-
Mauro Matteo Cascella authored
A wrong exit condition may lead to an infinite loop when inflating a valid zlib buffer containing some extra bytes in the `inflate_buffer` function. The bug only occurs post-authentication. Return the buffer immediately if the end of the compressed data has been reached (Z_STREAM_END). Fixes: CVE-2023-3255 Fixes: 0bf41cab ("ui/vnc: clipboard support") Reported-by:
Kevin Denis <kevin.denis@synacktiv.com> Signed-off-by:
Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <20230704084210.101822-1-mcascell@redhat.com>
Mauro Matteo Cascella authoredA wrong exit condition may lead to an infinite loop when inflating a valid zlib buffer containing some extra bytes in the `inflate_buffer` function. The bug only occurs post-authentication. Return the buffer immediately if the end of the compressed data has been reached (Z_STREAM_END). Fixes: CVE-2023-3255 Fixes: 0bf41cab ("ui/vnc: clipboard support") Reported-by:
Kevin Denis <kevin.denis@synacktiv.com> Signed-off-by:
Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <20230704084210.101822-1-mcascell@redhat.com>