Blame SOURCES/tigervnc-1.3.1-CVE-2014-8240.patch

288618
diff --git a/unix/x0vncserver/Image.cxx b/unix/x0vncserver/Image.cxx
418d68
index f998c6a..fb9dbd4 100644
288618
--- a/unix/x0vncserver/Image.cxx
288618
+++ b/unix/x0vncserver/Image.cxx
288618
@@ -80,6 +80,14 @@ void Image::Init(int width, int height)
288618
   xim = XCreateImage(dpy, vis, DefaultDepth(dpy, DefaultScreen(dpy)),
288618
                      ZPixmap, 0, 0, width, height, BitmapPad(dpy), 0);
288618
288618
+  if (xim->bytes_per_line <= 0 ||
288618
+      xim->height <= 0 ||
288618
+      xim->height >= INT_MAX / xim->bytes_per_line) {
288618
+    vlog.error("Invalid display size");
288618
+    XDestroyImage(xim);
288618
+    exit(1);
288618
+  }
288618
+
288618
   xim->data = (char *)malloc(xim->bytes_per_line * xim->height);
288618
   if (xim->data == NULL) {
288618
     vlog.error("malloc() failed");
288618
@@ -256,6 +264,17 @@ void ShmImage::Init(int width, int height, const XVisualInfo *vinfo)
288618
     return;
288618
   }
288618
288618
+  if (xim->bytes_per_line <= 0 ||
288618
+      xim->height <= 0 ||
288618
+      xim->height >= INT_MAX / xim->bytes_per_line) {
288618
+    vlog.error("Invalid display size");
288618
+    XDestroyImage(xim);
288618
+    xim = NULL;
288618
+    delete shminfo;
288618
+    shminfo = NULL;
288618
+    return;
288618
+  }
288618
+
288618
   shminfo->shmid = shmget(IPC_PRIVATE,
288618
                           xim->bytes_per_line * xim->height,
288618
                           IPC_CREAT|0777);
418d68
diff --git a/vncviewer/PlatformPixelBuffer.cxx b/vncviewer/PlatformPixelBuffer.cxx
418d68
index a2b506d..9266d9f 100644
418d68
--- a/vncviewer/PlatformPixelBuffer.cxx
418d68
+++ b/vncviewer/PlatformPixelBuffer.cxx
418d68
@@ -49,6 +49,15 @@ PlatformPixelBuffer::PlatformPixelBuffer(int width, int height) :
418d68
     if (!xim)
418d68
       throw rdr::Exception("XCreateImage");
288618
288618
+    if (xim->bytes_per_line <= 0 ||
418d68
+       xim->height <= 0 ||
418d68
+       xim->height >= INT_MAX / xim->bytes_per_line) {
288618
+      if (xim)
418d68
+       XDestroyImage(xim);
288618
+      xim = NULL;
418d68
+      throw rdr::Exception("Invalid display size");
288618
+    }
288618
+
288618
     xim->data = (char*)malloc(xim->bytes_per_line * xim->height);
418d68
     if (!xim->data)
418d68
       throw rdr::Exception("malloc");
418d68
@@ -152,6 +161,16 @@ bool PlatformPixelBuffer::setupShm()
288618
   if (!xim)
288618
     goto free_shminfo;
288618
288618
+  if (xim->bytes_per_line <= 0 ||
288618
+      xim->height <= 0 ||
288618
+      xim->height >= INT_MAX / xim->bytes_per_line) {
288618
+    XDestroyImage(xim);
288618
+    xim = NULL;
288618
+    delete shminfo;
288618
+    shminfo = NULL;
418d68
+    throw rdr::Exception("Invalid display size");
288618
+  }
288618
+
288618
   shminfo->shmid = shmget(IPC_PRIVATE,
288618
                           xim->bytes_per_line * xim->height,
418d68
                           IPC_CREAT|0600);