Bug 1861930

Summary:	Accessing byte-aligned data through uint16_t pointers can cause crashes or reduce performance
Product:	Red Hat Enterprise Linux 8	Reporter:	Todd Cullum <tcullum>
Component:	libvncserver	Assignee:	Jonas Ådahl <jadahl>
Status:	CLOSED WONTFIX	QA Contact:	Desktop QE <desktop-qa-list>
Severity:	low	Docs Contact:
Priority:	unspecified
Version:	8.3
Target Milestone:	rc
Target Release:	8.0
Hardware:	arm
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-01-29 07:27:06 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Todd Cullum 2020-07-29 23:59:51 UTC

Description of problem:

Accessing byte-aligned data through uint16_t pointers can cause crashes
on some platforms or reduce the performance.

Version-Release number of selected component (if applicable):
libvncserver-0.9.11-15.el8_2.1

How reproducible:

I have not been able to reproduce this but it is acknowledged upstream here: https://github.com/LibVNC/libvncserver/commit/53073c8d7e232151ea2ecd8a1243124121e10e2d


Actual results:

Can cause slow downs or crashes on ARM.

Expected results:

rfbSetClientColourMapBGR233() behaves normally without performance issues or crashes.

Additional info:

Note that this bug was originally picked up as a CVE/security issue. However, during analysis and after speaking with upstream developer Toby Junghans, we determined there is no security risk and this is a trivial reliability bug at most. I am filing this to let the maintainer know about the issue. I checked the code shipped in RHEL7 and found that the bug exists via code examination.

Comment 3 RHEL Program Management 2022-01-29 07:27:06 UTC

After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.