commit 466de9c52e925ea784fe4ce455741b2638ee3e94
author Pierre Ossman <ossman@cendio.se> Wed Jan 18 13:33:48 2017 +0100
committer Pierre Ossman <ossman@cendio.se> Wed Jan 18 13:33:48 2017 +0100
tree 899a02b00d4103aa45bab4d6a180c853c3349f18
parent 18c020124ff1b2441f714da2017f63dba50720ba

Check invalid RRE rects

common/rfb/rreDecode.h

diff --git a/common/rfb/rreDecode.h b/common/rfb/rreDecode.h
index 56defbd..f9fdcfc 100644
--- a/common/rfb/rreDecode.h
+++ b/common/rfb/rreDecode.h
@@ -22,6 +22,7 @@
 // BPP                - 8, 16 or 32
 
 #include <rdr/InStream.h>
+#include <rfb/Exception.h>
 
 namespace rfb {
 
@@ -49,6 +50,10 @@
     int y = is->readU16();
     int w = is->readU16();
     int h = is->readU16();
+
+    if (((x+w) > r.width()) || ((y+h) > r.height()))
+      throw Exception ("RRE decode error");
+
     pb->fillRect(pf, Rect(r.tl.x+x, r.tl.y+y, r.tl.x+x+w, r.tl.y+y+h), &pix);
   }
 }