diff options
| author | Nicolas Ruff <nruff@google.com> | 2014-08-18 15:16:16 +0200 |
|---|---|---|
| committer | Nicolas Ruff <nruff@google.com> | 2014-08-18 15:16:16 +0200 |
| commit | 6037a9074d52b1963c97cb28ea1096c7c14cbf28 (patch) | |
| tree | 06fc40f0c264b9f811439ef62fb1f2a8eec328b2 /libvncserver/rfbserver.c | |
| parent | 7c9ef6372d3ce2942fe78e853c611e269f68eb69 (diff) | |
| download | libtdevnc-6037a9074d52b1963c97cb28ea1096c7c14cbf28.tar.gz libtdevnc-6037a9074d52b1963c97cb28ea1096c7c14cbf28.zip | |
Check malloc() return value on client->server ClientCutText message. Client can send up to 2**32-1 bytes of text, and such a large allocation is likely to fail in case of high memory pressure. This would in a server crash (write at address 0).
Diffstat (limited to 'libvncserver/rfbserver.c')
| -rw-r--r-- | libvncserver/rfbserver.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libvncserver/rfbserver.c b/libvncserver/rfbserver.c index 5f3b31d..7e43fe3 100644 --- a/libvncserver/rfbserver.c +++ b/libvncserver/rfbserver.c @@ -2461,6 +2461,11 @@ rfbProcessClientNormalMessage(rfbClientPtr cl) msg.cct.length = Swap32IfLE(msg.cct.length); str = (char *)malloc(msg.cct.length); + if (str == NULL) { + rfbLogPerror("rfbProcessClientNormalMessage: not enough memory"); + rfbCloseClient(cl); + return; + } if ((n = rfbReadExact(cl, str, msg.cct.length)) <= 0) { if (n != 0) |