From: Marc-André Lureau <[email protected]> The clipboard "Release" D-Bus method handler passes the caller provided selection to qemu_clipboard_peer_release() without any bounds check, unlike the "Grab" and "Request" handlers.
An out-of-range selection reaches qemu_clipboard_info(), which asserts selection < QEMU_CLIPBOARD_SELECTION__COUNT and aborts QEMU. Reject invalid selections with an error, following the same pattern as the other clipboard handlers. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4717 Signed-off-by: Marc-André Lureau <[email protected]> --- ui/dbus-clipboard.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/ui/dbus-clipboard.c b/ui/dbus-clipboard.c index 90318384ee48..44764fff8081 100644 --- a/ui/dbus-clipboard.c +++ b/ui/dbus-clipboard.c @@ -346,11 +346,22 @@ dbus_clipboard_release( GDBusMethodInvocation *invocation, gint arg_selection) { + QemuClipboardSelection s = arg_selection; + if (!dbus_clipboard_check_caller(dpy, invocation)) { return DBUS_METHOD_INVOCATION_HANDLED; } - qemu_clipboard_peer_release(&dpy->clipboard_peer, arg_selection); + if (s >= QEMU_CLIPBOARD_SELECTION__COUNT) { + g_dbus_method_invocation_return_error( + invocation, + DBUS_DISPLAY_ERROR, + DBUS_DISPLAY_ERROR_FAILED, + "Invalid clipboard selection: %d", arg_selection); + return DBUS_METHOD_INVOCATION_HANDLED; + } + + qemu_clipboard_peer_release(&dpy->clipboard_peer, s); qemu_dbus_display1_clipboard_complete_release(dpy->clipboard, invocation); return DBUS_METHOD_INVOCATION_HANDLED; -- 2.56.0.116.g6de20f6092dc
