[Bugfix] Use rdr::U32 type for length of strings handled by *CutText functions.

This avoids big buffer overflow when memcpy is called with "-1" argument.

git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@3607 3789f03b-4d11-0410-bbf8-ca57d06f2519

diff --git a/common/rfb/CMsgHandler.cxx b/common/rfb/CMsgHandler.cxx
index bbc11763298656eaad3db07f18adc35e542b9135..4b338524fb2e8fe33b70d09f8d278644a8ac0850 100644 (file)
--- a/common/rfb/CMsgHandler.cxx
+++ b/common/rfb/CMsgHandler.cxx
@@ -80,7 +80,7 @@ void CMsgHandler::bell()
 {
 }
 
-void CMsgHandler::serverCutText(const char* str, int len)
+void CMsgHandler::serverCutText(const char* str, rdr::U32 len)
 {
 }
 

diff --git a/common/rfb/CMsgHandler.h b/common/rfb/CMsgHandler.h
index 6c86df01bbcb468020a906f3c2f8f77a0e26eeab..188963a42f6a585584b4adab39a620f61bb3cbce 100644 (file)
--- a/common/rfb/CMsgHandler.h
+++ b/common/rfb/CMsgHandler.h
@@ -57,7 +57,7 @@ namespace rfb {
     virtual void setColourMapEntries(int firstColour, int nColours,
                                     rdr::U16* rgbs);
     virtual void bell();
-    virtual void serverCutText(const char* str, int len);
+    virtual void serverCutText(const char* str, rdr::U32 len);
 
     virtual void fillRect(const Rect& r, Pixel pix);
     virtual void imageRect(const Rect& r, void* pixels);

diff --git a/common/rfb/CMsgReader.cxx b/common/rfb/CMsgReader.cxx
index 0e3d9679360b6aed86b6f2ef094a2c67bba4a3b8..488f549ce75fac92dfcce09493e1c73a583afd4a 100644 (file)
--- a/common/rfb/CMsgReader.cxx
+++ b/common/rfb/CMsgReader.cxx
@@ -60,7 +60,7 @@ void CMsgReader::readBell()
 void CMsgReader::readServerCutText()
 {
   is->skip(3);
-  int len = is->readU32();
+  rdr::U32 len = is->readU32();
   if (len > 256*1024) {
     is->skip(len);
     fprintf(stderr,"cut text too long (%d bytes) - ignoring\n",len);

diff --git a/common/rfb/CMsgWriter.cxx b/common/rfb/CMsgWriter.cxx
index 26e0d50ca1d7eb5780862d208bf9a2cc319bf3ef..8948cbdda0460bd95d721e8c25edd10ac2c1fac4 100644 (file)
--- a/common/rfb/CMsgWriter.cxx
+++ b/common/rfb/CMsgWriter.cxx
@@ -124,7 +124,7 @@ void CMsgWriter::pointerEvent(const Point& pos, int buttonMask)
 }
 
 
-void CMsgWriter::clientCutText(const char* str, int len)
+void CMsgWriter::clientCutText(const char* str, rdr::U32 len)
 {
   startMsg(msgTypeClientCutText);
   os->pad(3);

diff --git a/common/rfb/CMsgWriter.h b/common/rfb/CMsgWriter.h
index 19be8df9015e93856bf04ce34111d54994e71710..5794f91db46263eced8f6fc9cb3d286b2dae3a42 100644 (file)
--- a/common/rfb/CMsgWriter.h
+++ b/common/rfb/CMsgWriter.h
@@ -50,7 +50,7 @@ namespace rfb {
     // InputHandler implementation
     virtual void keyEvent(rdr::U32 key, bool down);
     virtual void pointerEvent(const Point& pos, int buttonMask);
-    virtual void clientCutText(const char* str, int len);
+    virtual void clientCutText(const char* str, rdr::U32 len);
 
     ConnParams* getConnParams() { return cp; }
     rdr::OutStream* getOutStream() { return os; }

diff --git a/unix/vncviewer/DesktopWindow.cxx b/unix/vncviewer/DesktopWindow.cxx
index 657572a434a01fdc4b7423f2d3448930176852b6..891985960e2dce2e0d30d1c0bcce31e4722fcbe0 100644 (file)
--- a/unix/vncviewer/DesktopWindow.cxx
+++ b/unix/vncviewer/DesktopWindow.cxx
@@ -254,7 +254,7 @@ void DesktopWindow::setColourMapEntries(int firstColour, int nColours,
     setColourMapEntriesTimer.start(100);
 }
 
-void DesktopWindow::serverCutText(const char* str, int len)
+void DesktopWindow::serverCutText(const char* str, rdr::U32 len)
 {
   if (acceptClipboard) {
     newServerCutText = true;

diff --git a/unix/vncviewer/DesktopWindow.h b/unix/vncviewer/DesktopWindow.h
index a1af75042ea94e29653dc9c74c1dfa916f10d87e..fe5ef82a306a9e97ca47b6fe910a0c406aad1613 100644 (file)
--- a/unix/vncviewer/DesktopWindow.h
+++ b/unix/vncviewer/DesktopWindow.h
@@ -55,7 +55,7 @@ public:
 
   // Methods forwarded from CConn
   void setColourMapEntries(int firstColour, int nColours, rdr::U16* rgbs);
-  void serverCutText(const char* str, int len);
+  void serverCutText(const char* str, rdr::U32 len);
   void framebufferUpdateEnd();
 
   void fillRect(const rfb::Rect& r, rfb::Pixel pix) {

diff --git a/win/vncviewer/CConn.cxx b/win/vncviewer/CConn.cxx
index d2697488db469b2218a37fc57fd4397d465b7920..81df866b4649f772c4a1727bd2e6d6783efea9a4 100644 (file)
--- a/win/vncviewer/CConn.cxx
+++ b/win/vncviewer/CConn.cxx
@@ -698,7 +698,7 @@ void CConn::serverInit() {
 }
 
 void
-CConn::serverCutText(const char* str, int len) {
+CConn::serverCutText(const char* str, rdr::U32 len) {
   if (!options.serverCutText) return;
   window->serverCutText(str, len);
 }

diff --git a/win/vncviewer/CConn.h b/win/vncviewer/CConn.h
index 29023f398ce56b84d5fab5f851d8b3944b65bb71..d294f9e0c33554189c83fa86d76847afd9c3b26d 100644 (file)
--- a/win/vncviewer/CConn.h
+++ b/win/vncviewer/CConn.h
@@ -105,7 +105,7 @@ namespace rfb {
       void setCursor(int w, int h, const Point& hotspot, void* data, void* mask);
       void setName(const char* name);
       void serverInit();
-      void serverCutText(const char* str, int len);
+      void serverCutText(const char* str, rdr::U32 len);
       void beginRect(const Rect& r, unsigned int encoding);
       void endRect(const Rect& r, unsigned int encoding);
       void fillRect(const Rect& r, Pixel pix);

diff --git a/win/vncviewer/DesktopWindow.cxx b/win/vncviewer/DesktopWindow.cxx
index eac2b6fd6c31f6bfd23e0bd95651fdef4d8175ce..5a9fe4e03e0af3b46f5e8a450216406afc249d29 100644 (file)
--- a/win/vncviewer/DesktopWindow.cxx
+++ b/win/vncviewer/DesktopWindow.cxx
@@ -1275,7 +1275,7 @@ DesktopWindow::setName(const char* name) {
 
 
 void
-DesktopWindow::serverCutText(const char* str, int len) {
+DesktopWindow::serverCutText(const char* str, rdr::U32 len) {
   CharArray t(len+1);
   memcpy(t.buf, str, len);
   t.buf[len] = 0;

diff --git a/win/vncviewer/DesktopWindow.h b/win/vncviewer/DesktopWindow.h
index 4319b752ec86bb70edc2d279face12e73c474303..259b6b0e31bd545ae39d3dd14f12d4ffdaa8f695 100644 (file)
--- a/win/vncviewer/DesktopWindow.h
+++ b/win/vncviewer/DesktopWindow.h
@@ -117,7 +117,7 @@ namespace rfb {
       char* getMonitor() const;
 
       // - Set the local clipboard
-      void serverCutText(const char* str, int len);
+      void serverCutText(const char* str, rdr::U32 len);
 
       // - Draw into the desktop buffer & update the window
       void fillRect(const Rect& r, Pixel pix);