summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorNicolas Ruff <nruff@google.com>2014-08-18 15:16:16 +0200
committerNicolas Ruff <nruff@google.com>2014-08-18 15:16:16 +0200
commit6037a9074d52b1963c97cb28ea1096c7c14cbf28 (patch)
tree06fc40f0c264b9f811439ef62fb1f2a8eec328b2
parent7c9ef6372d3ce2942fe78e853c611e269f68eb69 (diff)
downloadlibvncserver-6037a9074d52b1963c97cb28ea1096c7c14cbf28.zip
libvncserver-6037a9074d52b1963c97cb28ea1096c7c14cbf28.tar.gz
Check malloc() return value on client->server ClientCutText message. Client can send up to 2**32-1 bytes of text, and such a large allocation is likely to fail in case of high memory pressure. This would in a server crash (write at address 0).
-rw-r--r--libvncserver/rfbserver.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/libvncserver/rfbserver.c b/libvncserver/rfbserver.c
index 5f3b31d..7e43fe3 100644
--- a/libvncserver/rfbserver.c
+++ b/libvncserver/rfbserver.c
@@ -2461,6 +2461,11 @@ rfbProcessClientNormalMessage(rfbClientPtr cl)
msg.cct.length = Swap32IfLE(msg.cct.length);
str = (char *)malloc(msg.cct.length);
+ if (str == NULL) {
+ rfbLogPerror("rfbProcessClientNormalMessage: not enough memory");
+ rfbCloseClient(cl);
+ return;
+ }
if ((n = rfbReadExact(cl, str, msg.cct.length)) <= 0) {
if (n != 0)
OpenPOWER on IntegriCloud