[Qemu-devel] [Bug 1637447] [NEW] VNC/RFB: QEMU reports incorrect name (length)

[Qemu-devel] [Bug 1637447] [NEW] VNC/RFB: QEMU reports incorrect name (length)

[cardamon]

Public bug reported:

If the name of a machine (as set with the -name argument) has a length
longer than 1024, (RFB) VNC clients will not receive a correct RFB
ServerInit message.

I suspect this is the problem:

https://github.com/qemu/qemu/blob/master/ui/vnc.c#L2463

The return value of snprintf is used as the value for the name-length field in the ServerInit message.
This is problematic for names that were truncated to 1024, as the length will now be bigger than the actual name.

I think a quick fix would be to simply report min(size,1024) to the
client...

** Affects: qemu
     Importance: Undecided
         Status: New


** Tags: rfb vnc

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1637447

Title:
  VNC/RFB: QEMU reports incorrect name (length)

Status in QEMU:
  New

Bug description:
  If the name of a machine (as set with the -name argument) has a length
  longer than 1024, (RFB) VNC clients will not receive a correct RFB
  ServerInit message.

  I suspect this is the problem:

  https://github.com/qemu/qemu/blob/master/ui/vnc.c#L2463

  The return value of snprintf is used as the value for the name-length field in the ServerInit message.
  This is problematic for names that were truncated to 1024, as the length will now be bigger than the actual name.

  I think a quick fix would be to simply report min(size,1024) to the
  client...

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1637447/+subscriptions

[Qemu-devel] [Bug 1637447] Re: VNC/RFB: QEMU reports incorrect name (length)

[Jakob van Kruijssen]

** Description changed:

  If the name of a machine (as set with the -name argument) has a length
  longer than 1024, (RFB) VNC clients will not receive a correct RFB
  ServerInit message.
  
  I suspect this is the problem:
  
- https://github.com/qemu/qemu/blob/master/ui/vnc.c#L2463
+ https://github.com/qemu/qemu/blob/v2.7.0-rc5/ui/vnc.c#L2459
  
  The return value of snprintf is used as the value for the name-length field in the ServerInit message.
  This is problematic for names that were truncated to 1024, as the length will now be bigger than the actual name.
  
  I think a quick fix would be to simply report min(size,1024) to the
  client...

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1637447

Title:
  VNC/RFB: QEMU reports incorrect name (length)

Status in QEMU:
  New

Bug description:
  If the name of a machine (as set with the -name argument) has a length
  longer than 1024, (RFB) VNC clients will not receive a correct RFB
  ServerInit message.

  I suspect this is the problem:

  https://github.com/qemu/qemu/blob/v2.7.0-rc5/ui/vnc.c#L2459

  The return value of snprintf is used as the value for the name-length field in the ServerInit message.
  This is problematic for names that were truncated to 1024, as the length will now be bigger than the actual name.

  I think a quick fix would be to simply report min(size,1024) to the
  client...

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1637447/+subscriptions

[Qemu-devel] [Bug 1637447] Re: VNC/RFB: QEMU reports incorrect name (length)

[Daniel Berrange]

The right fix here is to switch to use g_strdup_printf and avoid a fixed
length stack buffer entirely.

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1637447

Title:
  VNC/RFB: QEMU reports incorrect name (length)

Status in QEMU:
  New

Bug description:
  If the name of a machine (as set with the -name argument) has a length
  longer than 1024, (RFB) VNC clients will not receive a correct RFB
  ServerInit message.

  I suspect this is the problem:

  https://github.com/qemu/qemu/blob/v2.7.0-rc5/ui/vnc.c#L2459

  The return value of snprintf is used as the value for the name-length field in the ServerInit message.
  This is problematic for names that were truncated to 1024, as the length will now be bigger than the actual name.

  I think a quick fix would be to simply report min(size,1024) to the
  client...

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1637447/+subscriptions

[Qemu-devel] [Bug 1637447] Re: VNC/RFB: QEMU reports incorrect name (length)

[Thomas Huth]

Fix has been committed:
http://git.qemu.org/?p=qemu.git;a=commitdiff;h=97efe4f961dcf5a0126

** Changed in: qemu
       Status: New => Fix Committed

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1637447

Title:
  VNC/RFB: QEMU reports incorrect name (length)

Status in QEMU:
  Fix Committed

Bug description:
  If the name of a machine (as set with the -name argument) has a length
  longer than 1024, (RFB) VNC clients will not receive a correct RFB
  ServerInit message.

  I suspect this is the problem:

  https://github.com/qemu/qemu/blob/v2.7.0-rc5/ui/vnc.c#L2459

  The return value of snprintf is used as the value for the name-length field in the ServerInit message.
  This is problematic for names that were truncated to 1024, as the length will now be bigger than the actual name.

  I think a quick fix would be to simply report min(size,1024) to the
  client...

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1637447/+subscriptions

[Qemu-devel] [Bug 1637447] Re: VNC/RFB: QEMU reports incorrect name (length)

[Thomas Huth]

** Changed in: qemu
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1637447

Title:
  VNC/RFB: QEMU reports incorrect name (length)

Status in QEMU:
  Fix Released

Bug description:
  If the name of a machine (as set with the -name argument) has a length
  longer than 1024, (RFB) VNC clients will not receive a correct RFB
  ServerInit message.

  I suspect this is the problem:

  https://github.com/qemu/qemu/blob/v2.7.0-rc5/ui/vnc.c#L2459

  The return value of snprintf is used as the value for the name-length field in the ServerInit message.
  This is problematic for names that were truncated to 1024, as the length will now be bigger than the actual name.

  I think a quick fix would be to simply report min(size,1024) to the
  client...

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1637447/+subscriptions