summaryrefslogtreecommitdiffstats
path: root/libvncserver/rfbserver.c
diff options
context:
space:
mode:
Diffstat (limited to 'libvncserver/rfbserver.c')
-rw-r--r--libvncserver/rfbserver.c18
1 files changed, 14 insertions, 4 deletions
diff --git a/libvncserver/rfbserver.c b/libvncserver/rfbserver.c
index 2567f23..767b673 100644
--- a/libvncserver/rfbserver.c
+++ b/libvncserver/rfbserver.c
@@ -3062,12 +3062,20 @@ rfbSendSetColourMapEntries(rfbClientPtr cl,
int nColours)
{
char buf[sz_rfbSetColourMapEntriesMsg + 256 * 3 * 2];
- rfbSetColourMapEntriesMsg *scme = (rfbSetColourMapEntriesMsg *)buf;
- uint16_t *rgb = (uint16_t *)(&buf[sz_rfbSetColourMapEntriesMsg]);
+ char *wbuf = buf;
+ rfbSetColourMapEntriesMsg *scme;
+ uint16_t *rgb;
rfbColourMap* cm = &cl->screen->colourMap;
-
int i, len;
+ if (nColours > 256) {
+ /* some rare hardware has, e.g., 4096 colors cells: PseudoColor:12 */
+ wbuf = (char *) malloc(sz_rfbSetColourMapEntriesMsg + nColours * 3 * 2);
+ }
+
+ scme = (rfbSetColourMapEntriesMsg *)wbuf;
+ rgb = (uint16_t *)(&wbuf[sz_rfbSetColourMapEntriesMsg]);
+
scme->type = rfbSetColourMapEntries;
scme->firstColour = Swap16IfLE(firstColour);
@@ -3091,13 +3099,15 @@ rfbSendSetColourMapEntries(rfbClientPtr cl,
len += nColours * 3 * 2;
- if (rfbWriteExact(cl, buf, len) < 0) {
+ if (rfbWriteExact(cl, wbuf, len) < 0) {
rfbLogPerror("rfbSendSetColourMapEntries: write");
rfbCloseClient(cl);
+ if (wbuf != buf) free(wbuf);
return FALSE;
}
rfbStatRecordMessageSent(cl, rfbSetColourMapEntries, len, len);
+ if (wbuf != buf) free(wbuf);
return TRUE;
}