We computed a safe area if a client gave us a bogus one, but we didn't
actually use it. Fix this properly and make sure we don't pass on bad
coordinates further.

So the current clipboard state is properly reflected in the desktop
session.

This was out of sync with the client handling for no good reason.

The peer expects a response, so we should also be able to respond that
there is no clipboard data currently available.

The extended clipboard protocol has the ability for the peer to request
things to be sent automatically, without a request message. Make sure we
honor such settings.

Each character is more than one byte, so adjust the clearing of the
buffer to reflect that.

Some code points are reserved for the UTF-16 coding itself and must not
appear as input data to the algorithm.

Signed bug prevented anything not ASCII from being coded correctly.

Everything outside of BMP was handled incorrectly and was coded as
completely different code points.

This would mess up most conversions from UTF-8 as the caller wouldn't
know how far to step to get to the next valid character, resulting in
markers for invalid data to be injected here and there.

Also add some unit tests to avoid this reoccurring.

It should be using the safe wrappers for everything so make sure it
cannot bypass those and call the SConnection methods directly.

We incorrectly called the underlying functions instead of the safe
wrappers for the new clipboard functions. This had the effect of a)
crashing the entire server if one of these functions failed, and b) not
respecting the settings disabling the clipboard.

64x64 changed block can be large for fine changes such as cursor
movement and typing in terminal windows, or an update to a clock.

If the block can be efficiently cropped, this will reduce latency
and bandwidth. Every pixel cropped is a pixel less to analyze, encode,
transmit, and decode.

The previous code already detected the top of the change in order
to determine if the block had changed. However, it did not use
this information to reduce the size of the change rectangle, nor
did it calculate any of the other edges.

The new code introduces detection of the other edges, and uses
the information to build a reduced area change rectangle. This
has the additional effect of reducing the number of discrete pixel
values in the change block which may allow a more efficient
encoding algorithm to be selected.

As this section of code is performance sensitive, the method
of detecting the edges has been optimized to quickly fall back
to pessimistic values as soon as a single comparison fails on
each edge. In the case that full 64x64 block are changing,
there will be three extra comparisons per block.

In cases where the change rectangle can be reduced from 64x64,
the reduced size of the change rectangle represents reduced
effort to encode, transfer, and decode the contained pixels.

In the case of images with high frequency changes, which
specifically includes text, the lossy JPEG encoding can be
highly distorted, especially with JPEG level 6 or less. The
quick flash from a distorted JPEG to a lossless JPEG can
appear as a flickering to some people. This effect was more
obvious when the surrounding area is not expected to change,
but is being distorted anyways due to being part of the 64x64
blocking algorithm.

In the case of a user typing in a terminal window, this change
may commonly reduce the number of pixels updated with every
character typed from 4096 pixels (64x64) to 640 pixels (32x20)
or less.

Since 8e09912 this wasn't triggered properly as we checked if all
clients were gone before we actually removed the last client from our
list.

The method it overloads got tweaked some time ago, so we need to make
sure this method follows suit.

Sends response for SetDesktopSize as per the community wiki
specification

We'll just crash later if we try to use such a large screen, so reject
the request from the client instead and keep the server running.

The previous method stored the certificates as authorities, meaning that
the owner of that certificate could impersonate any server it wanted
after a client had added an exception.

Handle this more properly by only storing exceptions for specific
hostname/certificate combinations, the same way browsers or SSH does
things.

Major restructuring of how streams work. Neither input nor output
streams are now blocking. This avoids stalling the rest of the client or
server when a peer is slow or unresponsive.

Note that this puts an extra burden on users of streams to make sure
they are allowed to do their work once the underlying transports are
ready (e.g. monitoring fds).

These are not universal in the protocol so having functions for them
only obfuscates things.

The specification only states a single result byte and not any reason
after a TLS authentication failure.

Provide some safety checks when directly accessing the underlying
pointer of streams.

Some systems (like TLS) need to send some final data before closing
a connection. Make sure this is properly handled by cleaning up the
security object before closing the underlying network socket.

Otherwise we might send duplicate result codes and other weird things.

External callers don't need to know the exact details, only if there is
data that needs to be flushed or not.

The principle can be used in a more general fashion than just TCP
streams.

We can do what we want with the standard methods.

Just have a simply number of bytes argument to avoid a lot of
complexity.

Makes it more readable to write code that needs to know how much
data/space is available in a stream.

It might leak data depending on what's in the buffer. Use pad() instead
where blank space is needed.

We need to be able to tell this exception came from a decoder.

There might be some final handshake data that is still stuck in the
buffers, so make a best effort attempt at getting it to the client.

The socket is closed at this point so we have to rely on a cached
value for the logging.

It's a generic feature that is better handled as part of SConnection's
state machine.

We can't safely use the normal timers in base classes as we cannot
guarantee that subclasses will call the base class' handleTimeout()
properly if the subclass overrides it.

Might as well make these explicit so the cost is apparent.

This is the current upstream so let's make use of it to get the latest
in features and fixes.

It is present on all UNIX systems anyway, so let's simplify things.
We will need it for more proper session startup anyway.

Modern MinGW seems to provide this, so simplify things a bit. This also
side steps some of the issue of the windows.h/winsock2.h include
ordering.

Otherwise such clients cannot use Scroll Lock at all, and that is
probably worse than any effects we might get from getting out of sync.

new throws an exception on allocation errors rather than return NULL.

This check is completely backwards and it is currently unknown how
this ever worked.

The copied rects have already been merged in to the changed rects
at this point if the client doesn't support the CopyRect encoding.

Our fast paths assume that each channel fits in to a separate byte.
That means the shift needs to be a multiple of 8. Start actually
checking this so that a client cannot trip us up and possibly cause
incorrect code exection.

Issue found by Pavel Cheremushkin from Kaspersky Lab.

Provides safety against them accidentally becoming negative because
of bugs in the calculations.

Also does the same to CharArray and friends as they were strongly
connection to the stream objects.

Otherwise we might be tricked in to reading and writing things at
incorrect offsets for pixels which ultimately could result in an
attacker writing things to the stack or heap and executing things
they shouldn't.

This only affects the server as the client never uses the pixel
format suggested by th server.

Issue found by Pavel Cheremushkin from Kaspersky Lab.