ui/vnc: fix OOB read access in VNC SASL mechname array
When reading the SASL mechname array off the VNC connection, if malicious, the received data may contain embedded NULs. If this happens the memory buffer returned by g_strndup may be shorter than the original data. Unfortunately the code continued to index into this buffer with an offset equal to the original length. This is a potential OOB read of the array. Fixes: 5847d9e1 (ui/vnc: simplify and avoid strncpy) Reported-by: boy juju <agx1657748706@gmail.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-ID: <20260521103353.1645561-2-berrange@redhat.com>
Daniel P. Berrangé committed
May 21, 2026 at 11:33 UTC
ae18df638fb4285c7b645f98c43f5ebc2e123a55
1 file changed
+2
ui/vnc-auth-sasl.c
+2
@@ -489,6 +489,8 @@ static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_
489
char *mechname = g_strndup((const char *) data, len);
490
trace_vnc_auth_sasl_mech_choose(vs, mechname);
491
492
+ /* If 'data' had embedded NUL the dup'd string might now be shorter */
493
+ len = strlen(mechname);
494
if (strncmp(vs->sasl.mechlist, mechname, len) == 0) {
495
if (vs->sasl.mechlist[len] != '\0' &&
496
vs->sasl.mechlist[len] != ',') {