commit 5e8227d30aa5b1af30b28da34521aa6166f1ec9e
author Brian P. Hinz <bphinz@users.sf.net> Thu Aug 03 21:14:54 2017 -0400
committer Brian P. Hinz <bphinz@users.sf.net> Thu Aug 03 21:19:05 2017 -0400
tree b82ad3d1c578d9ebb19b58a249dbea1a846708dc
parent 3a7d3c82c106363615f703bd37ccc39bb89ef6ae

Fix for NPE when zero width or height alpha cursor is sent

java/com/tigervnc/rfb/CMsgReader.java

diff --git a/java/com/tigervnc/rfb/CMsgReader.java b/java/com/tigervnc/rfb/CMsgReader.java
index a5cc267..a79cf84 100644
--- a/java/com/tigervnc/rfb/CMsgReader.java
+++ b/java/com/tigervnc/rfb/CMsgReader.java
@@ -314,7 +314,8 @@
       new ManagedPixelBuffer(rgbaPF, width, height);
     PixelFormat origPF;
 
-    DataBufferInt buf;
+    ByteBuffer buf =
+      ByteBuffer.allocate(pb.area()*4).order(rgbaPF.getByteOrder());;
 
     encoding = is.readS32();
 
@@ -323,28 +324,26 @@
     handler.readAndDecodeRect(pb.getRect(), encoding, pb);
     handler.cp.setPF(origPF);
 
-    if (pb.getRect().area() == 0)
-      return;
-
     // ARGB with pre-multiplied alpha works best for BufferedImage
-    buf = (DataBufferInt)pb.getBufferRW(pb.getRect()).getDataBuffer();
-    ByteBuffer bbuf =
-      ByteBuffer.allocate(pb.area()*4).order(rgbaPF.getByteOrder());
-    bbuf.asIntBuffer().put(buf.getData()).flip().mark();
-
-    for (int i = 0;i < pb.area();i++) {
-      byte alpha = bbuf.get(bbuf.position()+3);
-
-      bbuf.put(i*4+3, (byte)(bbuf.get(i*4+2)));
-      bbuf.put(i*4+2, (byte)(bbuf.get(i*4+1)));
-      bbuf.put(i*4+1, (byte)(bbuf.get(i*4+0))); 
-      bbuf.put(i*4+0, (byte)alpha);
-
-      bbuf.position(bbuf.position() + 4);
+    if (pb.area() > 0) {
+      // Sometimes a zero width or height cursor is sent.
+      DataBuffer db = pb.getBuffer(pb.getRect()).getDataBuffer();
+      for (int i = 0;i < pb.area();i++)
+        buf.asIntBuffer().put(i, db.getElem(i));
     }
 
-    handler.setCursor(width, height, hotspot,
-                      bbuf.array());
+    for (int i = 0;i < pb.area();i++) {
+      byte alpha = buf.get(buf.position()+3);
+
+      buf.put(i*4+3, buf.get(i*4+2));
+      buf.put(i*4+2, buf.get(i*4+1));
+      buf.put(i*4+1, buf.get(i*4+0));
+      buf.put(i*4+0, alpha);
+
+      buf.position(buf.position() + 4);
+    }
+
+    handler.setCursor(width, height, hotspot, buf.array());
   }
 
   protected void readSetDesktopName(int x, int y, int w, int h)

java/com/tigervnc/rfb/ManagedPixelBuffer.java

diff --git a/java/com/tigervnc/rfb/ManagedPixelBuffer.java b/java/com/tigervnc/rfb/ManagedPixelBuffer.java
index 6e14b92..028eadc 100644
--- a/java/com/tigervnc/rfb/ManagedPixelBuffer.java
+++ b/java/com/tigervnc/rfb/ManagedPixelBuffer.java
@@ -18,6 +18,8 @@
 
 package com.tigervnc.rfb;
 
+import java.awt.image.*;
+
 public class ManagedPixelBuffer extends FullFramePixelBuffer {
 
   public ManagedPixelBuffer() {
@@ -43,9 +45,15 @@
   final void checkDataSize() {
     int new_datasize = width_ * height_;
     if (datasize < new_datasize) {
-      vlog.debug("reallocating managed buffer ("+width_+"x"+height_+")");
-      if (format != null)
-        data = PixelFormat.getColorModel(format).createCompatibleWritableRaster(width_, height_);
+      if (data != null) {
+        datasize = 0; data = null;
+      }
+      if (new_datasize > 0) {
+        ColorModel cm = format.getColorModel();
+        data = cm.createCompatibleWritableRaster(width_, height_);
+        image = new BufferedImage(cm, data, cm.isAlphaPremultiplied(), null);
+        datasize = new_datasize;
+      }
     }
   }