commit 05a9bd41a8ec0a9d580a8f420f41718bdd235446

Author: Nicolas Ruff <nruff@google.com>

Date:   Mon Aug 18 15:22:48 2014 +0200

    Do not accept a scaling factor of zero on PalmVNCSetScaleFactor and SetScale client->server messages. This would cause a division by zero and crash the server.

diff --git a/libvncserver/rfbserver.c b/libvncserver/rfbserver.c

index 7e43fe3..df7d74c 100644

--- a/libvncserver/rfbserver.c

+++ b/libvncserver/rfbserver.c

@@ -2491,6 +2491,13 @@ rfbProcessClientNormalMessage(rfbClientPtr cl)

           rfbCloseClient(cl);

           return;

       }

+

+      if (msg.ssc.scale == 0) {

+          rfbLogPerror("rfbProcessClientNormalMessage: will not accept a scale factor of zero");

+          rfbCloseClient(cl);

+          return;

+      }

+

       rfbStatRecordMessageRcvd(cl, msg.type, sz_rfbSetScaleMsg, sz_rfbSetScaleMsg);

       rfbLog("rfbSetScale(%d)\n", msg.ssc.scale);

       rfbScalingSetup(cl,cl->screen->width/msg.ssc.scale, cl->screen->height/msg.ssc.scale);

@@ -2507,6 +2514,13 @@ rfbProcessClientNormalMessage(rfbClientPtr cl)

           rfbCloseClient(cl);

           return;

       }

+

+      if (msg.ssc.scale == 0) {

+          rfbLogPerror("rfbProcessClientNormalMessage: will not accept a scale factor of zero");

+          rfbCloseClient(cl);

+          return;

+      }

+

       rfbStatRecordMessageRcvd(cl, msg.type, sz_rfbSetScaleMsg, sz_rfbSetScaleMsg);

       rfbLog("rfbSetScale(%d)\n", msg.ssc.scale);

       rfbScalingSetup(cl,cl->screen->width/msg.ssc.scale, cl->screen->height/msg.ssc.scale);