From 35d481a783474d8b5eab4e9924008414253bbf4c Mon Sep 17 00:00:00 2001
From: dscho <dscho>
Date: Thu, 1 Feb 2007 15:02:59 +0000
Subject: [PATCH] sometimes zrle sends too many bytes; play safe

---
 libvncclient/zrle.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libvncclient/zrle.c b/libvncclient/zrle.c
index 701fb43..ac4aace 100644
--- a/libvncclient/zrle.c
+++ b/libvncclient/zrle.c
@@ -56,6 +56,7 @@ HandleZRLE (rfbClient* client, int rx, int ry, int rw, int rh)
 	int remaining;
 	int inflateResult;
 	int toRead;
+	int min_buffer_size = rw * rh * (REALBPP / 8) * 2;
 
 	/* First make sure we have a large enough raw buffer to hold the
 	 * decompressed data.  In practice, with a fixed REALBPP, fixed frame
@@ -63,7 +64,7 @@ HandleZRLE (rfbClient* client, int rx, int ry, int rw, int rh)
 	 * buffer, this buffer allocation should only happen once, on the
 	 * first update.
 	 */
-	if ( client->raw_buffer_size < (( rw * rh ) * ( REALBPP / 8 ))) {
+	if ( client->raw_buffer_size < min_buffer_size) {
 
 		if ( client->raw_buffer != NULL ) {
 
@@ -71,7 +72,7 @@ HandleZRLE (rfbClient* client, int rx, int ry, int rw, int rh)
 
 		}
 
-		client->raw_buffer_size = (( rw * rh ) * ( REALBPP / 8 ));
+		client->raw_buffer_size = min_buffer_size;
 		client->raw_buffer = (char*) malloc( client->raw_buffer_size );
 
 	}