You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
libvncserver/SOURCES/libvncserver-0.9.11-CVE-201...

36 lines
1.3 KiB

From d87d25516b3992e52cf79e3cd6bd331b0baceecf Mon Sep 17 00:00:00 2001
From: Christian Beier <dontmind@freeshell.org>
Date: Sun, 17 Nov 2019 16:21:18 +0100
Subject: [PATCH] When connecting to a repeater, make sure to not leak memory
Really closes #253
---
examples/repeater.c | 1 +
libvncclient/rfbproto.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/examples/repeater.c b/examples/repeater.c
index cf0350ff..7047578d 100644
--- a/examples/repeater.c
+++ b/examples/repeater.c
@@ -23,6 +23,7 @@ int main(int argc,char** argv)
"Usage: %s <id> <repeater-host> [<repeater-port>]\n", argv[0]);
exit(1);
}
+ memset(id, 0, sizeof(id));
snprintf(id, sizeof(id) - 1, "ID:%s", argv[1]);
repeaterHost = argv[2];
repeaterPort = argc < 4 ? 5500 : atoi(argv[3]);
diff --git a/libvncclient/rfbproto.c b/libvncclient/rfbproto.c
index 6c07d97e..675248fa 100644
--- a/libvncclient/rfbproto.c
+++ b/libvncclient/rfbproto.c
@@ -402,6 +402,7 @@ rfbBool ConnectToRFBRepeater(rfbClient* client,const char *repeaterHost, int rep
rfbClientLog("Connected to VNC repeater, using protocol version %d.%d\n", major, minor);
+ memset(tmphost, 0, sizeof(tmphost));
snprintf(tmphost, sizeof(tmphost), "%s:%d", destHost, destPort);
if (!WriteToRFBServer(client, tmphost, sizeof(tmphost)))
return FALSE;