|
 |
090aae |
commit 045a044e8ae79db9244593fbce154cdf6e843273
|
|
|
090aae |
Author: newsoft <newsoft@MacBook-Air-de-newsoft-2.local>
|
|
|
090aae |
Date: Fri Aug 15 16:31:13 2014 +0200
|
|
|
090aae |
|
|
|
090aae |
Fix integer overflow in MallocFrameBuffer()
|
|
|
090aae |
|
|
|
090aae |
Promote integers to uint64_t to avoid integer overflow issue during
|
|
|
090aae |
frame buffer allocation for very large screen sizes
|
|
|
090aae |
|
|
|
090aae |
diff --git a/libvncclient/vncviewer.c b/libvncclient/vncviewer.c
|
|
|
090aae |
index 3b16a6f..24bc6f8 100644
|
|
|
090aae |
--- a/libvncclient/vncviewer.c
|
|
|
090aae |
+++ b/libvncclient/vncviewer.c
|
|
|
090aae |
@@ -82,9 +82,27 @@ static char* ReadPassword(rfbClient* client) {
|
|
|
090aae |
#endif
|
|
|
090aae |
}
|
|
|
090aae |
static rfbBool MallocFrameBuffer(rfbClient* client) {
|
|
|
090aae |
+uint64_t allocSize;
|
|
|
090aae |
+
|
|
|
090aae |
if(client->frameBuffer)
|
|
|
090aae |
free(client->frameBuffer);
|
|
|
090aae |
- client->frameBuffer=malloc(client->width*client->height*client->format.bitsPerPixel/8);
|
|
|
090aae |
+
|
|
|
090aae |
+ /* SECURITY: promote 'width' into uint64_t so that the multiplication does not overflow
|
|
|
090aae |
+ 'width' and 'height' are 16-bit integers per RFB protocol design
|
|
|
090aae |
+ SIZE_MAX is the maximum value that can fit into size_t
|
|
|
090aae |
+ */
|
|
|
090aae |
+ allocSize = (uint64_t)client->width * client->height * client->format.bitsPerPixel/8;
|
|
|
090aae |
+
|
|
|
090aae |
+ if (allocSize >= SIZE_MAX) {
|
|
|
090aae |
+ rfbClientErr("CRITICAL: cannot allocate frameBuffer, requested size is too large\n");
|
|
|
090aae |
+ return FALSE;
|
|
|
090aae |
+ }
|
|
|
090aae |
+
|
|
|
090aae |
+ client->frameBuffer=malloc( (size_t)allocSize );
|
|
|
090aae |
+
|
|
|
090aae |
+ if (client->frameBuffer == NULL)
|
|
|
090aae |
+ rfbClientErr("CRITICAL: frameBuffer allocation failed, requested size too large or not enough memory?\n");
|
|
|
090aae |
+
|
|
|
090aae |
return client->frameBuffer?TRUE:FALSE;
|
|
|
090aae |
}
|
|
|
090aae |
|