Blame SOURCES/tigervnc-CVE-2019-15693.patch

12537a
From b4ada8d0c6dac98c8b91fc64d112569a8ae5fb95 Mon Sep 17 00:00:00 2001
12537a
From: Pierre Ossman <ossman@cendio.se>
12537a
Date: Tue, 10 Sep 2019 15:36:42 +0200
12537a
Subject: [PATCH] Handle empty Tight gradient rects
12537a
12537a
We always assumed there would be one pixel per row so a rect with
12537a
a zero width would result in us writing to unknown memory.
12537a
12537a
This could theoretically be used by a malicious server to inject
12537a
code in to the viewer process.
12537a
12537a
Issue found by Pavel Cheremushkin from Kaspersky Lab.
12537a
---
12537a
 common/rfb/tightDecode.h | 37 +++++++++++++++++++++----------------
12537a
 1 file changed, 21 insertions(+), 16 deletions(-)
12537a
12537a
diff --git a/common/rfb/tightDecode.h b/common/rfb/tightDecode.h
12537a
index b6e86ed5e..8f77aebd0 100644
12537a
--- a/common/rfb/tightDecode.h
12537a
+++ b/common/rfb/tightDecode.h
12537a
@@ -56,15 +56,17 @@ TightDecoder::FilterGradient24(const rdr::U8 *inbuf,
12537a
   int rectWidth = r.width();
12537a
 
12537a
   for (y = 0; y < rectHeight; y++) {
12537a
-    /* First pixel in a row */
12537a
-    for (c = 0; c < 3; c++) {
12537a
-      pix[c] = inbuf[y*rectWidth*3+c] + prevRow[c];
12537a
-      thisRow[c] = pix[c];
12537a
-    }
12537a
-    pf.bufferFromRGB((rdr::U8*)&outbuf[y*stride], pix, 1);
12537a
+    for (x = 0; x < rectWidth; x++) {
12537a
+      /* First pixel in a row */
12537a
+      if (x == 0) {
12537a
+        for (c = 0; c < 3; c++) {
12537a
+          pix[c] = inbuf[y*rectWidth*3+c] + prevRow[c];
12537a
+          thisRow[c] = pix[c];
12537a
+        }
12537a
+        pf.bufferFromRGB((rdr::U8*)&outbuf[y*stride], pix, 1);
12537a
+        continue;
12537a
+      }
12537a
 
12537a
-    /* Remaining pixels of a row */
12537a
-    for (x = 1; x < rectWidth; x++) {
12537a
       for (c = 0; c < 3; c++) {
12537a
         est[c] = prevRow[x*3+c] + pix[c] - prevRow[(x-1)*3+c];
12537a
         if (est[c] > 0xff) {
12537a
@@ -103,17 +105,20 @@ void TightDecoder::FilterGradient(const rdr::U8* inbuf,
12537a
   int rectWidth = r.width();
12537a
 
12537a
   for (y = 0; y < rectHeight; y++) {
12537a
-    /* First pixel in a row */
12537a
-    pf.rgbFromBuffer(pix, &inbuf[y*rectWidth], 1);
12537a
-    for (c = 0; c < 3; c++)
12537a
-      pix[c] += prevRow[c];
12537a
+    for (x = 0; x < rectWidth; x++) {
12537a
+      /* First pixel in a row */
12537a
+      if (x == 0) {
12537a
+        pf.rgbFromBuffer(pix, &inbuf[y*rectWidth], 1);
12537a
+        for (c = 0; c < 3; c++)
12537a
+          pix[c] += prevRow[c];
12537a
 
12537a
-    memcpy(thisRow, pix, sizeof(pix));
12537a
+        memcpy(thisRow, pix, sizeof(pix));
12537a
 
12537a
-    pf.bufferFromRGB((rdr::U8*)&outbuf[y*stride], pix, 1);
12537a
+        pf.bufferFromRGB((rdr::U8*)&outbuf[y*stride], pix, 1);
12537a
+
12537a
+        continue;
12537a
+      }
12537a
 
12537a
-    /* Remaining pixels of a row */
12537a
-    for (x = 1; x < rectWidth; x++) {
12537a
       for (c = 0; c < 3; c++) {
12537a
         est[c] = prevRow[x*3+c] + pix[c] - prevRow[(x-1)*3+c];
12537a
         if (est[c] > 255) {