app-emulation/spice: fix vuln 0.13.1, bug #584126

Apply the following patches to 0.13.1:

CVE-2016-2150:

  Commits 69628ea1375282cb7ca5b4dc4410e7aa67e0fc02
  Commits 790d8f3e53d324f496fc719498422e433aae8654

  *instead of* 0067-create-a-function-to-validate-surface-parameters.patch
  *instead of* 0068-improve-primary-surface-parameter-checks.patch

CVE-2016-0749:

  Ported the following commits to 0.13.1 (patches did not apply due to
  refactoring of some internal data structures and renaming).

  *modified* 0065-smartcard-add-a-ref-to-item-before-adding-to-pipe.patch
  *modified* 0066-smartcard-allocate-msg-with-the-expected-size.patch

Gentoo-Bug: 584126

Package-Manager: portage-2.2.28

4 files changed, 265 insertions, 0 deletions

diff --git a/app-emulation/spice/files/0.13.1-CVE-2016-0749-p1.patch b/app-emulation/spice/files/0.13.1-CVE-2016-0749-p1.patch
new file mode 100644
index 000000000000..cd1c8ef1df67
--- /dev/null
+++ b/app-emulation/spice/files/0.13.1-CVE-2016-0749-p1.patch
@@ -0,0 +1,56 @@
+From fd4a179a15882234f86ded87905a240dc76a9445 Mon Sep 17 00:00:00 2001
+From: Matthias Maier <tamiko@43-1.org>
+Date: Tue, 14 Jun 2016 00:08:05 -0500
+Subject: [PATCH 1/2] Port fix for CVE-2016-0749 to 0.13.1, part I
+
+This is a port of
+
+  0065-smartcard-add-a-ref-to-item-before-adding-to-pipe.patch
+
+to version 0.13.1
+
+Original commit message:
+
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Marc-Andre Lureau <marcandre.lureau@redhat.com>
+Date: Thu, 17 Dec 2015 18:13:47 +0100
+Subject: [PATCH] smartcard: add a ref to item before adding to pipe
+
+There is an unref when the message is sent.
+
+[...]
+
+Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
+---
+ server/smartcard.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/server/smartcard.c b/server/smartcard.c
+index ba6f2f5..96e4295 100644
+--- a/server/smartcard.c
++++ b/server/smartcard.c
+@@ -181,14 +181,18 @@ static void smartcard_unref_msg_to_client(RedCharDeviceMsgToClient *msg,
+     smartcard_unref_vsc_msg_item((MsgItem *)msg);
+ }
+ 
+-static void smartcard_send_msg_to_client(RedCharDeviceMsgToClient *msg,
++static void smartcard_send_msg_to_client(RedCharDeviceMsgToClient *message,
+                                          RedClient *client,
+                                          void *opaque)
+ {
+     RedCharDeviceSmartcard *dev = opaque;
+-    spice_assert(dev->priv->scc && dev->priv->scc->base.client == client);
+-    smartcard_channel_client_pipe_add_push(&dev->priv->scc->base, &((MsgItem *)msg)->base);
+ 
++    MsgItem *msg = (MsgItem *)message;
++    PipeItem *item = &msg->base;
++
++    spice_assert(dev->priv->scc && dev->priv->scc->base.client == client);
++    smartcard_ref_vsc_msg_item(msg);
++    smartcard_channel_client_pipe_add_push(&dev->priv->scc->base, item);
+ }
+ 
+ static void smartcard_send_tokens_to_client(RedClient *client, uint32_t tokens, void *opaque)
+-- 
+2.7.3
+
diff --git a/app-emulation/spice/files/0.13.1-CVE-2016-0749-p2.patch b/app-emulation/spice/files/0.13.1-CVE-2016-0749-p2.patch
new file mode 100644
index 000000000000..6a1895f247f9
--- /dev/null
+++ b/app-emulation/spice/files/0.13.1-CVE-2016-0749-p2.patch
@@ -0,0 +1,50 @@
+From 4cd23b8378e68283c7c9cf0b1e25dae11cf69c3e Mon Sep 17 00:00:00 2001
+From: Matthias Maier <tamiko@43-1.org>
+Date: Tue, 14 Jun 2016 00:15:48 -0500
+Subject: [PATCH 2/2] Port fix for CVE-2016-0749 to 0.13.1, part II
+
+This is a port of
+
+  0066-smartcard-allocate-msg-with-the-expected-size.patch
+
+to version 0.13.1
+
+Original commit message:
+
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Marc-Andre Lureau <marcandre.lureau@redhat.com>
+Date: Thu, 17 Dec 2015 18:16:22 +0100
+Subject: [PATCH] smartcard: allocate msg with the expected size
+
+[...]
+
+Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
+---
+ server/smartcard.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/server/smartcard.c b/server/smartcard.c
+index 96e4295..c317512 100644
+--- a/server/smartcard.c
++++ b/server/smartcard.c
+@@ -313,7 +313,7 @@ static void smartcard_char_device_notify_reader_add(RedCharDeviceSmartcard *dev)
+     RedCharDeviceWriteBuffer *write_buf;
+     VSCMsgHeader *vheader;
+ 
+-    write_buf = red_char_device_write_buffer_get(RED_CHAR_DEVICE(dev), NULL, sizeof(vheader));
++    write_buf = red_char_device_write_buffer_get(RED_CHAR_DEVICE(dev), NULL, sizeof(*vheader));
+     if (!write_buf) {
+         spice_error("failed to allocate write buffer");
+         return;
+@@ -360,7 +360,7 @@ static void smartcard_char_device_notify_reader_remove(RedCharDeviceSmartcard *d
+         spice_debug("reader add was never sent to the device");
+         return;
+     }
+-    write_buf = red_char_device_write_buffer_get(RED_CHAR_DEVICE(dev), NULL, sizeof(vheader));
++    write_buf = red_char_device_write_buffer_get(RED_CHAR_DEVICE(dev), NULL, sizeof(*vheader));
+     if (!write_buf) {
+         spice_error("failed to allocate write buffer");
+         return;
+-- 
+2.7.3
+
diff --git a/app-emulation/spice/files/0.13.1-CVE-2016-2150-p1.patch b/app-emulation/spice/files/0.13.1-CVE-2016-2150-p1.patch
new file mode 100644
index 000000000000..e814975e5f38
--- /dev/null
+++ b/app-emulation/spice/files/0.13.1-CVE-2016-2150-p1.patch
@@ -0,0 +1,109 @@
+From fc06265c3780e05503410a6646d1434e15d25b03 Mon Sep 17 00:00:00 2001
+From: Frediano Ziglio <fziglio@redhat.com>
+Date: Mon, 29 Feb 2016 14:24:03 +0000
+Subject: [PATCH 1/2] factor out red_validate_surface function to validate
+ surface parameters
+
+Make possible to reuse it outside red-parse-qxl.c.
+
+Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
+Acked-by: Christophe Fergeau <cfergeau@redhat.com>
+---
+ server/red-parse-qxl.c | 49 ++++++++++++++++++++++++++++++++-----------------
+ server/red-parse-qxl.h |  3 +++
+ 2 files changed, 35 insertions(+), 17 deletions(-)
+
+diff --git a/server/red-parse-qxl.c b/server/red-parse-qxl.c
+index 18b7ea6..b462311 100644
+--- a/server/red-parse-qxl.c
++++ b/server/red-parse-qxl.c
+@@ -1327,13 +1327,41 @@ static unsigned int surface_format_to_bpp(uint32_t format)
+     return 0;
+ }
+ 
++bool red_validate_surface(uint32_t width, uint32_t height,
++                          int32_t stride, uint32_t format)
++{
++    unsigned int bpp;
++    uint64_t size;
++
++    bpp = surface_format_to_bpp(format);
++
++    /* check if format is valid */
++    if (!bpp) {
++        return false;
++    }
++
++    /* check stride is larger than required bytes */
++    size = ((uint64_t) width * bpp + 7u) / 8u;
++    /* the uint32_t conversion is here to avoid problems with -2^31 value */
++    if (stride == G_MININT32 || size > (uint32_t) abs(stride)) {
++        return false;
++    }
++
++    /* the multiplication can overflow, also abs(-2^31) may return a negative value */
++    size = (uint64_t) height * abs(stride);
++    if (size > MAX_DATA_CHUNK) {
++        return false;
++    }
++
++    return true;
++}
++
+ int red_get_surface_cmd(RedMemSlotInfo *slots, int group_id,
+                         RedSurfaceCmd *red, QXLPHYSICAL addr)
+ {
+     QXLSurfaceCmd *qxl;
+     uint64_t size;
+     int error;
+-    unsigned int bpp;
+ 
+     qxl = (QXLSurfaceCmd *)memslot_get_virt(slots, addr, sizeof(*qxl), group_id,
+                                             &error);
+@@ -1353,26 +1381,13 @@ int red_get_surface_cmd(RedMemSlotInfo *slots, int group_id,
+         red->u.surface_create.width  = qxl->u.surface_create.width;
+         red->u.surface_create.height = qxl->u.surface_create.height;
+         red->u.surface_create.stride = qxl->u.surface_create.stride;
+-        bpp = surface_format_to_bpp(red->u.surface_create.format);
+ 
+-        /* check if format is valid */
+-        if (!bpp) {
++        if (!red_validate_surface(red->u.surface_create.width, red->u.surface_create.height,
++                                  red->u.surface_create.stride, red->u.surface_create.format)) {
+             return 1;
+         }
+ 
+-        /* check stride is larger than required bytes */
+-        size = ((uint64_t) red->u.surface_create.width * bpp + 7u) / 8u;
+-        /* the uint32_t conversion is here to avoid problems with -2^31 value */
+-        if (red->u.surface_create.stride == G_MININT32
+-            || size > (uint32_t) abs(red->u.surface_create.stride)) {
+-            return 1;
+-        }
+-
+-        /* the multiplication can overflow, also abs(-2^31) may return a negative value */
+-        size = (uint64_t) red->u.surface_create.height * abs(red->u.surface_create.stride);
+-        if (size > MAX_DATA_CHUNK) {
+-            return 1;
+-        }
++        size = red->u.surface_create.height * abs(red->u.surface_create.stride);
+         red->u.surface_create.data =
+             (uint8_t*)memslot_get_virt(slots, qxl->u.surface_create.data, size, group_id, &error);
+         if (error) {
+diff --git a/server/red-parse-qxl.h b/server/red-parse-qxl.h
+index 9c30572..72a57b4 100644
+--- a/server/red-parse-qxl.h
++++ b/server/red-parse-qxl.h
+@@ -127,6 +127,9 @@ int red_get_message(RedMemSlotInfo *slots, int group_id,
+                     RedMessage *red, QXLPHYSICAL addr);
+ void red_put_message(RedMessage *red);
+ 
++bool red_validate_surface(uint32_t width, uint32_t height,
++                          int32_t stride, uint32_t format);
++
+ int red_get_surface_cmd(RedMemSlotInfo *slots, int group_id,
+                         RedSurfaceCmd *red, QXLPHYSICAL addr);
+ void red_put_surface_cmd(RedSurfaceCmd *red);
+-- 
+2.7.3
+
diff --git a/app-emulation/spice/files/0.13.1-CVE-2016-2150-p2.patch b/app-emulation/spice/files/0.13.1-CVE-2016-2150-p2.patch
new file mode 100644
index 000000000000..a452969d6f1c
--- /dev/null
+++ b/app-emulation/spice/files/0.13.1-CVE-2016-2150-p2.patch
@@ -0,0 +1,50 @@
+From b1c167bb9e8047e93bfd43a43832963c8e830f5b Mon Sep 17 00:00:00 2001
+From: Frediano Ziglio <fziglio@redhat.com>
+Date: Wed, 2 Mar 2016 12:35:41 +0000
+Subject: [PATCH 2/2] improve primary surface parameter checks
+
+Primary surface, as additional surfaces, can be used to access
+host memory from the guest using invalid parameters.
+
+The removed warning is not enough to prevent all cases. Also a warning
+is not enough to stop an escalation to happen.
+The red_validate_surface do different checks to make sure surface
+request is valid and not cause possible buffer/integer overflows:
+- format is valid;
+- width is not large to cause overflow compared to stride;
+- stride is not -2^31 (a number which negate is still <0);
+- stride * height does not overflow.
+
+This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1312980.
+
+Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
+Acked-by: Christophe Fergeau <cfergeau@redhat.com>
+---
+ server/red-worker.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/server/red-worker.c b/server/red-worker.c
+index 241c300..c7fc8bd 100644
+--- a/server/red-worker.c
++++ b/server/red-worker.c
+@@ -681,8 +681,15 @@ static void dev_create_primary_surface(RedWorker *worker, uint32_t surface_id,
+     spice_debug(NULL);
+     spice_warn_if_fail(surface_id == 0);
+     spice_warn_if_fail(surface.height != 0);
+-    spice_warn_if_fail(((uint64_t)abs(surface.stride) * (uint64_t)surface.height) ==
+-             abs(surface.stride) * surface.height);
++
++    /* surface can arrive from guest unchecked so make sure
++     * guest is not a malicious one and drop invalid requests
++     */
++    if (!red_validate_surface(surface.width, surface.height,
++                              surface.stride, surface.format)) {
++        spice_warning("wrong primary surface creation request");
++        return;
++    }
+ 
+     line_0 = (uint8_t*)memslot_get_virt(&worker->mem_slots, surface.mem,
+                                         surface.height * abs(surface.stride),
+-- 
+2.7.3
+