Fixes a potential buffer overflow in the protocol handling.

https://bugzilla.redhat.com/show_bug.cgi?id=1399566
https://access.redhat.com/security/cve/CVE-2016-9578
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9578
https://security-tracker.debian.org/tracker/CVE-2016-9578

Patch copied from upstream source repository:

https://cgit.freedesktop.org/spice/spice/commit/?h=0.12&id=f66dc643635518e53dfbe5262f814a64eec54e4a

From f66dc643635518e53dfbe5262f814a64eec54e4a Mon Sep 17 00:00:00 2001
From: Frediano Ziglio <fziglio@redhat.com>
Date: Tue, 13 Dec 2016 14:40:10 +0000
Subject: Prevent integer overflows in capability checks

diff --git a/server/reds.c b/server/reds.c
index 86a33d5..9150454 100644
--- a/server/reds.c
+++ b/server/reds.c
@@ -2110,6 +2110,14 @@ static void reds_handle_read_link_done(void *opaque)
     link_mess->num_channel_caps = GUINT32_FROM_LE(link_mess->num_channel_caps);
     link_mess->num_common_caps = GUINT32_FROM_LE(link_mess->num_common_caps);
 
+    /* Prevent DoS. Currently we defined only 13 capabilities,
+     * I expect 1024 to be valid for quite a lot time */
+    if (link_mess->num_channel_caps > 1024 || link_mess->num_common_caps > 1024) {
+        reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
+        reds_link_free(link);
+        return;
+    }
+
     num_caps = link_mess->num_common_caps + link_mess->num_channel_caps;
     caps = (uint32_t *)((uint8_t *)link_mess + link_mess->caps_offset);
 
-- 
cgit v0.10.2

2fdd5ea90b47'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/packages/xfig.scm'>
<input type='hidden' name='id' value='eba493b369e3353d757a82e116682fdd5ea90b47'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=eba493b369e3353d757a82e116682fdd5ea90b47'>root</a>/<a href='/guix/log/gnu?id=eba493b369e3353d757a82e116682fdd5ea90b47'>gnu</a>/<a href='/guix/log/gnu/packages?id=eba493b369e3353d757a82e116682fdd5ea90b47'>packages</a>/<a href='/guix/log/gnu/packages/xfig.scm?id=eba493b369e3353d757a82e116682fdd5ea90b47'>xfig.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/packages/xfig.scm?id=eba493b369e3353d757a82e116682fdd5ea90b47&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2022-03-11 23:07:25 +0100'>2022-03-11</span></td><td><a href='/guix/commit/gnu/packages/xfig.scm?id=4e0c4ab7f962a56b1c5b023b40dbeb3e856c96f6'>gnu: transfig: Fix "multiple definition" errors with GCC 10+.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/patches/transfig-gcc10-fno-common.patch: New patch.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/xfig.scm (transfig)[source]&lt;origin&gt;: Use patch
"transfig-gcc10-fno-common.patch" to avoid "multiple definition" errors with
GCC 10+ and "-f-no-common".

Signed-off-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>Ivan Vilata i Balaguer</td></tr>
<tr><td><span title='2022-03-11 23:07:22 +0100'>2022-03-11</span></td><td><a href='/guix/commit/gnu/packages/xfig.scm?id=db41eabd47e676b3a08ff87ceea20e0cb9f98427'>gnu: transfig: Avoid "ar" option incompatibility with binutils 2.36.</a><span class='msg-avail'>...<span class='msg-tooltip'>Fixes &lt;https://issues.guix.gnu.org/53425&gt;.

* gnu/packages/xfig.scm (transfig)[arguments]&lt;#:phases&gt;: Remove "l" option
from "ar" invocation in makefiles to avoid incompatible meaning in binutils
2.36 causing error "ar: libdeps specified more than once".

Signed-off-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>Ivan Vilata i Balaguer</td></tr>
<tr><td><span title='2021-12-13 17:48:25 +0100'>2021-12-13</span></td><td><a href='/guix/commit/gnu/packages/xfig.scm?id=8394619baceb118df92e355377fd543bb1aa501a'>gnu: Simplify package inputs.</a><span class='msg-avail'>...<span class='msg-tooltip'>This commit was obtained by running:

  ./pre-inst-env guix style

without any additional argument.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2021-11-17 17:48:18 +0200'>2021-11-17</span></td><td><a href='/guix/commit/gnu/packages/xfig.scm?id=99084abd80d7c81e83263ffc6fd3699aeb8899c5'>gnu: xfig: Update to 3.2.8b.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/xfig.scm (xfig): Update to 3.2.8b.
[native-inputs]: Add ghostscript.
</span></span></td><td>Efraim Flashner</td></tr>