Blame SOURCES/libvncserver-0.9.11-CVE-2018-21247.patch

07ca88
From d87d25516b3992e52cf79e3cd6bd331b0baceecf Mon Sep 17 00:00:00 2001
07ca88
From: Christian Beier <dontmind@freeshell.org>
07ca88
Date: Sun, 17 Nov 2019 16:21:18 +0100
07ca88
Subject: [PATCH] When connecting to a repeater, make sure to not leak memory
07ca88
07ca88
Really closes #253
07ca88
---
07ca88
 examples/repeater.c     | 1 +
07ca88
 libvncclient/rfbproto.c | 1 +
07ca88
 2 files changed, 2 insertions(+)
07ca88
07ca88
diff --git a/examples/repeater.c b/examples/repeater.c
07ca88
index cf0350ff..7047578d 100644
07ca88
--- a/examples/repeater.c
07ca88
+++ b/examples/repeater.c
07ca88
@@ -23,6 +23,7 @@ int main(int argc,char** argv)
07ca88
       "Usage: %s <id> <repeater-host> [<repeater-port>]\n", argv[0]);
07ca88
     exit(1);
07ca88
   }
07ca88
+  memset(id, 0, sizeof(id));
07ca88
   snprintf(id, sizeof(id) - 1, "ID:%s", argv[1]);
07ca88
   repeaterHost = argv[2];
07ca88
   repeaterPort = argc < 4 ? 5500 : atoi(argv[3]);
07ca88
diff --git a/libvncclient/rfbproto.c b/libvncclient/rfbproto.c
07ca88
index 6c07d97e..675248fa 100644
07ca88
--- a/libvncclient/rfbproto.c
07ca88
+++ b/libvncclient/rfbproto.c
07ca88
@@ -402,6 +402,7 @@ rfbBool ConnectToRFBRepeater(rfbClient* client,const char *repeaterHost, int rep
07ca88
 
07ca88
   rfbClientLog("Connected to VNC repeater, using protocol version %d.%d\n", major, minor);
07ca88
 
07ca88
+  memset(tmphost, 0, sizeof(tmphost));
07ca88
   snprintf(tmphost, sizeof(tmphost), "%s:%d", destHost, destPort);
07ca88
   if (!WriteToRFBServer(client, tmphost, sizeof(tmphost)))
07ca88
     return FALSE;