|
 |
38cbf9 |
From 54220248886b5001fbbb9fa73c4e1a2cb9413fed Mon Sep 17 00:00:00 2001
|
|
|
38cbf9 |
From: Christian Beier <dontmind@freeshell.org>
|
|
|
38cbf9 |
Date: Sun, 17 Nov 2019 17:18:35 +0100
|
|
|
38cbf9 |
Subject: [PATCH] libvncclient/cursor: limit width/height input values
|
|
|
38cbf9 |
MIME-Version: 1.0
|
|
|
38cbf9 |
Content-Type: text/plain; charset=UTF-8
|
|
|
38cbf9 |
Content-Transfer-Encoding: 8bit
|
|
|
38cbf9 |
|
|
|
38cbf9 |
Avoids a possible heap overflow reported by Pavel Cheremushkin
|
|
|
38cbf9 |
<Pavel.Cheremushkin@kaspersky.com>.
|
|
|
38cbf9 |
|
|
|
38cbf9 |
re #275
|
|
|
38cbf9 |
|
|
|
38cbf9 |
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
|
|
38cbf9 |
---
|
|
|
38cbf9 |
libvncclient/cursor.c | 5 +++++
|
|
|
38cbf9 |
1 file changed, 5 insertions(+)
|
|
|
38cbf9 |
|
|
|
38cbf9 |
diff --git a/libvncclient/cursor.c b/libvncclient/cursor.c
|
|
|
38cbf9 |
index 67f45726..40ffb3b0 100644
|
|
|
38cbf9 |
--- a/libvncclient/cursor.c
|
|
|
38cbf9 |
+++ b/libvncclient/cursor.c
|
|
|
38cbf9 |
@@ -28,6 +28,8 @@
|
|
|
38cbf9 |
#define OPER_SAVE 0
|
|
|
38cbf9 |
#define OPER_RESTORE 1
|
|
|
38cbf9 |
|
|
|
38cbf9 |
+#define MAX_CURSOR_SIZE 1024
|
|
|
38cbf9 |
+
|
|
|
38cbf9 |
#define RGB24_TO_PIXEL(bpp,r,g,b) \
|
|
|
38cbf9 |
((((uint##bpp##_t)(r) & 0xFF) * client->format.redMax + 127) / 255 \
|
|
|
38cbf9 |
<< client->format.redShift | \
|
|
|
38cbf9 |
@@ -54,6 +56,9 @@ rfbBool HandleCursorShape(rfbClient* client,int xhot, int yhot, int width, int h
|
|
|
38cbf9 |
if (width * height == 0)
|
|
|
38cbf9 |
return TRUE;
|
|
|
38cbf9 |
|
|
|
38cbf9 |
+ if (width >= MAX_CURSOR_SIZE || height >= MAX_CURSOR_SIZE)
|
|
|
38cbf9 |
+ return FALSE;
|
|
|
38cbf9 |
+
|
|
|
38cbf9 |
/* Allocate memory for pixel data and temporary mask data. */
|
|
|
38cbf9 |
if(client->rcSource)
|
|
|
38cbf9 |
free(client->rcSource);
|
|
|
38cbf9 |
--
|
|
|
38cbf9 |
2.21.1
|
|
|
38cbf9 |
|