Browse Source

Safely discard large (extended) clipboard contents

Avoid having to buffer everything we want to discard, and instead do it
piece by piece. This is more efficient, and avoids hitting any limits on
the buffering.

Note that this is safe here because we already know we have all the
compressed data. It would not be safe for a general input stream.
tags/v1.12.90
Pierre Ossman 1 year ago
parent
commit
ece16218a4
2 changed files with 40 additions and 8 deletions
  1. 20
    4
      common/rfb/CMsgReader.cxx
  2. 20
    4
      common/rfb/SMsgReader.cxx

+ 20
- 4
common/rfb/CMsgReader.cxx View File

@@ -341,17 +341,33 @@ bool CMsgReader::readExtendedClipboard(rdr::S32 len)

lengths[num] = zis.readU32();

if (!zis.hasData(lengths[num]))
throw Exception("Extended clipboard decode error");

if (lengths[num] > (size_t)maxCutText) {
vlog.error("Extended clipboard data too long (%d bytes) - ignoring",
(unsigned)lengths[num]);
zis.skip(lengths[num]);

// Slowly (safely) drain away the data
while (lengths[num] > 0) {
size_t chunk;

if (!zis.hasData(1))
throw Exception("Extended clipboard decode error");

chunk = zis.avail();
if (chunk > lengths[num])
chunk = lengths[num];

zis.skip(chunk);
lengths[num] -= chunk;
}

flags &= ~(1 << i);

continue;
}

if (!zis.hasData(lengths[num]))
throw Exception("Extended clipboard decode error");

buffers[num] = new rdr::U8[lengths[num]];
zis.readBytes(buffers[num], lengths[num]);
num++;

+ 20
- 4
common/rfb/SMsgReader.cxx View File

@@ -380,17 +380,33 @@ bool SMsgReader::readExtendedClipboard(rdr::S32 len)

lengths[num] = zis.readU32();

if (!zis.hasData(lengths[num]))
throw Exception("Extended clipboard decode error");

if (lengths[num] > (size_t)maxCutText) {
vlog.error("Extended clipboard data too long (%d bytes) - ignoring",
(unsigned)lengths[num]);
zis.skip(lengths[num]);

// Slowly (safely) drain away the data
while (lengths[num] > 0) {
size_t chunk;

if (!zis.hasData(1))
throw Exception("Extended clipboard decode error");

chunk = zis.avail();
if (chunk > lengths[num])
chunk = lengths[num];

zis.skip(chunk);
lengths[num] -= chunk;
}

flags &= ~(1 << i);

continue;
}

if (!zis.hasData(lengths[num]))
throw Exception("Extended clipboard decode error");

buffers[num] = new rdr::U8[lengths[num]];
zis.readBytes(buffers[num], lengths[num]);
num++;

Loading…
Cancel
Save