de37ba2f0a
- CVE-2014-6051 (#1144287) - CVE-2014-6052 (#1144288) - CVE-2014-6053 (#1144289) - CVE-2014-6054 (#1144291) - CVE-2014-6055 (#1144293)
23 lines
899 B
Diff
23 lines
899 B
Diff
commit 6037a9074d52b1963c97cb28ea1096c7c14cbf28
|
|
Author: Nicolas Ruff <nruff@google.com>
|
|
Date: Mon Aug 18 15:16:16 2014 +0200
|
|
|
|
Check malloc() return value on client->server ClientCutText message. Client can send up to 2**32-1 bytes of text, and such a large allocation is likely to fail in case of high memory pressure. This would in a server crash (write at address 0).
|
|
|
|
diff --git a/libvncserver/rfbserver.c b/libvncserver/rfbserver.c
|
|
index 5f3b31d..7e43fe3 100644
|
|
--- a/libvncserver/rfbserver.c
|
|
+++ b/libvncserver/rfbserver.c
|
|
@@ -2461,6 +2461,11 @@ rfbProcessClientNormalMessage(rfbClientPtr cl)
|
|
msg.cct.length = Swap32IfLE(msg.cct.length);
|
|
|
|
str = (char *)malloc(msg.cct.length);
|
|
+ if (str == NULL) {
|
|
+ rfbLogPerror("rfbProcessClientNormalMessage: not enough memory");
|
|
+ rfbCloseClient(cl);
|
|
+ return;
|
|
+ }
|
|
|
|
if ((n = rfbReadExact(cl, str, msg.cct.length)) <= 0) {
|
|
if (n != 0)
|