diff options
| author | Christian Beier <[email protected]> | 2018-10-21 20:21:30 +0200 |
|---|---|---|
| committer | Christian Beier <[email protected]> | 2018-10-21 20:22:05 +0200 |
| commit | 502821828ed00b4a2c4bef90683d0fd88ce495de (patch) | |
| tree | 74e271c7a565cc8927022a4363e5d4eb949c4256 /libvncserver | |
| parent | 7b1ef0ffc4815cab9a96c7278394152bdc89dc4d (diff) | |
| download | libtdevnc-502821828ed00b4a2c4bef90683d0fd88ce495de.tar.gz libtdevnc-502821828ed00b4a2c4bef90683d0fd88ce495de.zip | |
LibVNCServer: fix heap out-of-bound write access
Closes #243
Diffstat (limited to 'libvncserver')
| -rw-r--r-- | libvncserver/rfbserver.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libvncserver/rfbserver.c b/libvncserver/rfbserver.c index ed1365a..6ca511f 100644 --- a/libvncserver/rfbserver.c +++ b/libvncserver/rfbserver.c @@ -1465,7 +1465,7 @@ char *rfbProcessFileTransferReadBuffer(rfbClientPtr cl, uint32_t length) rfbLog("rfbProcessFileTransferReadBuffer(%dlen)\n", length); */ if (length>0) { - buffer=malloc(length+1); + buffer=malloc((uint64_t)length+1); if (buffer!=NULL) { if ((n = rfbReadExact(cl, (char *)buffer, length)) <= 0) { if (n != 0) |