1 files changed, 14 insertions, 4 deletions
diff --git a/libvncserver/rfbserver.c b/libvncserver/rfbserver.c
index 2567f23..767b673 100644
--- a/libvncserver/rfbserver.c
+++ b/libvncserver/rfbserver.c
@@ -3062,12 +3062,20 @@ rfbSendSetColourMapEntries(rfbClientPtr cl,
                            int nColours)
 {
     char buf[sz_rfbSetColourMapEntriesMsg + 256 * 3 * 2];
-    rfbSetColourMapEntriesMsg *scme = (rfbSetColourMapEntriesMsg *)buf;
-    uint16_t *rgb = (uint16_t *)(&buf[sz_rfbSetColourMapEntriesMsg]);
+    char *wbuf = buf;
+    rfbSetColourMapEntriesMsg *scme;
+    uint16_t *rgb;
     rfbColourMap* cm = &cl->screen->colourMap;
-    
     int i, len;
 
+    if (nColours > 256) {
+	/* some rare hardware has, e.g., 4096 colors cells: PseudoColor:12 */
+    	wbuf = (char *) malloc(sz_rfbSetColourMapEntriesMsg + nColours * 3 * 2);
+    }
+
+    scme = (rfbSetColourMapEntriesMsg *)wbuf;
+    rgb = (uint16_t *)(&wbuf[sz_rfbSetColourMapEntriesMsg]);
+
     scme->type = rfbSetColourMapEntries;
 
     scme->firstColour = Swap16IfLE(firstColour);
@@ -3091,13 +3099,15 @@ rfbSendSetColourMapEntries(rfbClientPtr cl,
 
     len += nColours * 3 * 2;
 
-    if (rfbWriteExact(cl, buf, len) < 0) {
+    if (rfbWriteExact(cl, wbuf, len) < 0) {
 	rfbLogPerror("rfbSendSetColourMapEntries: write");
 	rfbCloseClient(cl);
+        if (wbuf != buf) free(wbuf);
 	return FALSE;
     }
 
     rfbStatRecordMessageSent(cl, rfbSetColourMapEntries, len, len);
+    if (wbuf != buf) free(wbuf);
     return TRUE;
 }