Prevent possible buffer overflow in SpiceKbdState
Prevent possible buffer overflow in SpiceKbdState

key and key_ext in SpiceKbdState are indexed using

   state[scan & 0x7f]

where scan is a 8 bit value got from client. In theory client can send
any value causing scan & 0x7f to be 0x7f. However these arrays contains
only 0x7f values so 0x7f cause a off one overflow.
This potentially cause key_ext to overflow in reds pointer following.
Happily this is not exploitable in either 32 or 64 bit environment.
On 64 bit key_ext is followed by a 4 byte (sizeof(bool) == 4) padding
which is written by the possible overflow.
On 32 bit reds will be overwritten with either 0 or 1 which will cause
a SIGSEGV leading to a DoS. Considering that you have to have access
to the machine with a client you are just shutting down only guests you
can access to.

Signed-off-by: Frediano Ziglio <55d48b080b2e443e395cde84d2c83b135a4ff48e@redhat.com>
Acked-by: Uri Lublin <0332784c07b6f27b46541214503bc0da50f0f291@redhat.com>

fgouget/spice,fgouget/spice,fgouget/spice,fgouget/spice