VDAgentMonitorsConfig *monitors_config; | ||
34 | RedsClientMonitorsConfig *cmc = &reds->client_monitors_config; | ||
35 | + uint32_t max_monitors; | ||
36 | |||
37 | // limit size of message sent by the client as this can cause a DoS through | ||
38 | // memory exhaustion, or potentially some integer overflows | ||
39 | @@ -1121,6 +1122,12 @@ static void reds_on_main_agent_monitors_config( | ||
40 | goto overflow; | ||
41 | } | ||
42 | monitors_config = (VDAgentMonitorsConfig *)(cmc->buffer + sizeof(*msg_header)); | ||
43 | + // limit the monitor number to avoid buffer overflows | ||
44 | + max_monitors = (msg_header->size - sizeof(VDAgentMonitorsConfig)) / | ||
45 | + sizeof(VDAgentMonConfig); | ||
46 | + if (monitors_config->num_of_monitors > max_monitors) { | ||
47 | + goto overflow; | ||
48 | + } | ||
49 | spice_debug("%s: %d\n", __func__, monitors_config->num_of_monitors); | ||
50 | red_dispatcher_client_monitors_config(monitors_config); | ||
51 | reds_client_monitors_config_cleanup(); | ||
52 | -- | ||
53 | 2.7.4 | ||
54 | |||
diff --git a/recipes-support/spice/files/Fix-build-issues-with-gcc-7.patch b/recipes-support/spice/files/Fix-build-issues-with-gcc-7.patch deleted file mode 100644 index 7fcafdc..0000000 --- a/recipes-support/spice/files/Fix-build-issues-with-gcc-7.patch +++ /dev/null | |||
@@ -1,59 +0,0 @@ | |||
1 | From 9f001b6818ac4baa1df010ccf4200ca56bfb11b2 Mon Sep 17 00:00:00 2001 | ||
2 | From: Mark Asselstine <mark.asselstine@windriver.com> | ||
3 | Date: Wed, 23 Aug 2017 13:47:29 -0400 | ||
4 | Subject: [PATCH] Fix build issues with gcc 7 | ||
5 | |||
6 | gcc 7 checks for when a switch statement doesn't break between | ||
7 | cases. When a break is not found you will see | ||
8 | |||
9 | | ../../git/server/reds.c: In function 'vdi_port_read_one_msg_from_device': | ||
10 | | ../../git/server/reds.c:797:31: error: this statement may fall through [-Werror=implicit-fallthrough=] | ||
11 | | state->read_state = VDI_PORT_READ_STATE_GET_BUFF; | ||
12 | | ~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||
13 | | ../../git/server/reds.c:798:9: note: here | ||
14 | | case VDI_PORT_READ_STATE_GET_BUFF: { | ||
15 | | ^~~~ | ||
16 | |||
17 | The 'fallthrough' comment will let gcc know this is done on purpose. | ||
18 | |||
19 | Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com> | ||
20 | --- | ||
21 | server/inputs_channel.c | 1 + | ||
22 | server/reds.c | 2 ++ | ||
23 | 2 files changed, 3 insertions(+) | ||
24 | |||
25 | diff --git a/server/inputs_channel.c b/server/inputs_channel.c | ||
26 | index 931dac1..534ab66 100644 | ||
27 | --- a/server/inputs_channel.c | ||
28 | +++ b/server/inputs_channel.c | ||
29 | @@ -321,6 +321,7 @@ static int inputs_channel_handle_parsed(RedChannelClient *rcc, uint32_t size, ui | ||
30 | activate_modifiers_watch(); | ||
31 | } | ||
32 | } | ||
33 | + /* fallthrough */ | ||
34 | case SPICE_MSGC_INPUTS_KEY_UP: { | ||
35 | SpiceMsgcKeyDown *key_down = (SpiceMsgcKeyDown *)buf; | ||
36 | for (i = 0; i < 4; i++) { | ||
37 | diff --git a/server/reds.c b/server/reds.c | ||
38 | index 30d0652..8c80eb6 100644 | ||
39 | --- a/server/reds.c | ||
40 | +++ b/server/reds.c | ||
41 | @@ -795,6 +795,7 @@ static SpiceCharDeviceMsgToClient *vdi_port_read_one_msg_from_device(SpiceCharDe | ||
42 | } | ||
43 | state->message_recive_len = state->vdi_chunk_header.size; | ||
44 | state->read_state = VDI_PORT_READ_STATE_GET_BUFF; | ||
45 | + /* fallthrough */ | ||
46 | case VDI_PORT_READ_STATE_GET_BUFF: { | ||
47 | if (!(state->current_read_buf = vdi_port_read_buf_get())) { | ||
48 | return NULL; | ||
49 | @@ -806,6 +807,7 @@ static SpiceCharDeviceMsgToClient *vdi_port_read_one_msg_from_device(SpiceCharDe | ||
50 | state->message_recive_len -= state->recive_len; | ||
51 | state->read_state = VDI_PORT_READ_STATE_READ_DATA; | ||
52 | } | ||
53 | + /* fallthrough */ | ||
54 | case VDI_PORT_READ_STATE_READ_DATA: | ||
55 | n = sif->read(vdagent, state->recive_pos, state->recive_len); | ||
56 | if (!n) { | ||
57 | -- | ||
58 | 2.7.4 | ||
59 | |||
diff --git a/recipes-support/spice/files/build-allow-separated-src-and-build-dirs.patch b/recipes-support/spice/files/build-allow-separated-src-and-build-dirs.patch deleted file mode 100644 index 9cbbff9..0000000 --- a/recipes-support/spice/files/build-allow-separated-src-and-build-dirs.patch +++ /dev/null | |||
@@ -1,62 +0,0 @@ | |||
1 | From 7d0d0ff080b159e647ebb26c337cb75314d64b52 Mon Sep 17 00:00:00 2001 | ||
2 | From: Mark Asselstine <mark.asselstine@windriver.com> | ||
3 | Date: Thu, 1 May 2014 12:09:16 -0400 | ||
4 | Subject: [PATCH] build: allow separated src and build dirs | ||
5 | |||
6 | We need to expland the list of include dirs to include the build dir since | ||
7 | generated files will be created there instead of in the src dir. | ||
8 | |||
9 | We also don't want to force using $srcdir for generated files as this will | ||
10 | allow them to be created in the build dir. We account for the slight | ||
11 | deviation in the generated files with expanded include paths. | ||
12 | |||
13 | Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com> | ||
14 | --- | ||
15 | configure.ac | 2 +- | ||
16 | spice-common/common/Makefile.am | 14 +++++++------- | ||
17 | 2 file changed, 8 insertions(+), 8 deletions(-) | ||
18 | |||
19 | diff --git a/configure.ac b/configure.ac | ||
20 | index edda8e9..9151fcb 100644 | ||
21 | --- a/configure.ac | ||
22 | +++ b/configure.ac | ||
23 | @@ -165,7 +165,7 @@ dnl ========================================================================= | ||
24 | dnl Check deps | ||
25 | |||
26 | AC_CONFIG_SUBDIRS([spice-common]) | ||
27 | -COMMON_CFLAGS='-I ${top_srcdir}/spice-common/ -I ${top_srcdir}/spice-common/spice-protocol/' | ||
28 | +COMMON_CFLAGS='-I ${top_srcdir}/spice-common/ -I ${top_srcdir}/spice-common/common/ -I ${top_srcdir}/spice-common/spice-protocol/ -I ${top_builddir}/spice-common/' | ||
29 | AC_SUBST(COMMON_CFLAGS) | ||
30 | |||
31 | AC_CHECK_LIBM | ||
32 | diff --git a/spice-common/common/Makefile.am b/spice-common/common/Makefile.am | ||
33 | index 45568c6..4c65ac4 100644 | ||
34 | --- a/spice-common/common/Makefile.am | ||
35 | +++ b/spice-common/common/Makefile.am | ||
36 | @@ -2,16 +2,16 @@ NULL = | ||
37 | |||
38 | # Avoid need for python(pyparsing) by end users | ||
39 | CLIENT_MARSHALLERS = \ | ||
40 | - $(srcdir)/generated_client_demarshallers.c \ | ||
41 | - $(srcdir)/generated_client_demarshallers1.c \ | ||
42 | - $(srcdir)/generated_client_marshallers.c \ | ||
43 | - $(srcdir)/generated_client_marshallers1.c \ | ||
44 | + generated_client_demarshallers.c \ | ||
45 | + generated_client_demarshallers1.c \ | ||
46 | + generated_client_marshallers.c \ | ||
47 | + generated_client_marshallers1.c \ | ||
48 | $(NULL) | ||
49 | |||
50 | SERVER_MARSHALLERS = \ | ||
51 | - $(srcdir)/generated_server_demarshallers.c \ | ||
52 | - $(srcdir)/generated_server_marshallers.c \ | ||
53 | - $(srcdir)/generated_server_marshallers.h \ | ||
54 | + generated_server_demarshallers.c \ | ||
55 | + generated_server_marshallers.c \ | ||
56 | + generated_server_marshallers.h \ | ||
57 | $(NULL) | ||
58 | |||
59 | BUILT_SOURCES = $(CLIENT_MARSHALLERS) $(SERVER_MARSHALLERS) $(top_srcdir)/spice-protocol/spice/enums.h | ||
60 | -- | ||
61 | 1.8.3.2 | ||
62 | |||
diff --git a/recipes-support/spice/files/configure.ac-add-subdir-objects-to-AM_INIT_AUTOMAKE.patch b/recipes-support/spice/files/configure.ac-add-subdir-objects-to-AM_INIT_AUTOMAKE.patch deleted file mode 100644 index 323ef52..0000000 --- a/recipes-support/spice/files/configure.ac-add-subdir-objects-to-AM_INIT_AUTOMAKE.patch +++ /dev/null | |||
@@ -1,29 +0,0 @@ | |||
1 | From 36efb79076420975f7fa7aa0b03a1fc282291b05 Mon Sep 17 00:00:00 2001 | ||
2 | From: Mark Asselstine <mark.asselstine@windriver.com> | ||
3 | Date: Tue, 25 Mar 2014 15:23:25 -0400 | ||
4 | Subject: [PATCH] configure.ac: add subdir-objects to AM_INIT_AUTOMAKE | ||
5 | |||
6 | Without this you will get subdir-objects error which will cause | ||
7 | autoreconf to complete successfully. | ||
8 | |||
9 | Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com> | ||
10 | --- | ||
11 | spice-common/configure.ac | 2 +- | ||
12 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
13 | |||
14 | diff --git a/spice-common/configure.ac b/spice-common/configure.ac | ||
15 | index b5cb960..78f1360 100644 | ||
16 | --- a/spice-common/configure.ac | ||
17 | +++ b/spice-common/configure.ac | ||
18 | @@ -13,7 +13,7 @@ AC_CONFIG_AUX_DIR([build-aux]) | ||
19 | m4_ifdef([AM_PROG_AR], [AM_PROG_AR]) | ||
20 | |||
21 | # Checks for programs | ||
22 | -AM_INIT_AUTOMAKE([1.11 dist-xz no-dist-gzip tar-ustar foreign -Wall -Werror]) | ||
23 | +AM_INIT_AUTOMAKE([1.11 dist-xz no-dist-gzip tar-ustar foreign subdir-objects -Wall -Werror]) | ||
24 | AM_MAINTAINER_MODE | ||
25 | AM_SILENT_RULES([yes]) | ||
26 | LT_INIT | ||
27 | -- | ||
28 | 1.8.3.2 | ||
29 | |||
diff --git a/recipes-support/spice/files/spice-fix-CVE-2013-4282.patch b/recipes-support/spice/files/spice-fix-CVE-2013-4282.patch deleted file mode 100644 index 1a00a85..0000000 --- a/recipes-support/spice/files/spice-fix-CVE-2013-4282.patch +++ /dev/null | |||
@@ -1,100 +0,0 @@ | |||
1 | Fix buffer overflow when decrypting client SPICE ticket | ||
2 | |||
3 | commit 8af619009660b24e0b41ad26b30289eea288fcc2 upstream | ||
4 | |||
5 | reds_handle_ticket uses a fixed size 'password' buffer for the decrypted | ||
6 | password whose size is SPICE_MAX_PASSWORD_LENGTH. However, | ||
7 | RSA_private_decrypt which we call for the decryption expects the | ||
8 | destination buffer to be at least RSA_size(link->tiTicketing.rsa) | ||
9 | bytes long. On my spice-server build, SPICE_MAX_PASSWORD_LENGTH | ||
10 | is 60 while RSA_size() is 128, so we end up overflowing 'password' | ||
11 | when using long passwords (this was reproduced using the string: | ||
12 | 'fullscreen=1proxy=#enter proxy here; e.g spice_proxy = http://[proxy]:[port]' | ||
13 | as a password). | ||
14 | |||
15 | When the overflow occurs, QEMU dies with: | ||
16 | *** stack smashing detected ***: qemu-system-x86_64 terminated | ||
17 | |||
18 | This commit ensures we use a corectly sized 'password' buffer, | ||
19 | and that it's correctly nul-terminated so that we can use strcmp | ||
20 | instead of strncmp. To keep using strncmp, we'd need to figure out | ||
21 | which one of 'password' and 'taTicket.password' is the smaller buffer, | ||
22 | and use that size. | ||
23 | |||
24 | This fixes rhbz#999839 | ||
25 | diff --git a/server/reds.c b/server/reds.c | ||
26 | index 30d0652..6f262b0 100644 | ||
27 | --- a/server/reds.c | ||
28 | +++ b/server/reds.c | ||
29 | @@ -1931,39 +1931,59 @@ static void reds_handle_link(RedLinkInfo *link) | ||
30 | static void reds_handle_ticket(void *opaque) | ||
31 | { | ||
32 | RedLinkInfo *link = (RedLinkInfo *)opaque; | ||
33 | - char password[SPICE_MAX_PASSWORD_LENGTH]; | ||
34 | + char *password; | ||
35 | time_t ltime; | ||
36 | + int password_size; | ||
37 | |||
38 | //todo: use monotonic time | ||
39 | time(<ime); | ||
40 | - RSA_private_decrypt(link->tiTicketing.rsa_size, | ||
41 | - link->tiTicketing.encrypted_ticket.encrypted_data, | ||
42 | - (unsigned char *)password, link->tiTicketing.rsa, RSA_PKCS1_OAEP_PADDING); | ||
43 | + if (RSA_size(link->tiTicketing.rsa) < SPICE_MAX_PASSWORD_LENGTH) { | ||
44 | + spice_warning("RSA modulus size is smaller than SPICE_MAX_PASSWORD_LENGTH (%d < %d), " | ||
45 | + "SPICE ticket sent from client may be truncated", | ||
46 | + RSA_size(link->tiTicketing.rsa), SPICE_MAX_PASSWORD_LENGTH); | ||
47 | + } | ||
48 | + | ||
49 | + password = g_malloc0(RSA_size(link->tiTicketing.rsa) + 1); | ||
50 | + password_size = RSA_private_decrypt(link->tiTicketing.rsa_size, | ||
51 | + link->tiTicketing.encrypted_ticket.encrypted_data, | ||
52 | + (unsigned char *)password, | ||
53 | + link->tiTicketing.rsa, | ||
54 | + RSA_PKCS1_OAEP_PADDING); | ||
55 | + if (password_size == -1) { | ||
56 | + spice_warning("failed to decrypt RSA encrypted password: %s", | ||
57 | + ERR_error_string(ERR_get_error(), NULL)); | ||
58 | + goto error; | ||
59 | + } | ||
60 | + password[password_size] = '\0'; | ||
61 | |||
62 | if (ticketing_enabled && !link->skip_auth) { | ||
63 | int expired = taTicket.expiration_time < ltime; | ||
64 | |||
65 | if (strlen(taTicket.password) == 0) { | ||
66 | - reds_send_link_result(link, SPICE_LINK_ERR_PERMISSION_DENIED); | ||
67 | spice_warning("Ticketing is enabled, but no password is set. " | ||
68 | - "please set a ticket first"); | ||
69 | - reds_link_free(link); | ||
70 | - return; | ||
71 | + "please set a ticket first"); | ||
72 | + goto error; | ||
73 | } | ||
74 | |||
75 | - if (expired || strncmp(password, taTicket.password, SPICE_MAX_PASSWORD_LENGTH) != 0) { | ||
76 | + if (expired || strcmp(password, taTicket.password) != 0) { | ||
77 | if (expired) { | ||
78 | spice_warning("Ticket has expired"); | ||
79 | } else { | ||
80 | spice_warning("Invalid password"); | ||
81 | } | ||
82 | - reds_send_link_result(link, SPICE_LINK_ERR_PERMISSION_DENIED); | ||
83 | - reds_link_free(link); | ||
84 | - return; | ||
85 | + goto error; | ||
86 | } | ||
87 | } | ||
88 | |||
89 | reds_handle_link(link); | ||
90 | + goto end; | ||
91 | + | ||
92 | +error: | ||
93 | + reds_send_link_result(link, SPICE_LINK_ERR_PERMISSION_DENIED); | ||
94 | + reds_link_free(link); | ||
95 | + | ||
96 | +end: | ||
97 | + g_free(password); | ||
98 | } | ||
99 | |||
100 | static inline void async_read_clear_handlers(AsyncRead *obj) | ||
diff --git a/recipes-support/spice/spice_git.bb b/recipes-support/spice/spice_git.bb deleted file mode 100644 index 44e7ce1..0000000 --- a/recipes-support/spice/spice_git.bb +++ /dev/null | |||
@@ -1,79 +0,0 @@ | |||
1 | # | ||
2 | # Copyright (C) 2013 Wind River Systems, Inc. | ||
3 | # | ||
4 | |||
5 | SUMMARY = "Simple Protocol for Independent Computing Environments" | ||
6 | DESCRIPTION = "SPICE (the Simple Protocol for Independent Computing \ | ||
7 | Environments) is a remote-display system built for virtual \ | ||
8 | environments which allows users to view a computing 'desktop' \ | ||
9 | environment - not only on its computer-server machine, but also from \ | ||
10 | anywhere on the Internet and using a wide variety of machine \ | ||
11 | architectures." | ||
12 | |||
13 | LICENSE = "BSD & LGPL-2.1-or-later" | ||
14 | LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c" | ||
15 | |||
16 | PR = "r0" | ||
17 | PV = "0.12.4" | ||
18 | |||
19 | # Actual versions based on the checkouts below | ||
20 | # spice = "0.12.4" | ||
21 | # common = "0.12.6" | ||
22 | # protocol = "0.12.6" | ||
23 | SRCREV_spice = "b270fb010a3ddb432dfe6b15e4bdffa6ac086cd0" | ||
24 | SRCREV_spice-common = "fe93908238196bd632287fc9875e6f2e11105d04" | ||
25 | SRCREV_spice-protocol = "784407f248e7f99d2bfcc9368f9acd1efb2b9617" | ||
26 | |||
27 | SRCREV_FORMAT = "spice_spice-common_spice-protocol" | ||
28 | |||
29 | SRC_URI = "git://anongit.freedesktop.org/spice/spice;name=spice;branch=master \ | ||
30 | git://anongit.freedesktop.org/spice/spice-common;destsuffix=git/spice-common;name=spice-common;branch=master \ | ||
31 | git://anongit.freedesktop.org/spice/spice-protocol;destsuffix=git/spice-common/spice-protocol;name=spice-protocol;branch=master \ | ||
32 | " | ||
33 | |||
34 | SRC_URI += " \ | ||
35 | file://spice-fix-CVE-2013-4282.patch \ | ||
36 | file://configure.ac-add-subdir-objects-to-AM_INIT_AUTOMAKE.patch \ | ||
37 | file://build-allow-separated-src-and-build-dirs.patch \ | ||
38 | file://0001-red_parse_qxl-Fix-BITMAP_FMT_IS_RGB-defined-but-not-.patch \ | ||
39 | file://0001-Use-PRI-macros-in-printf-to-keep-compatibility-betwe.patch \ | ||
40 | file://Fix-build-issues-with-gcc-7.patch \ | ||
41 | file://CVE-2017-7506-1.patch \ | ||
42 | file://CVE-2017-7506-2.patch \ | ||
43 | file://CVE-2017-7506-3.patch \ | ||
44 | " | ||
45 | |||
46 | S = "${WORKDIR}/git" | ||
47 | |||
48 | inherit autotools gettext python3native python3-dir pkgconfig | ||
49 | |||
50 | DEPENDS += "python3-native celt051 python3-pyparsing jpeg pixman alsa-lib glib-2.0" | ||
51 | |||
52 | export PYTHON="${STAGING_BINDIR_NATIVE}/python-native/python" | ||
53 | export PYTHONPATH="${PKG_CONFIG_SYSROOT_DIR}${libdir}/python${PYTHON_BASEVERSION}/site-packages" | ||
54 | |||
55 | PACKAGECONFIG ?= "sasl" | ||
56 | |||
57 | PACKAGECONFIG[smartcard] = "--enable-smartcard,--disable-smartcard,libcacard," | ||
58 | PACKAGECONFIG[sasl] = "--with-sasl,--without-sasl,cyrus-sasl," | ||
59 | PACKAGECONFIG[client] = "--enable-client,--disable-client,," | ||
60 | PACKAGECONFIG[gui] = "--enable-gui,--disable-gui,," | ||
61 | PACKAGECONFIG[opengl] = "--enable-opengl,--disable-opengl,," | ||
62 | PACKAGECONFIG[xinerama] = "--enable-xinerama,--disable-xinerama,libxinerama," | ||
63 | |||
64 | PACKAGES =+ "${PN}-protocol" | ||
65 | LICENSE:${PN}-protocol = "BSD" | ||
66 | FILES:${PN}-protocol += "${includedir}/spice-1" | ||
67 | FILES:${PN}-protocol += "${datadir}/pkgconfig" | ||
68 | |||
69 | do_configure:prepend() { | ||
70 | mkdir -p ${S}/spice-common/spice-protocol/m4 | ||
71 | } | ||
72 | |||
73 | do_install:append() { | ||
74 | cd ${B}/spice-common/spice-protocol | ||
75 | oe_runmake DESTDIR="${D}" install | ||
76 | cd - | ||
77 | } | ||
78 | |||
79 | COMPATIBLE_HOST = '(x86_64|i.86).*-linux' | ||