Fixes a potential buffer overflow in the protocol handling.

https://bugzilla.redhat.com/show_bug.cgi?id=1399566
https://access.redhat.com/security/cve/CVE-2016-9578
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9578
https://security-tracker.debian.org/tracker/CVE-2016-9578

Patch copied from upstream source repository:

https://cgit.freedesktop.org/spice/spice/commit/?h=0.12&id=f66dc643635518e53dfbe5262f814a64eec54e4a

From f66dc643635518e53dfbe5262f814a64eec54e4a Mon Sep 17 00:00:00 2001
From: Frediano Ziglio <fziglio@redhat.com>
Date: Tue, 13 Dec 2016 14:40:10 +0000
Subject: Prevent integer overflows in capability checks

diff --git a/server/reds.c b/server/reds.c
index 86a33d5..9150454 100644
--- a/server/reds.c
+++ b/server/reds.c
@@ -2110,6 +2110,14 @@ static void reds_handle_read_link_done(void *opaque)
     link_mess->num_channel_caps = GUINT32_FROM_LE(link_mess->num_channel_caps);
     link_mess->num_common_caps = GUINT32_FROM_LE(link_mess->num_common_caps);
 
+    /* Prevent DoS. Currently we defined only 13 capabilities,
+     * I expect 1024 to be valid for quite a lot time */
+    if (link_mess->num_channel_caps > 1024 || link_mess->num_common_caps > 1024) {
+        reds_send_link_error(link, SPICE_LINK_ERR_INVALID_DATA);
+        reds_link_free(link);
+        return;
+    }
+
     num_caps = link_mess->num_common_caps + link_mess->num_channel_caps;
     caps = (uint32_t *)((uint8_t *)link_mess + link_mess->caps_offset);
 
-- 
cgit v0.10.2

ht' method='get' action='/guix/log/po/packages'>
<input type='hidden' name='id' value='6de772d9d40ac7ad338c1b13323fd7c9e8ec80af'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=6de772d9d40ac7ad338c1b13323fd7c9e8ec80af'>root</a>/<a href='/guix/log/po?id=6de772d9d40ac7ad338c1b13323fd7c9e8ec80af'>po</a>/<a href='/guix/log/po/packages?id=6de772d9d40ac7ad338c1b13323fd7c9e8ec80af'>packages</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/po/packages?id=6de772d9d40ac7ad338c1b13323fd7c9e8ec80af&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2020-04-14 13:01:58 +0200'>2020-04-14</span></td><td><a href='/guix/commit/po/packages?id=2b2921937017bf4b3c7c8be2d0448f8c64d02bb1'>nls: Update.</a></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-04-12 00:18:05 +0200'>2020-04-12</span></td><td><a href='/guix/commit/po/packages?id=935ef44b398353b5b6af94e185d7b0c3d833db0b'>nls: Update.</a></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-03-23 00:06:58 +0100'>2020-03-23</span></td><td><a href='/guix/commit/po/packages?id=86603d8660e42a3b5d8b407e456a98429943bc7e'>nls: Update.</a></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-05-13 22:44:22 +0200'>2019-05-13</span></td><td><a href='/guix/commit/po/packages?id=d1b18fbb5c119f16d57d08ac4264e10a0a536884'>nls: Update 'fr' translation.</a></td><td>Julien Lepiller</td></tr>
<tr><td><span title='2019-05-03 17:47:30 +0200'>2019-05-03</span></td><td><a href='/guix/commit/po/packages?id=adb5506b2cfb47f696d66a03ede897e9bfa829bb'>nls: Update da translations.</a></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-05-01 10:49:52 +0200'>2019-05-01</span></td><td><a href='/guix/commit/po/packages?id=20ee8883bcb1d75e8e783de5254e11e7142c1e61'>nls: Update translations for de and fr.</a></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-04-25 18:55:12 +0200'>2019-04-25</span></td><td><a href='/guix/commit/po/packages?id=57e2b24dc03e44e4e379436e63d29231f1f9d28c'>nls: Update 'es' translation.</a></td><td>Julien Lepiller</td></tr>
<tr><td><span title='2019-04-25 18:54:46 +0200'>2019-04-25</span></td><td><a href='/guix/commit/po/packages?id=518acc73c11d0fc4118bd4f4f9220fe745d59054'>nls: Update 'fr' translation.</a></td><td>Julien Lepiller</td></tr>
<tr><td><span title='2019-04-13 14:50:46 +0200'>2019-04-13</span></td><td><a href='/guix/commit/po/packages?id=a27ed8fd35ce66520bc3d81dbe752841583d1482'>nls: Update 'fr' translation.</a></td><td>Julien Lepiller</td></tr>
<tr><td><span title='2019-02-13 21:40:17 +0100'>2019-02-13</span></td><td><a href='/guix/commit/po/packages?id=57e508d1c13cc95a37cf44ed429d1d0b97ef763d'>nls: Update 'de' translation.</a></td><td>Julien Lepiller</td></tr>
<tr><td><span title='2019-02-13 21:40:02 +0100'>2019-02-13</span></td><td><a href='/guix/commit/po/packages?id=d093f3e4a4dd155969499ac2dc5fdb069a611c75'>nls: Update 'da' translation.</a></td><td>Julien Lepiller</td></tr>
<tr><td><span title='2018-12-02 14:31:20 +0100'>2018-12-02</span></td><td><a href='/guix/commit/po/packages?id=adfb167f12c91731788f0b20066471274df23400'>nls: Update 'fr' translation.</a></td><td>Julien Lepiller</td></tr>
<tr><td><span title='2018-06-23 16:23:50 +0200'>2018-06-23</span></td><td><a href='/guix/commit/po/packages?id=2cf2c778846153f3d5a56e98232fbef6f71b57a6'>nls: Update 'fr' translation.</a></td><td>Julien Lepiller</td></tr>
<tr><td><span title='2018-06-18 23:19:51 +0200'>2018-06-18</span></td><td><a href='/guix/commit/po/packages?id=f202292217c0a5588d1c281014e9453ff0343c19'>nls: Update 'da' translation.</a></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-04-19 00:14:49 +0200'>2018-04-19</span></td><td><a href='/guix/commit/po/packages?id=c88abbf2fda8f3798a0e3dd14a02157d247875e8'>nls: Update 'es' translation.</a></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-04-11 01:21:32 +0200'>2018-04-11</span></td><td><a href='/guix/commit/po/packages?id=ac6d2e35300012ddac2eea13b09e7a20cfb02520'>nls: Add Spanish translation.</a></td><td>Ludovic Courtès</td></tr>