commit 6037a9074d52b1963c97cb28ea1096c7c14cbf28

Author: Nicolas Ruff <nruff@google.com>

Date:   Mon Aug 18 15:16:16 2014 +0200

    Check malloc() return value on client->server ClientCutText message. Client can send up to 2**32-1 bytes of text, and such a large allocation is likely to fail in case of high memory pressure. This would in a server crash (write at address 0).

diff --git a/libvncserver/rfbserver.c b/libvncserver/rfbserver.c

index 5f3b31d..7e43fe3 100644

--- a/libvncserver/rfbserver.c

+++ b/libvncserver/rfbserver.c

@@ -2461,6 +2461,11 @@ rfbProcessClientNormalMessage(rfbClientPtr cl)

 	msg.cct.length = Swap32IfLE(msg.cct.length);

 	str = (char *)malloc(msg.cct.length);

+	if (str == NULL) {

+		rfbLogPerror("rfbProcessClientNormalMessage: not enough memory");

+		rfbCloseClient(cl);

+		return;

+	}

 	if ((n = rfbReadExact(cl, str, msg.cct.length)) <= 0) {

 	    if (n != 0)