Limit size of cursor accepted by client.
Width and height of a cursor are received as U16 from network. Accepting full range of U16 values can cause integer overflows in multiple places.
The worst is probably VLA in CMsgReader::readSetXCursor:
rdr::U8 buf[width*height*4];
The width*height*4 can be too big to fit on stack or it can overflow into negative numbers. Both cases are undefined behaviour. Following writes to buf can overwrite other data on stack.
diff --git a/common/rfb/CMsgReader.h b/common/rfb/CMsgReader.h
index ff73414..7b52033 100644
--- a/common/rfb/CMsgReader.h
+++ b/common/rfb/CMsgReader.h
@@ -69,6 +69,8 @@
CMsgHandler* handler;
rdr::InStream* is;
int nUpdateRectsLeft;
+
+ static const int maxCursorSize = 256;
};
}
#endif