| commit | c26b4b3bd20b40ca5f1ae9477164473fbd94995d | [log] [tgz] |
|---|---|---|
| author | Michal Srb <michalsrb@gmail.com> | Thu Apr 06 23:52:22 2017 +0300 |
| committer | Michal Srb <michalsrb@gmail.com> | Thu Apr 06 23:52:22 2017 +0300 |
| tree | dba2f546ea3c02cbf1928fc77cd0a0547a1ce6f2 | |
| parent | 83722048ddbe3eafe41bdccca4d706e98b25103b [diff] |
Limit size of cursor accepted by client. Width and height of a cursor are received as U16 from network. Accepting full range of U16 values can cause integer overflows in multiple places. The worst is probably VLA in CMsgReader::readSetXCursor: rdr::U8 buf[width*height*4]; The width*height*4 can be too big to fit on stack or it can overflow into negative numbers. Both cases are undefined behaviour. Following writes to buf can overwrite other data on stack.