Bug 1861930 - Accessing byte-aligned data through uint16_t pointers can cause crashes or reduce performance
Summary: Accessing byte-aligned data through uint16_t pointers can cause crashes or re...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: libvncserver
Version: 8.3
Hardware: arm
OS: Unspecified
unspecified
low
Target Milestone: rc
: 8.0
Assignee: Jonas Ådahl
QA Contact: Desktop QE
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-07-29 23:59 UTC by Todd Cullum
Modified: 2022-01-29 07:27 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-01-29 07:27:06 UTC
Type: Bug
Target Upstream Version:


Attachments (Terms of Use)

Description Todd Cullum 2020-07-29 23:59:51 UTC
Description of problem:

Accessing byte-aligned data through uint16_t pointers can cause crashes
on some platforms or reduce the performance.

Version-Release number of selected component (if applicable):
libvncserver-0.9.11-15.el8_2.1

How reproducible:

I have not been able to reproduce this but it is acknowledged upstream here: https://github.com/LibVNC/libvncserver/commit/53073c8d7e232151ea2ecd8a1243124121e10e2d


Actual results:

Can cause slow downs or crashes on ARM.

Expected results:

rfbSetClientColourMapBGR233() behaves normally without performance issues or crashes.

Additional info:

Note that this bug was originally picked up as a CVE/security issue. However, during analysis and after speaking with upstream developer Toby Junghans, we determined there is no security risk and this is a trivial reliability bug at most. I am filing this to let the maintainer know about the issue. I checked the code shipped in RHEL7 and found that the bug exists via code examination.

Comment 3 RHEL Program Management 2022-01-29 07:27:06 UTC
After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.


Note You need to log in before you can comment on or make changes to this bug.