]> source.dussan.org Git - tigervnc.git/commit
projects / tigervnc.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 9f61530) | patch
Handle empty Tight gradient rects
authorPierre Ossman <ossman@cendio.se>
Tue, 10 Sep 2019 13:36:42 +0000 (15:36 +0200)
committerPierre Ossman <ossman@cendio.se>
Fri, 15 Nov 2019 10:20:26 +0000 (11:20 +0100)
commitb4ada8d0c6dac98c8b91fc64d112569a8ae5fb95
treed3b6ebc4ee5fcceb7ea951d63937f3f2ca17e344tree | snapshot
parent9f615301aba1cc54a749950bf9462c5a85217bc4commit | diff
Handle empty Tight gradient rects

We always assumed there would be one pixel per row so a rect with
a zero width would result in us writing to unknown memory.

This could theoretically be used by a malicious server to inject
code in to the viewer process.

Issue found by Pavel Cheremushkin from Kaspersky Lab.
common/rfb/tightDecode.h diff | blob | history
High performance, multi-platform VNC client and server: https://github.com/TigerVNC/tigervnc