LookingGlass/client
Tudor Brindus 8982493239 [client] clipboard: fix heap-buffer overflow in clipboardRequest
=================================================================
==7680==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000ec010 at pc 0x5622fcf9f386 bp 0x7f36084ff680 sp 0x7f36084ff678
WRITE of size 4 at 0x6020000ec010 thread T1
    #0 0x5622fcf9f385 in clipboardRequest /code/LookingGlass/client/src/main.c:707
    #1 0x5622fd0036c9 in wayland_cb_notice /code/LookingGlass/client/clipboards/Wayland/src/wayland.c:521
    #2 0x5622fcf9f4dc in spiceClipboardNotice /code/LookingGlass/client/src/main.c:724
    #3 0x5622fcfc4d59 in spice_agent_process /code/LookingGlass/repos/PureSpice/src/spice.c:1106
    #4 0x5622fcfc16d6 in spice_on_main_channel_read /code/LookingGlass/repos/PureSpice/src/spice.c:655
    #5 0x5622fcfbee4f in spice_process /code/LookingGlass/repos/PureSpice/src/spice.c:361
    #6 0x5622fcf9e3a2 in spiceThread /code/LookingGlass/client/src/main.c:598
    #7 0x5622fd006b5e in threadWrapper /code/LookingGlass/common/src/platform/linux/thread.c:39
    #8 0x7f3614b2bf26 in start_thread /build/glibc-WZtAaN/glibc-2.30/nptl/pthread_create.c:479
    #9 0x7f3614a4c2ee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfd2ee)

0x6020000ec011 is located 0 bytes to the right of 1-byte region [0x6020000ec010,0x6020000ec011)
allocated by thread T1 here:
    #0 0x7f36156f9628 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x107628)
    #1 0x5622fcf9f33f in clipboardRequest /code/LookingGlass/client/src/main.c:705
    #2 0x5622fd0036c9 in wayland_cb_notice /code/LookingGlass/client/clipboards/Wayland/src/wayland.c:521
    #3 0x5622fcf9f4dc in spiceClipboardNotice /code/LookingGlass/client/src/main.c:724
    #4 0x5622fcfc4d59 in spice_agent_process /code/LookingGlass/repos/PureSpice/src/spice.c:1106
    #5 0x5622fcfc16d6 in spice_on_main_channel_read /code/LookingGlass/repos/PureSpice/src/spice.c:655
    #6 0x5622fcfbee4f in spice_process /code/LookingGlass/repos/PureSpice/src/spice.c:361
    #7 0x5622fcf9e3a2 in spiceThread /code/LookingGlass/client/src/main.c:598
    #8 0x5622fd006b5e in threadWrapper /code/LookingGlass/common/src/platform/linux/thread.c:39
    #9 0x7f3614b2bf26 in start_thread /build/glibc-WZtAaN/glibc-2.30/nptl/pthread_create.c:479

Thread T1 created by T0 here:
    #0 0x7f361562b9b2 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x399b2)
    #1 0x5622fd006cd0 in lgCreateThread /code/LookingGlass/common/src/platform/linux/thread.c:50
    #2 0x5622fcfa5a7d in lg_run /code/LookingGlass/client/src/main.c:1615
    #3 0x5622fcface28 in main /code/LookingGlass/client/src/main.c:2035
    #4 0x7f3614975e0a in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow /code/LookingGlass/client/src/main.c:707 in clipboardRequest
Shadow bytes around the buggy address:
  0x0c04800157b0: fa fa 00 00 fa fa fd fa fa fa fd fa fa fa fd fd
  0x0c04800157c0: fa fa fd fd fa fa fd fa fa fa 00 fa fa fa 00 fa
  0x0c04800157d0: fa fa 00 fa fa fa fd fa fa fa fd fd fa fa fa fa
  0x0c04800157e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c04800157f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c0480015800: fa fa[01]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480015810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480015820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480015830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480015840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480015850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==7680==ABORTING
2021-01-10 14:52:58 +11:00
..
clipboards [client] added streaming clipboard support for large transfers 2020-12-03 12:01:51 +11:00
cmake [client] egl: move shaders into seperate files and build into objects 2019-03-28 14:59:54 +11:00
decoders [build] make "common" a static library (part 2/2) 2019-04-11 11:12:59 +10:00
fonts [build] make "common" a static library (part 2/2) 2019-04-11 11:12:59 +10:00
include [client] ll: add new method ll_peek_tail 2021-01-06 22:11:10 +11:00
parsers [all] update copyright dates 2019-02-22 22:16:14 +11:00
renderers [client] egl: actually set the dma texture member 2021-01-09 22:16:40 +11:00
src [client] clipboard: fix heap-buffer overflow in clipboardRequest 2021-01-10 14:52:58 +11:00
CMakeLists.txt [client] add support for compiling with AddressSanitizer 2021-01-10 13:42:58 +11:00
DEBUGGING.md [doc] Fix formatting 2018-05-23 08:46:03 +10:00
README.md [client] add input:captureOnly to disable input when not captured 2021-01-09 18:01:08 +11:00

Looking Glass Client

This is the Looking Glass client application that is designed to work in tandem with the Looking Glass Host application


Building the Application

Build Dependencies

  • binutils-dev
  • cmake
  • fonts-freefont-ttf
  • libsdl2-dev
  • libsdl2-ttf-dev
  • libspice-protocol-dev
  • libfontconfig1-dev
  • libx11-dev
  • nettle-dev

Debian (and maybe Ubuntu)

apt-get install binutils-dev cmake fonts-freefont-ttf libsdl2-dev libsdl2-ttf-dev libspice-protocol-dev libfontconfig1-dev libx11-dev nettle-dev

Building

mkdir build
cd build
cmake ../
make

Should this all go well you should be left with the file looking-glass-client


Usage Tips

Key Bindings

By default Looking Glass uses the Scroll Lock key as the escape key for commands as well as the input capture mode toggle, this can be changed using the -m switch if you desire a different key. Below are a list of current key bindings:

Command Description
ScrLk Toggle cursor screen capture
ScrLk+F Full Screen toggle
ScrLk+V Video stream toggle
ScrLk+I Spice keyboard & mouse enable toggle
ScrLk+N Toggle night vision mode (EGL renderer only!)
ScrLk+Q Quit
ScrLk+Insert Increase mouse sensitivity (in capture mode only)
ScrLk+Del Decrease mouse sensitivity (in capture mode only)
ScrLk+F1 Send Ctrl+Alt+F1 to the guest
ScrLk+F2 Send Ctrl+Alt+F2 to the guest
ScrLk+F3 Send Ctrl+Alt+F3 to the guest
ScrLk+F4 Send Ctrl+Alt+F4 to the guest
ScrLk+F5 Send Ctrl+Alt+F5 to the guest
ScrLk+F6 Send Ctrl+Alt+F6 to the guest
ScrLk+F7 Send Ctrl+Alt+F7 to the guest
ScrLk+F8 Send Ctrl+Alt+F8 to the guest
ScrLk+F9 Send Ctrl+Alt+F9 to the guest
ScrLk+F10 Send Ctrl+Alt+F10 to the guest
ScrLk+F11 Send Ctrl+Alt+F11 to the guest
ScrLk+F12 Send Ctrl+Alt+F12 to the guest
ScrLk+LWin Send LWin to the guest
ScrLk+RWin Send RWin to the guest

Setting options via command line arguments

The syntax is simple: module:name=value, for example:

./looking-glass-client win:fullScreen=yes egl:nvGain=1

Setting options via configuration files

By default the application will look for and load the config files in the following locations

  • /etc/looking-glass-client.ini
  • ~/.looking-glass-client.ini

The format of this file is the commonly known INI format, for example:

[win]
fullScreen=yes

[egl]
nvGain=1

Command line arguments will override any options loaded from the config files.

Supported options

|--------------------------------------------------------------------------------------------------------------------------------------------------|
| Long                   | Short | Value                  | Description                                                                            |
|--------------------------------------------------------------------------------------------------------------------------------------------------|
| app:configFile         | -C    | NULL                   | A file to read additional configuration from                                           |
| app:renderer           | -g    | auto                   | Specify the renderer to use                                                            |
| app:license            | -l    | no                     | Show the license for this application and then terminate                               |
| app:cursorPollInterval |       | 1000                   | How often to check for a cursor update in microseconds                                 |
| app:framePollInterval  |       | 1000                   | How often to check for a frame update in microseconds                                  |
| app:allowDMA           |       | yes                    | Allow direct DMA transfers if possible (VM-VM only for now)                            |
| app:shmFile            | -f    | /dev/shm/looking-glass | The path to the shared memory file, or the name of the kvmfr device to use, ie: kvmfr0 |
|--------------------------------------------------------------------------------------------------------------------------------------------------|

|---------------------------------------------------------------------------------------------------------------------------------|
| Long                    | Short | Value                  | Description                                                          |
|---------------------------------------------------------------------------------------------------------------------------------|
| win:title               |       | Looking Glass (client) | The window title                                                     |
| win:position            |       | center                 | Initial window position at startup                                   |
| win:size                |       | 1024x768               | Initial window size at startup                                       |
| win:autoResize          | -a    | no                     | Auto resize the window to the guest                                  |
| win:allowResize         | -n    | yes                    | Allow the window to be manually resized                              |
| win:keepAspect          | -r    | yes                    | Maintain the correct aspect ratio                                    |
| win:forceAspect         |       | yes                    | Force the window to maintain the aspect ratio                        |
| win:dontUpscale         |       | no                     | Never try to upscale the window                                      |
| win:borderless          | -d    | no                     | Borderless mode                                                      |
| win:fullScreen          | -F    | no                     | Launch in fullscreen borderless mode                                 |
| win:maximize            | -T    | no                     | Launch window maximized                                              |
| win:minimizeOnFocusLoss |       | yes                    | Minimize window on focus loss                                        |
| win:fpsMin              | -K    | -1                     | Frame rate minimum (0 = disable - not recommended, -1 = auto detect) |
| win:showFPS             | -k    | no                     | Enable the FPS & UPS display                                         |
| win:ignoreQuit          | -Q    | no                     | Ignore requests to quit (ie: Alt+F4)                                 |
| win:noScreensaver       | -S    | no                     | Prevent the screensaver from starting                                |
| win:alerts              | -q    | yes                    | Show on screen alert messages                                        |
| win:quickSplash         |       | no                     | Skip fading out the splash screen when a connection is established   |
|---------------------------------------------------------------------------------------------------------------------------------|

|----------------------------------------------------------------------------------------------------------------------------------------------|
| Long                      | Short | Value           | Description                                                                            |
|----------------------------------------------------------------------------------------------------------------------------------------------|
| input:grabKeyboard        | -G    | yes             | Grab the keyboard in capture mode                                                      |
| input:grabKeyboardOnFocus |       | yes             | Grab the keyboard when focused                                                         |
| input:escapeKey           | -m    | 71 = ScrollLock | Specify the escape key, see https://wiki.libsdl.org/SDLScancodeLookup for valid values |
| input:ignoreWindowsKeys   |       | no              | Do not pass events for the windows keys to the guest                                   |
| input:hideCursor          | -M    | yes             | Hide the local mouse cursor                                                            |
| input:mouseSens           |       | 0               | Initial mouse sensitivity when in capture mode (-9 to 9)                               |
| input:mouseSmoothing      |       | yes             | Apply simple mouse smoothing when rawMouse is not in use (helps reduce aliasing)       |
| input:rawMouse            |       | no              | Use RAW mouse input when in capture mode (good for gaming)                             |
| input:mouseRedraw         |       | yes             | Mouse movements trigger redraws (ignores FPS minimum)                                  |
| input:autoCapture         |       | no              | Try to keep the mouse captured when needed                                             |
| input:captureOnly         |       | no              | Only enable input via SPICE if in capture mode                                         |
|----------------------------------------------------------------------------------------------------------------------------------------------|

|------------------------------------------------------------------------------------------------------------------|
| Long                   | Short | Value     | Description                                                         |
|------------------------------------------------------------------------------------------------------------------|
| spice:enable           | -s    | yes       | Enable the built in SPICE client for input and/or clipboard support |
| spice:host             | -c    | 127.0.0.1 | The SPICE server host or UNIX socket                                |
| spice:port             | -p    | 5900      | The SPICE server port (0 = unix socket)                             |
| spice:input            |       | yes       | Use SPICE to send keyboard and mouse input events to the guest      |
| spice:clipboard        |       | yes       | Use SPICE to syncronize the clipboard contents with the guest       |
| spice:clipboardToVM    |       | yes       | Allow the clipboard to be syncronized TO the VM                     |
| spice:clipboardToLocal |       | yes       | Allow the clipboard to be syncronized FROM the VM                   |
| spice:scaleCursor      | -j    | yes       | Scale cursor input position to screen size when up/down scaled      |
| spice:captureOnStart   |       | no        | Capture mouse and keyboard on start                                 |
| spice:alwaysShowCursor |       | no        | Always show host cursor                                             |
|------------------------------------------------------------------------------------------------------------------|

|--------------------------------------------------------------------------------------------------------------|
| Long             | Short | Value | Description                                                               |
|--------------------------------------------------------------------------------------------------------------|
| egl:vsync        |       | no    | Enable vsync                                                              |
| egl:doubleBuffer |       | no    | Enable double buffering                                                   |
| egl:multisample  |       | yes   | Enable Multisampling                                                      |
| egl:nvGainMax    |       | 1     | The maximum night vision gain                                             |
| egl:nvGain       |       | 0     | The initial night vision gain at startup                                  |
| egl:cbMode       |       | 0     | Color Blind Mode (0 = Off, 1 = Protanope, 2 = Deuteranope, 3 = Tritanope) |
|--------------------------------------------------------------------------------------------------------------|

|------------------------------------------------------------------------------------|
| Long                 | Short | Value | Description                                 |
|------------------------------------------------------------------------------------|
| opengl:mipmap        |       | yes   | Enable mipmapping                           |
| opengl:vsync         |       | no    | Enable vsync                                |
| opengl:preventBuffer |       | yes   | Prevent the driver from buffering frames    |
| opengl:amdPinnedMem  |       | yes   | Use GL_AMD_pinned_memory if it is available |
|------------------------------------------------------------------------------------|