diff options
| author | Christian Beier <dontmind@freeshell.org> | 2016-04-12 21:08:46 +0200 |
|---|---|---|
| committer | Christian Beier <dontmind@freeshell.org> | 2016-04-12 21:08:46 +0200 |
| commit | 96a5111cba681ae846383753859f2d35e3395f91 (patch) | |
| tree | af7168c0d5784a65217135c7d4f83b51cf6e918b | |
| parent | 5ceccb0dfa4c7fb764b4e1ada2912b664818c796 (diff) | |
| parent | 9b82dee3a4c93048162db8b643757e817406a37e (diff) | |
| download | libtdevnc-96a5111cba681ae846383753859f2d35e3395f91.tar.gz libtdevnc-96a5111cba681ae846383753859f2d35e3395f91.zip | |
Merge pull request #111 from zbierak/master
Fix buffer overflow when applying client encodings
| -rw-r--r-- | libvncclient/rfbproto.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libvncclient/rfbproto.c b/libvncclient/rfbproto.c index 187a56a..fa46578 100644 --- a/libvncclient/rfbproto.c +++ b/libvncclient/rfbproto.c @@ -1492,7 +1492,8 @@ SetFormatAndEncodings(rfbClient* client) if(e->encodings) { int* enc; for(enc = e->encodings; *enc; enc++) - encs[se->nEncodings++] = rfbClientSwap32IfLE(*enc); + if(se->nEncodings < MAX_ENCODINGS) + encs[se->nEncodings++] = rfbClientSwap32IfLE(*enc); } len = sz_rfbSetEncodingsMsg + se->nEncodings * 4; |