5 files changed, 37 insertions, 19 deletions

diff --git a/common/rfb/CConnection.cxx b/common/rfb/CConnection.cxx
index f541a969..cb1b84bd 100644
--- a/common/rfb/CConnection.cxx
+++ b/common/rfb/CConnection.cxx
@@ -301,7 +301,10 @@ void CConnection::processSecurityResultMsg()
   state_ = RFBSTATE_INVALID;
   if (server.beforeVersion(3,8))
     throw AuthFailureException();
-  CharArray reason(is->readString());
+  rdr::U32 len = is->readU32();
+  CharArray reason(len + 1);
+  is->readBytes(reason.buf, len);
+  reason.buf[len] = '\0';
   throw AuthFailureException(reason.buf);
 }
 
@@ -314,8 +317,10 @@ void CConnection::processInitMsg()
 void CConnection::throwConnFailedException()
 {
   state_ = RFBSTATE_INVALID;
-  CharArray reason;
-  reason.buf = is->readString();
+  rdr::U32 len = is->readU32();
+  CharArray reason(len + 1);
+  is->readBytes(reason.buf, len);
+  reason.buf[len] = '\0';
   throw ConnFailedException(reason.buf);
 }
 
diff --git a/common/rfb/CMsgReader.cxx b/common/rfb/CMsgReader.cxx
index 52d40ce7..a015ec99 100644
--- a/common/rfb/CMsgReader.cxx
+++ b/common/rfb/CMsgReader.cxx
@@ -53,7 +53,10 @@ void CMsgReader::readServerInit()
   int height = is->readU16();
   PixelFormat pf;
   pf.read(is);
-  CharArray name(is->readString());
+  rdr::U32 len = is->readU32();
+  CharArray name(len + 1);
+  is->readBytes(name.buf, len);
+  name.buf[len] = '\0';
   handler->serverInit(width, height, pf, name.buf);
 }
 
@@ -556,15 +559,16 @@ void CMsgReader::readSetVMwareCursor(int width, int height, const Point& hotspot
 
 void CMsgReader::readSetDesktopName(int x, int y, int w, int h)
 {
-  char* name = is->readString();
+  rdr::U32 len = is->readU32();
+  CharArray name(len + 1);
+  is->readBytes(name.buf, len);
+  name.buf[len] = '\0';
 
   if (x || y || w || h) {
     vlog.error("Ignoring DesktopName rect with non-zero position/size");
   } else {
-    handler->setName(name);
+    handler->setName(name.buf);
   }
-
-  delete [] name;
 }
 
 void CMsgReader::readExtendedDesktopSize(int x, int y, int w, int h)
diff --git a/common/rfb/SConnection.cxx b/common/rfb/SConnection.cxx
index b5a69d4c..e06fc6bb 100644
--- a/common/rfb/SConnection.cxx
+++ b/common/rfb/SConnection.cxx
@@ -268,8 +268,11 @@ bool SConnection::handleAuthFailureTimeout(Timer* t)
 
   try {
     os->writeU32(secResultFailed);
-    if (!client.beforeVersion(3,8)) // 3.8 onwards have failure message
-      os->writeString(authFailureMsg.buf);
+    if (!client.beforeVersion(3,8)) { // 3.8 onwards have failure message
+      const char* reason = authFailureMsg.buf;
+      os->writeU32(strlen(reason));
+      os->writeBytes(reason, strlen(reason));
+    }
     os->flush();
   } catch (rdr::Exception& e) {
     close(e.str());
@@ -295,11 +298,13 @@ void SConnection::throwConnFailedException(const char* format, ...)
   if (state_ == RFBSTATE_PROTOCOL_VERSION) {
     if (client.majorVersion == 3 && client.minorVersion == 3) {
       os->writeU32(0);
-      os->writeString(str);
+      os->writeU32(strlen(str));
+      os->writeBytes(str, strlen(str));
       os->flush();
     } else {
       os->writeU8(0);
-      os->writeString(str);
+      os->writeU32(strlen(str));
+      os->writeBytes(str, strlen(str));
       os->flush();
     }
   }
@@ -425,10 +430,10 @@ void SConnection::approveConnection(bool accept, const char* reason)
     } else {
       os->writeU32(secResultFailed);
       if (!client.beforeVersion(3,8)) { // 3.8 onwards have failure message
-        if (reason)
-          os->writeString(reason);
-        else
-          os->writeString("Authentication failure");
+        if (!reason)
+          reason = "Authentication failure";
+        os->writeU32(strlen(reason));
+        os->writeBytes(reason, strlen(reason));
       }
     }
     os->flush();
diff --git a/common/rfb/SMsgWriter.cxx b/common/rfb/SMsgWriter.cxx
index becf6e70..a29ed9d8 100644
--- a/common/rfb/SMsgWriter.cxx
+++ b/common/rfb/SMsgWriter.cxx
@@ -56,7 +56,8 @@ void SMsgWriter::writeServerInit(rdr::U16 width, rdr::U16 height,
   os->writeU16(width);
   os->writeU16(height);
   pf.write(os);
-  os->writeString(name);
+  os->writeU32(strlen(name));
+  os->writeBytes(name, strlen(name));
   endMsg();
 }
 
@@ -551,7 +552,8 @@ void SMsgWriter::writeSetDesktopNameRect(const char *name)
   os->writeU16(0);
   os->writeU16(0);
   os->writeU32(pseudoEncodingDesktopName);
-  os->writeString(name);
+  os->writeU32(strlen(name));
+  os->writeBytes(name, strlen(name));
 }
 
 void SMsgWriter::writeSetCursorRect(int width, int height,
diff --git a/common/rfb/VNCServerST.cxx b/common/rfb/VNCServerST.cxx
index 8a005334..be1662d8 100644
--- a/common/rfb/VNCServerST.cxx
+++ b/common/rfb/VNCServerST.cxx
@@ -137,7 +137,9 @@ void VNCServerST::addSocket(network::Socket* sock, bool outgoing)
       // Shortest possible way to tell a client it is not welcome
       os.writeBytes("RFB 003.003\n", 12);
       os.writeU32(0);
-      os.writeString("Too many security failures");
+      const char* reason = "Too many security failures";
+      os.writeU32(strlen(reason));
+      os.writeBytes(reason, strlen(reason));
       os.flush();
     } catch (rdr::Exception&) {
     }