Tudor Brindus 8982493239 [client] clipboard: fix heap-buffer overflow in clipboardRequest
=================================================================
==7680==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000ec010 at pc 0x5622fcf9f386 bp 0x7f36084ff680 sp 0x7f36084ff678
WRITE of size 4 at 0x6020000ec010 thread T1
     0x5622fcf9f385 in clipboardRequest /code/LookingGlass/client/src/main.c:707
     0x5622fd0036c9 in wayland_cb_notice /code/LookingGlass/client/clipboards/Wayland/src/wayland.c:521
     0x5622fcf9f4dc in spiceClipboardNotice /code/LookingGlass/client/src/main.c:724
     0x5622fcfc4d59 in spice_agent_process /code/LookingGlass/repos/PureSpice/src/spice.c:1106
     0x5622fcfc16d6 in spice_on_main_channel_read /code/LookingGlass/repos/PureSpice/src/spice.c:655
     0x5622fcfbee4f in spice_process /code/LookingGlass/repos/PureSpice/src/spice.c:361
     0x5622fcf9e3a2 in spiceThread /code/LookingGlass/client/src/main.c:598
     0x5622fd006b5e in threadWrapper /code/LookingGlass/common/src/platform/linux/thread.c:39
     0x7f3614b2bf26 in start_thread /build/glibc-WZtAaN/glibc-2.30/nptl/pthread_create.c:479
     0x7f3614a4c2ee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfd2ee)

0x6020000ec011 is located 0 bytes to the right of 1-byte region [0x6020000ec010,0x6020000ec011)
allocated by thread T1 here:
     0x7f36156f9628 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x107628)
     0x5622fcf9f33f in clipboardRequest /code/LookingGlass/client/src/main.c:705
     0x5622fd0036c9 in wayland_cb_notice /code/LookingGlass/client/clipboards/Wayland/src/wayland.c:521
     0x5622fcf9f4dc in spiceClipboardNotice /code/LookingGlass/client/src/main.c:724
     0x5622fcfc4d59 in spice_agent_process /code/LookingGlass/repos/PureSpice/src/spice.c:1106
     0x5622fcfc16d6 in spice_on_main_channel_read /code/LookingGlass/repos/PureSpice/src/spice.c:655
     0x5622fcfbee4f in spice_process /code/LookingGlass/repos/PureSpice/src/spice.c:361
     0x5622fcf9e3a2 in spiceThread /code/LookingGlass/client/src/main.c:598
     0x5622fd006b5e in threadWrapper /code/LookingGlass/common/src/platform/linux/thread.c:39
     0x7f3614b2bf26 in start_thread /build/glibc-WZtAaN/glibc-2.30/nptl/pthread_create.c:479

Thread T1 created by T0 here:
     0x7f361562b9b2 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x399b2)
     0x5622fd006cd0 in lgCreateThread /code/LookingGlass/common/src/platform/linux/thread.c:50
     0x5622fcfa5a7d in lg_run /code/LookingGlass/client/src/main.c:1615
     0x5622fcface28 in main /code/LookingGlass/client/src/main.c:2035
     0x7f3614975e0a in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow /code/LookingGlass/client/src/main.c:707 in clipboardRequest
Shadow bytes around the buggy address:
  0x0c04800157b0: fa fa 00 00 fa fa fd fa fa fa fd fa fa fa fd fd
  0x0c04800157c0: fa fa fd fd fa fa fd fa fa fa 00 fa fa fa 00 fa
  0x0c04800157d0: fa fa 00 fa fa fa fd fa fa fa fd fd fa fa fa fa
  0x0c04800157e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c04800157f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c0480015800: fa fa[01]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480015810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480015820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480015830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480015840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480015850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==7680==ABORTING
2021-01-10 14:52:58 +11:00
2017-12-14 22:22:44 +11:00
2021-01-03 23:42:43 +11:00
2018-05-31 13:28:36 +10:00
2017-10-31 19:07:16 +11:00

Looking Glass

An extremely low latency KVMFR (KVM FrameRelay) implementation for guests with VGA PCI Passthrough.

Donations

I (Geoffrey McRae) am the primary developer behind this project and I have invested thousands of hours of development time into it.

If you like this project and find it useful and would like to help out you can support me directly using the following platforms.

Documentation

** IMPORTANT ** This project contains submodules that must be checked out if building from the git repository! If you are not a developer and just want to compile Looking Glass please download the source archive from the website instead:

https://looking-glass.io/downloads

Please also be sure to see the following files for more information Note: The README.md files are slowly being deprecated from this project in favor of the wiki at https://looking-glass.io/wiki, and as such the information in these files may be dated.

Latest Version

If you would like to use the latest bleeding edge version of Looking Glass please be aware there will be no support at this time.

Latest bleeding edge builds of the Windows host application can be obtained from:

https://looking-glass.io/downloads

Help and support

Web

https://forum.level1techs.com/t/looking-glass-triage/130952

Discord

https://discord.gg/4ahCn4c

IRC

Join us in the #LookingGlass channel on the FreeNode network

Trello

Description
An extremely low latency KVMFR (KVM FrameRelay) implementation for guests with VGA PCI Passthrough.
Readme GPL-2.0 9.6 MiB
Languages
C 89.3%
C++ 7.1%
CMake 2.4%
NSIS 0.4%
GLSL 0.4%
Other 0.4%