|
 |
12537a |
From b4ada8d0c6dac98c8b91fc64d112569a8ae5fb95 Mon Sep 17 00:00:00 2001
|
|
|
12537a |
From: Pierre Ossman <ossman@cendio.se>
|
|
|
12537a |
Date: Tue, 10 Sep 2019 15:36:42 +0200
|
|
|
12537a |
Subject: [PATCH] Handle empty Tight gradient rects
|
|
|
12537a |
|
|
|
12537a |
We always assumed there would be one pixel per row so a rect with
|
|
|
12537a |
a zero width would result in us writing to unknown memory.
|
|
|
12537a |
|
|
|
12537a |
This could theoretically be used by a malicious server to inject
|
|
|
12537a |
code in to the viewer process.
|
|
|
12537a |
|
|
|
12537a |
Issue found by Pavel Cheremushkin from Kaspersky Lab.
|
|
|
12537a |
---
|
|
|
12537a |
common/rfb/tightDecode.h | 37 +++++++++++++++++++++----------------
|
|
|
12537a |
1 file changed, 21 insertions(+), 16 deletions(-)
|
|
|
12537a |
|
|
|
12537a |
diff --git a/common/rfb/tightDecode.h b/common/rfb/tightDecode.h
|
|
|
12537a |
index b6e86ed5e..8f77aebd0 100644
|
|
|
12537a |
--- a/common/rfb/tightDecode.h
|
|
|
12537a |
+++ b/common/rfb/tightDecode.h
|
|
|
12537a |
@@ -56,15 +56,17 @@ TightDecoder::FilterGradient24(const rdr::U8 *inbuf,
|
|
|
12537a |
int rectWidth = r.width();
|
|
|
12537a |
|
|
|
12537a |
for (y = 0; y < rectHeight; y++) {
|
|
|
12537a |
- /* First pixel in a row */
|
|
|
12537a |
- for (c = 0; c < 3; c++) {
|
|
|
12537a |
- pix[c] = inbuf[y*rectWidth*3+c] + prevRow[c];
|
|
|
12537a |
- thisRow[c] = pix[c];
|
|
|
12537a |
- }
|
|
|
12537a |
- pf.bufferFromRGB((rdr::U8*)&outbuf[y*stride], pix, 1);
|
|
|
12537a |
+ for (x = 0; x < rectWidth; x++) {
|
|
|
12537a |
+ /* First pixel in a row */
|
|
|
12537a |
+ if (x == 0) {
|
|
|
12537a |
+ for (c = 0; c < 3; c++) {
|
|
|
12537a |
+ pix[c] = inbuf[y*rectWidth*3+c] + prevRow[c];
|
|
|
12537a |
+ thisRow[c] = pix[c];
|
|
|
12537a |
+ }
|
|
|
12537a |
+ pf.bufferFromRGB((rdr::U8*)&outbuf[y*stride], pix, 1);
|
|
|
12537a |
+ continue;
|
|
|
12537a |
+ }
|
|
|
12537a |
|
|
|
12537a |
- /* Remaining pixels of a row */
|
|
|
12537a |
- for (x = 1; x < rectWidth; x++) {
|
|
|
12537a |
for (c = 0; c < 3; c++) {
|
|
|
12537a |
est[c] = prevRow[x*3+c] + pix[c] - prevRow[(x-1)*3+c];
|
|
|
12537a |
if (est[c] > 0xff) {
|
|
|
12537a |
@@ -103,17 +105,20 @@ void TightDecoder::FilterGradient(const rdr::U8* inbuf,
|
|
|
12537a |
int rectWidth = r.width();
|
|
|
12537a |
|
|
|
12537a |
for (y = 0; y < rectHeight; y++) {
|
|
|
12537a |
- /* First pixel in a row */
|
|
|
12537a |
- pf.rgbFromBuffer(pix, &inbuf[y*rectWidth], 1);
|
|
|
12537a |
- for (c = 0; c < 3; c++)
|
|
|
12537a |
- pix[c] += prevRow[c];
|
|
|
12537a |
+ for (x = 0; x < rectWidth; x++) {
|
|
|
12537a |
+ /* First pixel in a row */
|
|
|
12537a |
+ if (x == 0) {
|
|
|
12537a |
+ pf.rgbFromBuffer(pix, &inbuf[y*rectWidth], 1);
|
|
|
12537a |
+ for (c = 0; c < 3; c++)
|
|
|
12537a |
+ pix[c] += prevRow[c];
|
|
|
12537a |
|
|
|
12537a |
- memcpy(thisRow, pix, sizeof(pix));
|
|
|
12537a |
+ memcpy(thisRow, pix, sizeof(pix));
|
|
|
12537a |
|
|
|
12537a |
- pf.bufferFromRGB((rdr::U8*)&outbuf[y*stride], pix, 1);
|
|
|
12537a |
+ pf.bufferFromRGB((rdr::U8*)&outbuf[y*stride], pix, 1);
|
|
|
12537a |
+
|
|
|
12537a |
+ continue;
|
|
|
12537a |
+ }
|
|
|
12537a |
|
|
|
12537a |
- /* Remaining pixels of a row */
|
|
|
12537a |
- for (x = 1; x < rectWidth; x++) {
|
|
|
12537a |
for (c = 0; c < 3; c++) {
|
|
|
12537a |
est[c] = prevRow[x*3+c] + pix[c] - prevRow[(x-1)*3+c];
|
|
|
12537a |
if (est[c] > 255) {
|