diff options
| author | Christian Beier <dontmind@freeshell.org> | 2018-10-04 22:27:39 +0200 |
|---|---|---|
| committer | Christian Beier <dontmind@freeshell.org> | 2018-10-04 22:27:39 +0200 |
| commit | 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d (patch) | |
| tree | dde0cd4f6bbcf7aae5cf892f2f93e39001b8078b | |
| parent | 459046efc023161642c599809c6a5ef733035a12 (diff) | |
| download | libtdevnc-7b1ef0ffc4815cab9a96c7278394152bdc89dc4d.tar.gz libtdevnc-7b1ef0ffc4815cab9a96c7278394152bdc89dc4d.zip | |
LibVNCClient: really fix #250
| -rw-r--r-- | libvncclient/corre.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libvncclient/corre.c b/libvncclient/corre.c index 55107b1..cbc986a 100644 --- a/libvncclient/corre.c +++ b/libvncclient/corre.c @@ -48,7 +48,7 @@ HandleCoRREBPP (rfbClient* client, int rx, int ry, int rw, int rh) client->GotFillRect(client, rx, ry, rw, rh, pix); - if (hdr.nSubrects * (4 + (BPP / 8)) > RFB_BUFFER_SIZE || !ReadFromRFBServer(client, client->buffer, hdr.nSubrects * (4 + (BPP / 8)))) + if (hdr.nSubrects > RFB_BUFFER_SIZE / (4 + (BPP / 8)) || !ReadFromRFBServer(client, client->buffer, hdr.nSubrects * (4 + (BPP / 8)))) return FALSE; ptr = (uint8_t *)client->buffer; |