You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
28afb6c537
This patch constrains a client cut text length to 1 MB. Otherwise a client could make server allocate 2 GB of memory and that seems to be to much to classify it as a denial of service. The limit also prevents from an integer overflow followed by copying an uninitilized memory when processing msg.cct.length value larger than SIZE_MAX or INT_MAX - sz_rfbClientCutTextMsg. This patch also corrects accepting length value of zero (malloc(0) is interpreted on differnet systems differently). CVE-2018-7225 <https://github.com/LibVNC/libvncserver/issues/218> |
8 years ago | |
|---|---|---|
| .. | ||
| tightvnc-filetransfer | 9 years ago | |
| auth.c | 14 years ago | |
| cargs.c | 11 years ago | |
| corre.c | 15 years ago | |
| cursor.c | 16 years ago | |
| cutpaste.c | 15 years ago | |
| draw.c | 15 years ago | |
| font.c | 9 years ago | |
| hextile.c | 15 years ago | |
| httpd.c | 9 years ago | |
| main.c | 9 years ago | |
| private.h | 15 years ago | |
| rfbcrypto.h | 9 years ago | |
| rfbcrypto_gnutls.c | 15 years ago | |
| rfbcrypto_included.c | 11 years ago | |
| rfbcrypto_openssl.c | 15 years ago | |
| rfbcrypto_polarssl.c | 15 years ago | |
| rfbregion.c | 12 years ago | |
| rfbserver.c | 8 years ago | |
| rfbssl.h | 15 years ago | |
| rfbssl_gnutls.c | 11 years ago | |
| rfbssl_none.c | 15 years ago | |
| rfbssl_openssl.c | 15 years ago | |
| rre.c | 15 years ago | |
| scale.c | 9 years ago | |
| scale.h | 15 years ago | |
| selbox.c | 12 years ago | |
| sockets.c | 9 years ago | |
| stats.c | 12 years ago | |
| tableinit24.c | 15 years ago | |
| tableinitcmtemplate.c | 15 years ago | |
| tableinittctemplate.c | 15 years ago | |
| tabletrans24template.c | 15 years ago | |
| tabletranstemplate.c | 15 years ago | |
| tight.c | 11 years ago | |
| translate.c | 15 years ago | |
| ultra.c | 11 years ago | |
| websockets.c | 9 years ago | |
| ws_decode.c | 9 years ago | |
| ws_decode.h | 9 years ago | |
| zlib.c | 11 years ago | |
| zrle.c | 15 years ago | |
| zrleencodetemplate.c | 15 years ago | |
| zrleoutstream.c | 21 years ago | |
| zrleoutstream.h | 22 years ago | |
| zrlepalettehelper.c | 22 years ago | |
| zrlepalettehelper.h | 22 years ago | |
| zrletypes.h | 15 years ago | |