diff options
| -rw-r--r-- | acinclude.m4 | 10 | ||||
| -rw-r--r-- | libvncclient.pc.in | 4 | ||||
| -rw-r--r-- | libvncclient/rfbproto.c | 10 | ||||
| -rw-r--r-- | libvncclient/vncviewer.c | 23 | ||||
| -rw-r--r-- | libvncserver.pc.in | 4 |
5 files changed, 42 insertions, 9 deletions
diff --git a/acinclude.m4 b/acinclude.m4 index fc947ac..0365753 100644 --- a/acinclude.m4 +++ b/acinclude.m4 @@ -1137,7 +1137,10 @@ x86_64-*linux*|ppc*-*linux*|powerpc*-*linux*|s390*-*linux*|sparc*-*linux*) x86_64-*linux*) LD="${LD-ld} -m elf_i386" ;; - ppc64-*linux*|powerpc64-*linux*) + powerpc64le-*) + LD="${LD-ld} -m elf32lppclinux" + ;; + powerpc64-*) LD="${LD-ld} -m elf32ppclinux" ;; s390x-*linux*) @@ -1153,7 +1156,10 @@ x86_64-*linux*|ppc*-*linux*|powerpc*-*linux*|s390*-*linux*|sparc*-*linux*) x86_64-*linux*) LD="${LD-ld} -m elf_x86_64" ;; - ppc*-*linux*|powerpc*-*linux*) + powerpcle-*) + LD="${LD-ld} -m elf64lppc" + ;; + powerpc-*) LD="${LD-ld} -m elf64ppc" ;; s390*-*linux*) diff --git a/libvncclient.pc.in b/libvncclient.pc.in index 143dc46..37495e7 100644 --- a/libvncclient.pc.in +++ b/libvncclient.pc.in @@ -7,6 +7,8 @@ Name: LibVNCClient Description: A library for easy implementation of a VNC client. Version: @VERSION@ Requires: -Libs: -L${libdir} -lvncclient @LIBS@ @WSOCKLIB@ +Requires.private: zlib +Libs: -L${libdir} -lvncclient +Libs.private: @LIBS@ @WSOCKLIB@ Cflags: -I${includedir} diff --git a/libvncclient/rfbproto.c b/libvncclient/rfbproto.c index b4d7156..9d48b16 100644 --- a/libvncclient/rfbproto.c +++ b/libvncclient/rfbproto.c @@ -1829,7 +1829,8 @@ HandleRFBServerMessage(rfbClient* client) client->updateRect.x = client->updateRect.y = 0; client->updateRect.w = client->width; client->updateRect.h = client->height; - client->MallocFrameBuffer(client); + if (!client->MallocFrameBuffer(client)) + return FALSE; SendFramebufferUpdateRequest(client, 0, 0, rect.r.w, rect.r.h, FALSE); rfbClientLog("Got new framebuffer size: %dx%d\n", rect.r.w, rect.r.h); continue; @@ -2290,7 +2291,9 @@ HandleRFBServerMessage(rfbClient* client) client->updateRect.x = client->updateRect.y = 0; client->updateRect.w = client->width; client->updateRect.h = client->height; - client->MallocFrameBuffer(client); + if (!client->MallocFrameBuffer(client)) + return FALSE; + SendFramebufferUpdateRequest(client, 0, 0, client->width, client->height, FALSE); rfbClientLog("Got new framebuffer size: %dx%d\n", client->width, client->height); break; @@ -2306,7 +2309,8 @@ HandleRFBServerMessage(rfbClient* client) client->updateRect.x = client->updateRect.y = 0; client->updateRect.w = client->width; client->updateRect.h = client->height; - client->MallocFrameBuffer(client); + if (!client->MallocFrameBuffer(client)) + return FALSE; SendFramebufferUpdateRequest(client, 0, 0, client->width, client->height, FALSE); rfbClientLog("Got new framebuffer size: %dx%d\n", client->width, client->height); break; diff --git a/libvncclient/vncviewer.c b/libvncclient/vncviewer.c index 3b16a6f..8237254 100644 --- a/libvncclient/vncviewer.c +++ b/libvncclient/vncviewer.c @@ -82,9 +82,27 @@ static char* ReadPassword(rfbClient* client) { #endif } static rfbBool MallocFrameBuffer(rfbClient* client) { + uint64_t allocSize; + if(client->frameBuffer) free(client->frameBuffer); - client->frameBuffer=malloc(client->width*client->height*client->format.bitsPerPixel/8); + + /* SECURITY: promote 'width' into uint64_t so that the multiplication does not overflow + 'width' and 'height' are 16-bit integers per RFB protocol design + SIZE_MAX is the maximum value that can fit into size_t + */ + allocSize = (uint64_t)client->width * client->height * client->format.bitsPerPixel/8; + + if (allocSize >= SIZE_MAX) { + rfbClientErr("CRITICAL: cannot allocate frameBuffer, requested size is too large\n"); + return FALSE; + } + + client->frameBuffer=malloc( (size_t)allocSize ); + + if (client->frameBuffer == NULL) + rfbClientErr("CRITICAL: frameBuffer allocation failed, requested size too large or not enough memory?\n"); + return client->frameBuffer?TRUE:FALSE; } @@ -232,7 +250,8 @@ static rfbBool rfbInitConnection(rfbClient* client) client->width=client->si.framebufferWidth; client->height=client->si.framebufferHeight; - client->MallocFrameBuffer(client); + if (!client->MallocFrameBuffer(client)) + return FALSE; if (!SetFormatAndEncodings(client)) return FALSE; diff --git a/libvncserver.pc.in b/libvncserver.pc.in index f9273ea..d246052 100644 --- a/libvncserver.pc.in +++ b/libvncserver.pc.in @@ -7,6 +7,8 @@ Name: LibVNCServer Description: A library for easy implementation of a VNC server. Version: @VERSION@ Requires: -Libs: -L${libdir} -lvncserver @LIBS@ @WSOCKLIB@ +Requires.private: zlib +Libs: -L${libdir} -lvncserver +Libs.private: @LIBS@ @WSOCKLIB@ Cflags: -I${includedir} |