Don't parse empty fence messages

We need to return here or we'll do an out-of-bounds access on the data
array.

(cherry picked from commit 7af69eb4a7a52d6baf4d09f79ccbec76bd1fcee1)

diff --git a/common/rfb/VNCSConnectionST.cxx b/common/rfb/VNCSConnectionST.cxx
index 306bba1dc402dfc0dbc7264e7d8df1cb7632922e..758744952535c2c31fd5cc4f1df296cc1fe2f559 100644 (file)
--- a/common/rfb/VNCSConnectionST.cxx
+++ b/common/rfb/VNCSConnectionST.cxx
@@ -706,8 +706,10 @@ void VNCSConnectionST::fence(uint32_t flags, unsigned len, const uint8_t data[])
     return;
   }
 
-  if (len < 1)
+  if (len < 1) {
     vlog.error("Fence response of unexpected size received");
+    return;
+  }
 
   type = data[0];