Blob Blame History Raw
From 3fd03977c9b35800d73a865f167338cb4d05b0c1 Mon Sep 17 00:00:00 2001
From: Christian Beier <dontmind@freeshell.org>
Date: Sat, 6 Apr 2019 20:23:12 +0200
Subject: [PATCH] libvncclient: bail out if unix socket name would overflow

Closes #291
---
 libvncclient/sockets.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libvncclient/sockets.c b/libvncclient/sockets.c
index f042472f..821f85ca 100644
--- a/libvncclient/sockets.c
+++ b/libvncclient/sockets.c
@@ -461,6 +461,10 @@ ConnectClientToUnixSock(const char *sockFile)
   int sock;
   struct sockaddr_un addr;
   addr.sun_family = AF_UNIX;
+  if(strlen(sockFile) + 1 > sizeof(addr.sun_path)) {
+      rfbClientErr("ConnectToUnixSock: socket file name too long\n");
+      return -1;
+  }
   strcpy(addr.sun_path, sockFile);
 
   sock = socket(AF_UNIX, SOCK_STREAM, 0);