From: Marc-André Lureau <marcandre.lureau@xxxxxxxxxx>
The protocol uses a u8 for the selection value. Make sure the given
argument value fits there, or throw a critical.
The other places seem to use u8 variables already.
Signed-off-by: Marc-André Lureau <marcandre.lureau@xxxxxxxxxx>
---
src/channel-main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/channel-main.c b/src/channel-main.c
index 7d4b5c2..e359e8d 100644
--- a/src/channel-main.c
+++ b/src/channel-main.c
@@ -1354,6 +1354,7 @@ static void agent_clipboard_grab(SpiceMainChannel *channel, guint selection,
if (!c->agent_connected)
return;
+ g_return_if_fail(selection < 256);
g_return_if_fail(test_agent_cap(channel, VD_AGENT_CAP_CLIPBOARD_BY_DEMAND));
size = sizeof(VDAgentClipboardGrab) + sizeof(uint32_t) * ntypes;
--
2.21.0.4.g36eb1cb9cf
_______________________________________________
Spice-devel mailing list
Spice-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/spice-devel