diff options
| author | Petr Písař <ppisar@redhat.com> | 2018-02-26 13:48:00 +0100 |
|---|---|---|
| committer | Slávek Banko <slavek.banko@axis.cz> | 2019-03-03 16:04:38 +0100 |
| commit | 20e7000d0cd56ab6e10d8f22b9caf922e655402c (patch) | |
| tree | 6c4e3bf1c50c29d6e56c8b78a6b4bfbbb65dbf77 /dcoprss/xmlrpciface.cpp | |
| parent | 6221931c63e88eda17f9bd3128470bffb3b2cee3 (diff) | |
| download | tdenetwork-20e7000d0cd56ab6e10d8f22b9caf922e655402c.tar.gz tdenetwork-20e7000d0cd56ab6e10d8f22b9caf922e655402c.zip | |
Limit client cut text length to 1 MB
This patch constrains a client cut text length to 1 MB. Otherwise
a client could make server allocate 2 GB of memory and that seems to
be to much to classify it as a denial of service.
The limit also prevents from an integer overflow followed by copying
an uninitilized memory when processing msg.cct.length value larger
than SIZE_MAX or INT_MAX - sz_rfbClientCutTextMsg.
This patch also corrects accepting length value of zero (malloc(0) is
interpreted on differnet systems differently).
CVE-2018-7225
<https://github.com/LibVNC/libvncserver/issues/218>
(cherry picked from commit 28afb6c537dc82ba04d5f245b15ca7205c6dbb9c)
Diffstat (limited to 'dcoprss/xmlrpciface.cpp')
0 files changed, 0 insertions, 0 deletions