diff options
| author | dscho <[email protected]> | 2014-08-16 10:46:36 +0200 |
|---|---|---|
| committer | dscho <[email protected]> | 2014-08-16 10:46:36 +0200 |
| commit | ba710eb145bd2a9bb14bc316eb6ff645f004b06c (patch) | |
| tree | 67f488e08d6bd6a89390c2840d96dd6ca909bcae /libvncclient/rfbproto.c | |
| parent | 9453be42014b6b9eaa6ab6f8c2e8b6f4f01d15aa (diff) | |
| parent | 85a778c0e45e87e35ee7199f1f25020648e8b812 (diff) | |
| download | libtdevnc-ba710eb145bd2a9bb14bc316eb6ff645f004b06c.tar.gz libtdevnc-ba710eb145bd2a9bb14bc316eb6ff645f004b06c.zip | |
Merge pull request #20 from newsoft/master
Fix integer overflow in MallocFrameBuffer()
Diffstat (limited to 'libvncclient/rfbproto.c')
| -rw-r--r-- | libvncclient/rfbproto.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/libvncclient/rfbproto.c b/libvncclient/rfbproto.c index b4d7156..f55c74f 100644 --- a/libvncclient/rfbproto.c +++ b/libvncclient/rfbproto.c @@ -1829,7 +1829,8 @@ HandleRFBServerMessage(rfbClient* client) client->updateRect.x = client->updateRect.y = 0; client->updateRect.w = client->width; client->updateRect.h = client->height; - client->MallocFrameBuffer(client); + if (!client->MallocFrameBuffer(client)) + return FALSE; SendFramebufferUpdateRequest(client, 0, 0, rect.r.w, rect.r.h, FALSE); rfbClientLog("Got new framebuffer size: %dx%d\n", rect.r.w, rect.r.h); continue; @@ -2290,7 +2291,9 @@ HandleRFBServerMessage(rfbClient* client) client->updateRect.x = client->updateRect.y = 0; client->updateRect.w = client->width; client->updateRect.h = client->height; - client->MallocFrameBuffer(client); + if (!client->MallocFrameBuffer(client)) + return FALSE; + SendFramebufferUpdateRequest(client, 0, 0, client->width, client->height, FALSE); rfbClientLog("Got new framebuffer size: %dx%d\n", client->width, client->height); break; @@ -2306,7 +2309,8 @@ HandleRFBServerMessage(rfbClient* client) client->updateRect.x = client->updateRect.y = 0; client->updateRect.w = client->width; client->updateRect.h = client->height; - client->MallocFrameBuffer(client); + if (!client->MallocFrameBuffer(client)) + return FALSE; SendFramebufferUpdateRequest(client, 0, 0, client->width, client->height, FALSE); rfbClientLog("Got new framebuffer size: %dx%d\n", client->width, client->height); break; |