|
 |
288618 |
diff --git a/unix/x0vncserver/Image.cxx b/unix/x0vncserver/Image.cxx
|
|
|
288618 |
index f998c6a..d113f17 100644
|
|
|
288618 |
--- a/unix/x0vncserver/Image.cxx
|
|
|
288618 |
+++ b/unix/x0vncserver/Image.cxx
|
|
|
288618 |
@@ -80,6 +80,14 @@ void Image::Init(int width, int height)
|
|
|
288618 |
xim = XCreateImage(dpy, vis, DefaultDepth(dpy, DefaultScreen(dpy)),
|
|
|
288618 |
ZPixmap, 0, 0, width, height, BitmapPad(dpy), 0);
|
|
|
288618 |
|
|
|
288618 |
+ if (xim->bytes_per_line <= 0 ||
|
|
|
288618 |
+ xim->height <= 0 ||
|
|
|
288618 |
+ xim->height >= INT_MAX / xim->bytes_per_line) {
|
|
|
288618 |
+ vlog.error("Invalid display size");
|
|
|
288618 |
+ XDestroyImage(xim);
|
|
|
288618 |
+ exit(1);
|
|
|
288618 |
+ }
|
|
|
288618 |
+
|
|
|
288618 |
xim->data = (char *)malloc(xim->bytes_per_line * xim->height);
|
|
|
288618 |
if (xim->data == NULL) {
|
|
|
288618 |
vlog.error("malloc() failed");
|
|
|
288618 |
@@ -256,6 +264,17 @@ void ShmImage::Init(int width, int height, const XVisualInfo *vinfo)
|
|
|
288618 |
return;
|
|
|
288618 |
}
|
|
|
288618 |
|
|
|
288618 |
+ if (xim->bytes_per_line <= 0 ||
|
|
|
288618 |
+ xim->height <= 0 ||
|
|
|
288618 |
+ xim->height >= INT_MAX / xim->bytes_per_line) {
|
|
|
288618 |
+ vlog.error("Invalid display size");
|
|
|
288618 |
+ XDestroyImage(xim);
|
|
|
288618 |
+ xim = NULL;
|
|
|
288618 |
+ delete shminfo;
|
|
|
288618 |
+ shminfo = NULL;
|
|
|
288618 |
+ return;
|
|
|
288618 |
+ }
|
|
|
288618 |
+
|
|
|
288618 |
shminfo->shmid = shmget(IPC_PRIVATE,
|
|
|
288618 |
xim->bytes_per_line * xim->height,
|
|
|
288618 |
IPC_CREAT|0777);
|
|
|
288618 |
diff --git a/vncviewer/X11PixelBuffer.cxx b/vncviewer/X11PixelBuffer.cxx
|
|
|
288618 |
index bd0610c..2c493c9 100644
|
|
|
288618 |
--- a/vncviewer/X11PixelBuffer.cxx
|
|
|
288618 |
+++ b/vncviewer/X11PixelBuffer.cxx
|
|
|
288618 |
@@ -105,6 +105,15 @@ PlatformPixelBuffer::PlatformPixelBuffer(int width, int height) :
|
|
|
288618 |
ZPixmap, 0, 0, width, height, BitmapPad(fl_display), 0);
|
|
|
288618 |
assert(xim);
|
|
|
288618 |
|
|
|
288618 |
+ if (xim->bytes_per_line <= 0 ||
|
|
|
288618 |
+ xim->height <= 0 ||
|
|
|
288618 |
+ xim->height >= INT_MAX / xim->bytes_per_line) {
|
|
|
288618 |
+ if (xim)
|
|
|
288618 |
+ XDestroyImage(xim);
|
|
|
288618 |
+ xim = NULL;
|
|
|
288618 |
+ throw rfb::Exception("Invalid display size");
|
|
|
288618 |
+ }
|
|
|
288618 |
+
|
|
|
288618 |
xim->data = (char*)malloc(xim->bytes_per_line * xim->height);
|
|
|
288618 |
assert(xim->data);
|
|
|
288618 |
}
|
|
|
288618 |
@@ -169,6 +178,16 @@ int PlatformPixelBuffer::setupShm()
|
|
|
288618 |
if (!xim)
|
|
|
288618 |
goto free_shminfo;
|
|
|
288618 |
|
|
|
288618 |
+ if (xim->bytes_per_line <= 0 ||
|
|
|
288618 |
+ xim->height <= 0 ||
|
|
|
288618 |
+ xim->height >= INT_MAX / xim->bytes_per_line) {
|
|
|
288618 |
+ XDestroyImage(xim);
|
|
|
288618 |
+ xim = NULL;
|
|
|
288618 |
+ delete shminfo;
|
|
|
288618 |
+ shminfo = NULL;
|
|
|
288618 |
+ throw rfb::Exception("Invalid display size");
|
|
|
288618 |
+ }
|
|
|
288618 |
+
|
|
|
288618 |
shminfo->shmid = shmget(IPC_PRIVATE,
|
|
|
288618 |
xim->bytes_per_line * xim->height,
|
|
|
288618 |
IPC_CREAT|0777);
|