pkgs/tools/admin/tightvnc/1.3.10-CVE-2019-15678.patch

   1 Adapted from https://github.com/LibVNC/libvncserver/commit/c5ba3fee85a7ecbbca1df5ffd46d32b92757bc2a
   2 diff --git a/vncviewer/rfbproto.c b/vncviewer/rfbproto.c
   3 index 04b0230..47a6863 100644
   4 --- a/vncviewer/rfbproto.c
   5 +++ b/vncviewer/rfbproto.c
   6 @@ -1217,6 +1217,12 @@ HandleRFBServerMessage()
   7      if (serverCutText)
   8        free(serverCutText);
   9
  10 +    if (msg.sct.length > 1<<20) {
  11 +      fprintf(stderr,"Ignoring too big cut text length sent by server: %u B > 1 MB\n",
  12 +              (unsigned int)msg.sct.length);
  13 +      return False;
  14 +    }
  15 +
  16      serverCutText = malloc(msg.sct.length+1);
  17
  18      if (!ReadFromRFBServer(serverCutText, msg.sct.length))