hextileDecode.h: Fix buffer overflow
The hextileDecodexx functions do not properly check for out-of-bounds writes,
which allows a malicious server to overwrite parts of the stack.
diff --git a/common/rfb/hextileDecode.h b/common/rfb/hextileDecode.h
index 47006a0..402cd03 100644
--- a/common/rfb/hextileDecode.h
+++ b/common/rfb/hextileDecode.h
@@ -22,6 +22,7 @@
// BPP - 8, 16 or 32
#include <rdr/InStream.h>
+#include <rfb/Exception.h>
#include <rfb/hextileConstants.h>
namespace rfb {
@@ -87,6 +88,9 @@
int y = (xy & 15);
int w = ((wh >> 4) & 15) + 1;
int h = (wh & 15) + 1;
+ if (x + w > 16 || y + h > 16) {
+ throw rfb::Exception("HEXTILE_DECODE: Hextile out of bounds");
+ }
PIXEL_T* ptr = buf + y * t.width() + x;
int rowAdd = t.width() - w;
while (h-- > 0) {