summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2016-01-13Update spice-common0.12Christophe Fergeau1-0/+0
This fixes a compilation problem on EL6. git shortlog of the spice-common changes brought in by the submodule update: Christophe Fergeau (2): m4: Fix SPICE_WARNING on el6 test: Use _LDADD rather than _LDFLAGS Frediano Ziglio (1): ring: use NULL instead of 0 for null pointers Lukas Venhoda (9): pixman_utils: Add macros for color byte ordering pixman_utils: Use PIXMAN_LE_ constants in spice_bitmap_try_as_pixman() ppc: Add support for bigendian color byte order ppc: Fix colors on ppc when using QUIC ppc: Fix colors on ppc when using LZ ppc: Fix colors on ppc when using LZ4 ppc: Fix colors on ppc when using jpeg ppc: Fix alpha state checking on BE machines Remove trailing whitespace Pavel Grunt (1): m4: Add macro for --with-sasl Victor Toso (1): Remove headers that are included in spice_common.h
2016-01-13Update NEWS for 0.12.7 releaseChristophe Fergeau1-0/+18
2016-01-13spicevmc: Drop unsent data on client disconnectionChristophe Fergeau1-0/+5
When redirecting a USB webcam over a slow link, it's currently possible to hit an assertion in spice-server by running cheese (application using the webcam), killing the client with ctrl+c and then restarting the client: qemu-kvm: spicevmc.c:324: spicevmc_red_channel_alloc_msg_rcv_buf: Assertion `!state->recv_from_client_buf' failed. This happens when red_peer_handle_incoming tries to allocate memory for a message using spicevmc: handler->msg = handler->cb->alloc_msg_buf(handler->opaque, msg_type, msg_size); red_peer_handle_incoming() is called when there is client data to be read, and does - call alloc_msg_buf() to allocate memory for the message - read the message - if the read was partial, return early, the main loop will call again red_peer_handle_incoming() when there is more data available for that channel - parse the message - call release_msg_buf() to free the message For channels based on spicevmc (usbredir and port), alloc_msg_buf() stores message data in SpiceVmcState::recv_from_client_buf and before allocating new memory, it asserts that it's NULL. This is what causes this crash in the following scenario: - SpiceVmc::alloc_msg_buf() is called and allocates memory for a new message in SpiceVmcState::recv_from_client_buf - red_peer_handle_incoming() returns early as all the spicevmc message data hasn't been received yet - the client gets killed - the main channel notices the disconnect and calls main_dispatcher_client_disconnect() which will disconnect all the channels - SpiceVmc::on_disconnect is called - after the new client connects, SpiceVmc::alloc_msg_buf() is called, notices that SpiceVmcState::recv_from_client_buf is already set, and asserts() This commit makes sure the partial SpiceVmcState::recv_from_client_buf data is cleared on disconnect so that the assert does not trigger. This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1264113
2016-01-13pass proper type to SPICE_CONTAINEROFFrediano Ziglio2-3/+3
In some case the member specified to SPICE_CONTAINEROF was not exactly the same type of the pointer passed. This can cause issues if structure changes so use proper member. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Fabiano Fidêncio <fidencio@redhat.com>
2016-01-13channel: add option tcp keepalive timeout to channelsSunny Shin4-0/+29
2016-01-13server: Fix conversions between QXLPHYSICAL and pointersFrancois Gouget1-45/+48
This avoids compilation errors with -Werror on 32 bit systems as the pointer size differs from that of a QXLPHYSICAL. Signed-off-by: Francois Gouget <fgouget@codeweavers.com>
2016-01-13server: Simplify the next chunk initialization in red_replay_data_chunks()Francois Gouget1-5/+6
Signed-off-by: Francois Gouget <fgouget@codeweavers.com>
2016-01-13server: Fix a pointer to uint64_t cast in spice_replay_next_cmd()Francois Gouget1-1/+1
This avoids a compilation error with -Werror on 32 bit systems as the pointer size differs from that of an uint64_t. Signed-off-by: Francois Gouget <fgouget@codeweavers.com>
2016-01-13server: Use '%zu' to print size_t variablesFrancois Gouget2-6/+6
The size_t definition is different between 32 and 64 bit systems so that neither '%u' nor '%lu' work for both. '%zu' should be used instead. Signed-off-by: Francois Gouget <fgouget@codeweavers.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
2016-01-13server: Use PRI macros in printf for 32/64 bit compatibilityFrancois Gouget3-8/+9
Some integer type definitions are different between 32 and 64 bit systems which causes problems in printf. The PRI macros automatically provide the printf format appropriate for the system. Signed-off-by: Francois Gouget <fgouget@codeweavers.com> Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
2016-01-13spicevmc: set state of DeviceInstance to NULLVictor Toso1-0/+1
After spice_char_device_state_destroy is called spicevmc should not keep reference to that memory. state->chardev_st and sin->st point to the same SpiceCharDeviceState and both should be set to NULL when it is destroyed.
2016-01-13char-device: set to NULL freed pointers on destroyVictor Toso1-0/+2
As SpiceCharDeviceState is only unref'ed on spice_char_device_state_destroy the same device could be destroyed more then once so the pointers that are freed should be set to NULL. Related: https://bugzilla.redhat.com/show_bug.cgi?id=1281455
2016-01-13char-device: free all memory pool when no clientsVictor Toso1-0/+6
When no client is connect we should not need to keep the memory pool used by char-device. In most situations this is not significant but when using webdav this could mean freeing MAX_POOL_SIZE bytes Related: https://bugs.freedesktop.org/show_bug.cgi?id=91350
2016-01-13char-device: Define a memory pool limitVictor Toso1-1/+8
Otherwise the amount of unused memory could grow while transfering big chunks of data. This change only means that once the memory was used it will not be stored again after the limit was reached. Related: https://bugs.freedesktop.org/show_bug.cgi?id=91350
2016-01-13char-device: fix usage of free/unref on WriteBufferVictor Toso1-12/+22
There are places were the could should definetly free the SpiceCharDeviceWriteBuffer and places that it should only unref it. The current use of spice_char_device_write_buffer_free was missleading. This patch creates the spice_char_device_write_buffer_unref and properly call these two functions. Related: https://bugs.freedesktop.org/show_bug.cgi?id=91350
2016-01-13dcc: Don't disconnect channel, when compression is not supportedLukas Venhoda1-2/+2
Don't disconnect the display channel, when unsupported compression is requested from the client. Not changing the compression is enough. https://bugs.freedesktop.org/show_bug.cgi?id=92821 Acked-by: Victor Toso <victortoso@redhat.com> Acked-by: Frediano Ziglio <fziglio@redhat.com>
2016-01-07spicevmc: Return early when instance has no device statePavel Grunt1-0/+5
Same approach as in spice_server_char_device_wakeup(). Avoid segmentation fault when the webdav channel (spice port channel) is used with the vnc display: #0 0x00007ffff7aab734 in spice_char_device_state_opaque_get (dev=0x0) at char_device.c:720 #1 0x00007ffff7b0850c in spice_server_port_event (sin=<optimized out>, event=<optimized out>) at spicevmc.c:578 #2 0x0000555555787ba4 in set_guest_connected (port=<optimized out>, guest_connected=1) at hw/char/virtio-console.c:89 #3 0x0000555555678d7c in control_out (len=<optimized out>, buf=0x55555775c3a0, vser=0x5555578d1540) at /home/pgrunt/RH/qemu/hw/char/virtio-serial-bus.c:404 #4 0x0000555555678d7c in control_out (vdev=0x5555578d1540, vq=0x555557941bc8) at /home/pgrunt/RH/qemu/hw/char/virtio-serial-bus.c:441 #5 0x000055555588eb98 in aio_dispatch (ctx=0x5555562e1a50) at aio-posix.c:160 #6 0x00005555558829ee in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at async.c:226 #7 0x00007ffff2010e3a in g_main_context_dispatch () at /lib64/libglib-2.0.so.0 #8 0x000055555588d8fb in main_loop_wait () at main-loop.c:211 #9 0x000055555588d8fb in main_loop_wait (timeout=<optimized out>) at main-loop.c:256 #10 0x000055555588d8fb in main_loop_wait (nonblocking=<optimized out>) at main-loop.c:504 #11 0x000055555561b664 in main () at vl.c:1891
2016-01-07reds: Do not abort due to wrong headerPavel Grunt1-1/+4
Just prevent the buggy client from connecting. #0 0x00007fffe83b2a98 in raise () at /lib64/libc.so.6 #1 0x00007fffe83b469a in abort () at /lib64/libc.so.6 #2 0x00007ffff7b1533d in spice_logv (log_domain=0x7ffff7b87226 "Spice", log_level=SPICE_LOG_LEVEL_ERROR, strloc=0x7ffff7b92aba "reds.c:1373", function=0x7ffff7b94f40 <__FUNCTION__.31775> "reds_send_link_ack", format=0x7ffff7b871fe "assertion `%s' failed", args=args@entry=0x7fffffffcb68) at log.c:109 #3 0x00007ffff7b15468 in spice_log (log_domain=log_domain@entry=0x7ffff7b87226 "Spice", log_level=log_level@entry=SPICE_LOG_LEVEL_ERROR, strloc=strloc@entry=0x7ffff7b92aba "reds.c:1373", function=function@entry=0x7ffff7b94f40 <__FUNCTION__.31775> "reds_send_link_ack", format=format@entry=0x7ffff7b871fe "assertion `%s' failed") at log.c:123 #4 0x00007ffff7aee335 in reds_handle_read_link_done (link=0x555556b27c70) at reds.c:1373 #5 0x00007ffff7aee335 in reds_handle_read_link_done (opaque=0x555556b27c70) at reds.c:2139 #6 0x000055555588acc6 in qemu_iohandler_poll () #7 0x000055555588a8e1 in main_loop_wait () #8 0x0000555555614064 in main () Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1281442 Acked-by: Fabiano Fidêncio <fidencio@redhat.com> Acked-by: Frediano Ziglio <fziglio@redhat.com>
2016-01-07build-sys: disable static lib by defaultMarc-André Lureau1-1/+1
It's not used in general, so no need to build it by default. Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com> Acked-by: Frediano Ziglio <fziglio@redhat.com>
2016-01-07build: Remove unused SPICEC_STATIC_LINKAGE_BSTATICChristophe Fergeau1-2/+0
A left-over from the client code.
2016-01-07replay: better help for -s optionFrediano Ziglio1-1/+1
-s accepts an option to delay command queueing. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Marc-André Lureau <mlureau@redhat.com>
2015-12-14Flush display commands before validating the surface.Jeremy White1-1/+2
This fixes a display glitch in xspice which is caused when a surface create is queued, but then a direct call to update the area is issued. Unless we flush the queue, the surface does not exist, and we fail. Signed-off-by: Jeremy White <jwhite@codeweavers.com>
2015-12-11dcc: do not cause problem with multiple threads.Frediano Ziglio1-3/+2
With multiple cards configured you can have multiple workers running in different thread. With such configuration static variables not syncronized could lead to undefined behavior. Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
2015-12-11smartcard: include libcacard.h if possibleMarc-André Lureau1-0/+6
Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
2015-12-11Add travis CI fileMarc-André Lureau1-0/+31
Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
2015-12-11Update spice-commonChristophe Fergeau1-0/+0
shortlog for the spice-common changes this brings in: Christophe Fergeau (3): build-sys: Add missing # to comment ssl-verify: Handle NULL return from g_inet_address_new_from_string() ssl-verify: Don't leak GInetAddress Francois Gouget (3): build-sys: Add the SPICE_WARNING() and SPICE_PRINT_MESSAGES m4 macros build-sys: Add SPICE_CHECK_GSTREAMER() build-sys: Add SPICE_CHECK_GSTREAMER_ELEMENTS() Lukas Venhoda (1): canvas_base: Remove redundant switch case block Marc-André Lureau (2): Fix make distcheck Use new libcacard.h if possible
2015-12-11build-sys: Adjust to new spice-common spice-deps.m4Christophe Fergeau3-6/+5
This commit also updates the spice-common submodule Christophe Fergeau (7): Add marshaller test case build-sys: Use ${PKG_CONFIG} rather than pkg-config build-sys: Rework SPICE_CHECK_* m4 macros build-sys: Add gio-2.0 to SPICE_CHECK_GLIB2 build-sys: Fix error in SPICE_CHECK_LZ4 description build-sys: Set automake conditional in SPICE_CHECK_SMARTCARD build-sys: Rename SUPPORT_GL to HAVE_GL Javier Celaya (1): Fix linearization of several marshallers with one item Lukas Venhoda (3): ssl-verify: Only check addr length when using IP addr m4: Require glib version >= 2.22 ssl-verify: Changed IPv4 hostname to IPv6
2015-12-11remove small leak in MJPEG codeFrediano Ziglio1-0/+1
cinfo.dest is allocated in spice_jpeg_mem_dest but never freed. Note that jpeg_destroy_compress does not free this field as is supposed to be a buffer provided by jpeg caller. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
2015-12-11Add missing license headersChristophe Fergeau27-0/+460
2015-12-11syntax-check: Exclude png files from sc_prohibit_empty_lines_at_EOFChristophe Fergeau1-1/+1
2015-12-11syntax-check: Clean-up exception rulesChristophe Fergeau1-10/+3
Some files no longer exists, some exceptions are no longer needed, ...
2015-12-11syntax-check: Remove unused #include <strings.h>Christophe Fergeau1-1/+0
2015-12-11syntax-check: Add missing #include <config.h>Christophe Fergeau3-0/+10
2015-12-11syntax-check: Don't use tabs for indentationChristophe Fergeau4-12/+12
2015-12-11syntax-check: Exclude red_replay_qxl.c from sc_cast_of_argument_to_freeChristophe Fergeau1-0/+2
red_replay_qxl.c stores some pointers QXLPHYSICAL data members (ie uint64_t), and then needs to free them, so the cast is required.
2015-12-11syntax-check: Ignore .png files in sc_trailing_blank testChristophe Fergeau1-1/+1
2015-12-11syntax-check: manual: Remove duplicate wordChristophe Fergeau1-1/+1
2015-12-11syntax-check: Add missing AUTHORSChristophe Fergeau2-7/+28
2015-12-11fix spelling mistakes in comments (reseting to resetting & dummym to dummy)snir sheriber4-5/+5
Acked-by: Frediano Ziglio <fziglio@redhat.com>
2015-12-11Update the .gitignore files for the new manual,Jeremy White3-0/+7
for a few newly generated tests, and for the spice-server.h.
2015-10-12Simplify pointer computationFrediano Ziglio1-1/+1
Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-07build-sys: Remove client check from configure.acChristophe Fergeau1-10/+0
configure.ac is checking for pyparsing availability if client/generated_marshallers.cpp is missing. The client/ code is gone, and the python modules checks are done in spice-common/configure.ac nowadays, so we can get rid of this check.
2015-10-06build-sys: bump libtool version informationFrediano Ziglio1-2/+2
As one interface was added bump the version and put a comment to avoid too much updates. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
2015-10-06Mention the 2 recently fixed CVEs in NEWSChristophe Fergeau1-1/+1
2015-10-06Prevent leak if size from red_get_data_chunks don't match in red_get_imageFrediano Ziglio1-0/+2
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
2015-10-06Prevent data_size to be set independently from dataFrediano Ziglio1-0/+1
There was not check for data_size field so one could set data to a small set of data and data_size much bigger than size of data leading to buffer overflow. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
2015-10-06Avoid race condition copying segments in red_get_pathFrediano Ziglio1-1/+1
The guest can attempt to increase the number of segments while spice-server is reading them. Make sure we don't copy more then the allocated segments. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06Make sure we can read QXLPathSeg structuresFrediano Ziglio1-2/+2
start pointer points to a QXLPathSeg structure. Before reading from the structure, make sure the structure is contained in the memory range checked. Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06Fix some possible overflows in red_get_string for 32 bitFrediano Ziglio1-1/+7
Signed-off-by: Frediano Ziglio <fziglio@redhat.com> Acked-by: Christophe Fergeau <cfergeau@redhat.com>
2015-10-06Prevent DoS from guest trying to allocate too much data on host for chunksFrediano Ziglio1-8/+41
Limit number of chunks to a given amount to avoid guest trying to allocate too much memory. Using circular or nested chunks lists guest could try to allocate huge amounts of memory. Considering the list can be infinite and guest can change data this also prevents strange security attacks from guest. Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-09 05:42:52 +0000