diff options
| author | Petr Písař <ppisar@redhat.com> | 2018-02-26 13:48:00 +0100 |
|---|---|---|
| committer | Petr Písař <ppisar@redhat.com> | 2018-03-08 15:04:04 +0100 |
| commit | 28afb6c537dc82ba04d5f245b15ca7205c6dbb9c (patch) | |
| tree | 1151452897afb18dd3a9c03a2e4c84187386b24e /libvncserver/rfbssl_gnutls.c | |
| parent | 020c30f63d1b747c9001471c5d279db4890692e4 (diff) | |
| download | libtdevnc-28afb6c537dc82ba04d5f245b15ca7205c6dbb9c.tar.gz libtdevnc-28afb6c537dc82ba04d5f245b15ca7205c6dbb9c.zip | |
Limit client cut text length to 1 MB
This patch constrains a client cut text length to 1 MB. Otherwise
a client could make server allocate 2 GB of memory and that seems to
be to much to classify it as a denial of service.
The limit also prevents from an integer overflow followed by copying
an uninitilized memory when processing msg.cct.length value larger
than SIZE_MAX or INT_MAX - sz_rfbClientCutTextMsg.
This patch also corrects accepting length value of zero (malloc(0) is
interpreted on differnet systems differently).
CVE-2018-7225
<https://github.com/LibVNC/libvncserver/issues/218>
Diffstat (limited to 'libvncserver/rfbssl_gnutls.c')
0 files changed, 0 insertions, 0 deletions