Hogweed needs nettle, not the other way around. So make sure they
are specified in the correct order for the static link to succeed.

(cherry picked from commit 5ef3a70d1d)

Our fast paths assume that each channel fits in to a separate byte.
That means the shift needs to be a multiple of 8. Start actually
checking this so that a client cannot trip us up and possibly cause
incorrect code exection.

Issue found by Pavel Cheremushkin from Kaspersky Lab.

(cherry picked from commit 05e2849087)

(cherry picked from commit 91bdaa6c87)

We use a lot of lengths given to us over the network, so be more
paranoid about them causing an overflow as otherwise an attacker
might trick us in to overwriting other memory.

This primarily affects the client which often gets lengths from the
server, but there are also some scenarios where the server might
theoretically be vulnerable.

Issue found by Pavel Cheremushkin from Kaspersky Lab.

(cherry picked from commit 75e6e0653a)

Provides safety against them accidentally becoming negative because
of bugs in the calculations.

Also does the same to CharArray and friends as they were strongly
connection to the stream objects.

(cherry picked from commit 0943c006c7)

(cherry picked from commit 4ff58f0aca)

Otherwise we might be tricked in to reading and writing things at
incorrect offsets for pixels which ultimately could result in an
attacker writing things to the stack or heap and executing things
they shouldn't.

This only affects the server as the client never uses the pixel
format suggested by th server.

Issue found by Pavel Cheremushkin from Kaspersky Lab.

(cherry picked from commit cd1d650c53)

(cherry picked from commit f1b9b868ec)

(cherry picked from commit 014c501237)

We always assumed there would be one pixel per row so a rect with
a zero width would result in us writing to unknown memory.

This could theoretically be used by a malicious server to inject
code in to the viewer process.

Issue found by Pavel Cheremushkin from Kaspersky Lab.

(cherry picked from commit b4ada8d0c6)

No one should every try to write to this buffer. Enforce that by
throwing an exception if any one tries to get a writeable pointer
to the data.

(cherry picked from commit 9f615301ab)

We do a lot of calculations based on pixel coordinates and we need
to make sure they do not overflow. Restrict the maximum dimensions
we support rather than try to switch over all calculations to use
64 bit integers.

This prevents attackers from from injecting code by specifying a
huge framebuffer size and relying on the values overflowing to
access invalid areas of the heap.

This primarily affects the client which gets both the screen
dimensions and the pixel contents from the remote side. But the
server might also be affected as a client can adjust the screen
dimensions, as can applications inside the session.

Issue found by Pavel Cheremushkin from Kaspersky Lab.

(cherry picked from commit 996356b6c6)

Don't allow subclasses to just override dimensions or buffer details
directly and instead force them to go via methods. This allows us
to do sanity checks on the new values and catch bugs and attacks.

(cherry picked from commit 53f913a761)

Move the checks around to avoid missing cases where we might access
memory that is no longer valid. Also avoid touching the underlying
stream implicitly (e.g. via the destructor) as it might also no
longer be valid.

A malicious server could theoretically use this for remote code
execution in the client.

Issue found by Pavel Cheremushkin from Kaspersky Lab

(cherry picked from commit d61a767d68)

(cherry picked from commit 7ac36ad42f)

(cherry picked from commit 47c7de6008)

(cherry picked from commit 36454cfa88)

(cherry picked from commit bbbb67ee32)

(cherry picked from commit bae4f60b08)

(cherry picked from commit fb7667646f)

(cherry picked from commit eea96c4e40)

(cherry picked from commit 16abf6bcef)

(cherry picked from commit e1210592c9)

(cherry picked from commit 71b0d7c86c)

(cherry picked from commit 13b58d9206)

We need to examine the incoming PixelBuffer, not the previous one
(which might not even be valid).

fix test order in convertLF and convertCRLF

We need to check the buffer length before accessing the incoming
string. Probably not a problem in practice as there should be a
final null in most incoming strings.

Issue found by Pavel Cheremushkin from Kaspersky Lab.

They have very different purpose, so make things easier to work
with by having multiple directories.

Window hooks aren't working well on modern systems so switch the
default to polling until we can fix things.

The new order of test avoid ready invalid memory address in ca.buf

Do not return returncode indicating error when listing sessions

Implements support in both client and server for the extended
clipboard format first seen in UltraVNC. Currently only implements
text handling, but that is still an improvement as it extends the
clipboard from ISO 8859-1 to full Unicode.