|
 |
8b1cd8 |
diff -up tigervnc-1.3.0/common/CMakeLists.txt.CVE-2014-0011 tigervnc-1.3.0/common/CMakeLists.txt
|
|
|
8b1cd8 |
--- tigervnc-1.3.0/common/CMakeLists.txt.CVE-2014-0011 2013-07-01 13:42:01.000000000 +0100
|
|
|
8b1cd8 |
+++ tigervnc-1.3.0/common/CMakeLists.txt 2014-02-04 16:59:10.840037314 +0000
|
|
|
8b1cd8 |
@@ -23,3 +23,6 @@ if(CMAKE_COMPILER_IS_GNUCXX AND (CMAKE_S
|
|
|
8b1cd8 |
set_target_properties(zlib PROPERTIES COMPILE_FLAGS -fPIC)
|
|
|
8b1cd8 |
endif()
|
|
|
8b1cd8 |
endif()
|
|
|
8b1cd8 |
+
|
|
|
8b1cd8 |
+# Turn asserts on.
|
|
|
8b1cd8 |
+set_target_properties(rdr rfb PROPERTIES COMPILE_FLAGS -UNDEBUG)
|
|
|
8b1cd8 |
diff -up tigervnc-1.3.0/common/rfb/zrleDecode.h.CVE-2014-0011 tigervnc-1.3.0/common/rfb/zrleDecode.h
|
|
|
8b1cd8 |
--- tigervnc-1.3.0/common/rfb/zrleDecode.h.CVE-2014-0011 2013-07-01 13:41:59.000000000 +0100
|
|
|
8b1cd8 |
+++ tigervnc-1.3.0/common/rfb/zrleDecode.h 2014-02-04 16:17:00.881565540 +0000
|
|
|
8b1cd8 |
@@ -25,9 +25,10 @@
|
|
|
8b1cd8 |
// FILL_RECT - fill a rectangle with a single colour
|
|
|
8b1cd8 |
// IMAGE_RECT - draw a rectangle of pixel data from a buffer
|
|
|
8b1cd8 |
|
|
|
8b1cd8 |
+#include <stdio.h>
|
|
|
8b1cd8 |
#include <rdr/InStream.h>
|
|
|
8b1cd8 |
#include <rdr/ZlibInStream.h>
|
|
|
8b1cd8 |
-#include <assert.h>
|
|
|
8b1cd8 |
+#include <rfb/Exception.h>
|
|
|
8b1cd8 |
|
|
|
8b1cd8 |
namespace rfb {
|
|
|
8b1cd8 |
|
|
|
8b1cd8 |
@@ -143,7 +144,10 @@ void ZRLE_DECODE (const Rect& r, rdr::In
|
|
|
8b1cd8 |
len += b;
|
|
|
8b1cd8 |
} while (b == 255);
|
|
|
8b1cd8 |
|
|
|
8b1cd8 |
- assert(len <= end - ptr);
|
|
|
8b1cd8 |
+ if (end - ptr < len) {
|
|
|
8b1cd8 |
+ fprintf (stderr, "ZRLE decode error\n");
|
|
|
8b1cd8 |
+ throw Exception ("ZRLE decode error");
|
|
|
8b1cd8 |
+ }
|
|
|
8b1cd8 |
|
|
|
8b1cd8 |
#ifdef FAVOUR_FILL_RECT
|
|
|
8b1cd8 |
int i = ptr - buf;
|
|
|
8b1cd8 |
@@ -193,7 +197,10 @@ void ZRLE_DECODE (const Rect& r, rdr::In
|
|
|
8b1cd8 |
len += b;
|
|
|
8b1cd8 |
} while (b == 255);
|
|
|
8b1cd8 |
|
|
|
8b1cd8 |
- assert(len <= end - ptr);
|
|
|
8b1cd8 |
+ if (end - ptr < len) {
|
|
|
8b1cd8 |
+ fprintf (stderr, "ZRLE decode error\n");
|
|
|
8b1cd8 |
+ throw Exception ("ZRLE decode error");
|
|
|
8b1cd8 |
+ }
|
|
|
8b1cd8 |
}
|
|
|
8b1cd8 |
|
|
|
8b1cd8 |
index &= 127;
|