aboutsummaryrefslogtreecommitdiffstats
path: root/common/rfb
Commit message (Collapse)AuthorAgeFilesLines
...
| * | Generalise corking to all output streamsPierre Ossman2020-05-212-6/+8
| | | | | | | | | | | | | | | The principle can be used in a more general fashion than just TCP streams.
| * | Remove unused bufSize argument from streamsPierre Ossman2020-05-211-1/+1
| | |
| * | Remove special functions from JPEG compressorPierre Ossman2020-05-212-7/+1
| | | | | | | | | | | | We can do what we want with the standard methods.
| * | Simplify stream availability handlingPierre Ossman2020-05-212-3/+3
| | | | | | | | | | | | | | | Just have a simply number of bytes argument to avoid a lot of complexity.
| * | Add stream avail() methodsPierre Ossman2020-05-211-2/+2
| | | | | | | | | | | | | | | Makes it more readable to write code that needs to know how much data/space is available in a stream.
| * | Remove OutStream::skip()Pierre Ossman2020-05-211-1/+1
| | | | | | | | | | | | | | | It might leak data depending on what's in the buffer. Use pad() instead where blank space is needed.
| * | Throw more descriptive error on decode errorPierre Ossman2020-05-211-2/+7
| | | | | | | | | | | | We need to be able to tell this exception came from a decoder.
| * | Flush data on closePierre Ossman2020-05-211-0/+11
| | | | | | | | | | | | | | | There might be some final handshake data that is still stuck in the buffers, so make a best effort attempt at getting it to the client.
| * | Fix connection close logPierre Ossman2020-05-192-2/+4
| | | | | | | | | | | | | | | The socket is closed at this point so we have to rely on a cached value for the logging.
| * | Move auth failure delay to SConnectionPierre Ossman2020-05-194-46/+54
| | | | | | | | | | | | | | | It's a generic feature that is better handled as part of SConnection's state machine.
| * | Support calling methods from timersPierre Ossman2020-05-191-0/+15
| | | | | | | | | | | | | | | | | | We can't safely use the normal timers in base classes as we cannot guarantee that subclasses will call the base class' handleTimeout() properly if the subclass overrides it.
* | | Fix handling of bad update requestsPierre Ossman2021-01-141-1/+1
| |/ |/| | | | | | | | | We computed a safe area if a client gave us a bogus one, but we didn't actually use it. Fix this properly and make sure we don't pass on bad coordinates further.
* | Correctly clear out output UTF-16 bufferPierre Ossman2020-10-051-1/+1
| | | | | | | | | | Each character is more than one byte, so adjust the clearing of the buffer to reflect that.
* | Correctly handle invalid UTF-16 code pointsPierre Ossman2020-10-051-1/+1
| | | | | | | | | | Some code points are reserved for the UTF-16 coding itself and must not appear as input data to the algorithm.
* | Fix conversion of latin-1 to UTF-8Pierre Ossman2020-10-051-2/+2
| | | | | | | | Signed bug prevented anything not ASCII from being coded correctly.
* | Fix UTF-16 encoding/decoding of high code pointsPierre Ossman2020-10-051-3/+4
| | | | | | | | | | Everything outside of BMP was handled incorrectly and was coded as completely different code points.
* | Return the correct number of consumed UTF-8 bytesPierre Ossman2020-10-051-0/+2
| | | | | | | | | | | | | | | | This would mess up most conversions from UTF-8 as the caller wouldn't know how far to step to get to the next valid character, resulting in markers for invalid data to be injected here and there. Also add some unit tests to avoid this reoccurring.
* | Merge branch 'tlstofu' of https://github.com/CendioOssman/tigervncPierre Ossman2020-09-081-90/+73
|\ \
| * | Properly store certificate exceptionsPierre Ossman2020-05-211-90/+73
| |/ | | | | | | | | | | | | | | | | | | The previous method stored the certificates as authorities, meaning that the owner of that certificate could impersonate any server it wanted after a client had added an exception. Handle this more properly by only storing exceptions for specific hostname/certificate combinations, the same way browsers or SSH does things.
* | Hide base SConnection methods from VNCServerSTPierre Ossman2020-08-212-2/+4
| | | | | | | | | | It should be using the safe wrappers for everything so make sure it cannot bypass those and call the SConnection methods directly.
* | Call correct wrappers for clipboard handlingPierre Ossman2020-08-211-3/+3
| | | | | | | | | | | | | | We incorrectly called the underlying functions instead of the safe wrappers for the new clipboard functions. This had the effect of a) crashing the entire server if one of these functions failed, and b) not respecting the settings disabling the clipboard.
* | Enhanced ComparingUpdateTracker to crop changed blocksMark Mielke2020-07-221-4/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 64x64 changed block can be large for fine changes such as cursor movement and typing in terminal windows, or an update to a clock. If the block can be efficiently cropped, this will reduce latency and bandwidth. Every pixel cropped is a pixel less to analyze, encode, transmit, and decode. The previous code already detected the top of the change in order to determine if the block had changed. However, it did not use this information to reduce the size of the change rectangle, nor did it calculate any of the other edges. The new code introduces detection of the other edges, and uses the information to build a reduced area change rectangle. This has the additional effect of reducing the number of discrete pixel values in the change block which may allow a more efficient encoding algorithm to be selected. As this section of code is performance sensitive, the method of detecting the edges has been optimized to quickly fall back to pessimistic values as soon as a single comparison fails on each edge. In the case that full 64x64 block are changing, there will be three extra comparisons per block. In cases where the change rectangle can be reduced from 64x64, the reduced size of the change rectangle represents reduced effort to encode, transfer, and decode the contained pixels. In the case of images with high frequency changes, which specifically includes text, the lossy JPEG encoding can be highly distorted, especially with JPEG level 6 or less. The quick flash from a distorted JPEG to a lossless JPEG can appear as a flickering to some people. This effect was more obvious when the surrounding area is not expected to change, but is being distorted anyways due to being part of the 64x64 blocking algorithm. In the case of a user typing in a terminal window, this change may commonly reduce the number of pixels updated with every character typed from 4096 pixels (64x64) to 640 pixels (32x20) or less.
* | Fix non-functional MaxDisconnectionTimePierre Ossman2020-06-181-5/+5
| | | | | | | | | | | | Since 8e09912 this wasn't triggered properly as we checked if all clients were gone before we actually removed the last client from our list.
* | Merge branch 'regions' of https://github.com/CendioOssman/tigervncPierre Ossman2020-06-154-143/+60
|\ \
| * | Get rid of magical assignment to RegionPierre Ossman2020-05-183-36/+2
| | | | | | | | | | | | Might as well make these explicit so the cost is apparent.
| * | Switch region code to pixmanPierre Ossman2020-05-013-114/+65
| |/ | | | | | | | | This is the current upstream so let's make use of it to get the latest in features and fixes.
* | Remove unused variablePierre Ossman2020-05-311-1/+0
| |
* | Fix JpegCompressor::overrun() type changePierre Ossman2020-05-311-1/+1
| | | | | | | | | | The method it overloads got tweaked some time ago, so we need to make sure this method follows suit.
* | Send response for refused SetDesktopSizematt3356722020-05-291-3/+4
| | | | | | | | | | Sends response for SetDesktopSize as per the community wiki specification
* | Reject too large screen resize requestsPierre Ossman2020-05-231-0/+5
|/ | | | | We'll just crash later if we try to use such a large screen, so reject the request from the client instead and keep the server running.
* Make PAM mandatoryPierre Ossman2020-03-125-24/+6
| | | | | It is present on all UNIX systems anyway, so let's simplify things. We will need it for more proper session startup anyway.
* Use sys/time.h on Windows as wellPierre Ossman2020-01-161-4/+0
| | | | | | Modern MinGW seems to provide this, so simplify things a bit. This also side steps some of the issue of the windows.h/winsock2.h include ordering.
* Allow XK_Scroll_Lock when LED state isn't supportedPierre Ossman2020-01-031-9/+1
| | | | | Otherwise such clients cannot use Scroll Lock at all, and that is probably worse than any effects we might get from getting out of sync.
* Remove unneeded memory checksPierre Ossman2019-12-301-4/+0
| | | | new throws an exception on allocation errors rather than return NULL.
* Fix saving of bad server certificatesPierre Ossman2019-12-301-2/+3
| | | | | This check is completely backwards and it is currently unknown how this ever worked.
* Merge branch 'secfix' of https://github.com/CendioOssman/tigervncPierre Ossman2019-12-2016-88/+171
|\
| * Handle pixel formats with odd shift valuesPierre Ossman2019-11-151-0/+6
| | | | | | | | | | | | | | | | | | Our fast paths assume that each channel fits in to a separate byte. That means the shift needs to be a multiple of 8. Start actually checking this so that a client cannot trip us up and possibly cause incorrect code exection. Issue found by Pavel Cheremushkin from Kaspersky Lab.
| * Use size_t for lengths in stream objectsPierre Ossman2019-11-155-16/+17
| | | | | | | | | | | | | | | | Provides safety against them accidentally becoming negative because of bugs in the calculations. Also does the same to CharArray and friends as they were strongly connection to the stream objects.
| * Add sanity checks for PixelFormat shift valuesPierre Ossman2019-11-151-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | Otherwise we might be tricked in to reading and writing things at incorrect offsets for pixels which ultimately could result in an attacker writing things to the stack or heap and executing things they shouldn't. This only affects the server as the client never uses the pixel format suggested by th server. Issue found by Pavel Cheremushkin from Kaspersky Lab.
| * Fix depth sanity test in PixelFormatPierre Ossman2019-11-151-1/+1
| |
| * Add unit test for PixelFormat sanity checksPierre Ossman2019-11-151-1/+2
| |
| * Handle empty Tight gradient rectsPierre Ossman2019-11-151-16/+21
| | | | | | | | | | | | | | | | | | | | We always assumed there would be one pixel per row so a rect with a zero width would result in us writing to unknown memory. This could theoretically be used by a malicious server to inject code in to the viewer process. Issue found by Pavel Cheremushkin from Kaspersky Lab.
| * Add write protection to OffsetPixelBufferPierre Ossman2019-11-152-0/+9
| | | | | | | | | | | | No one should every try to write to this buffer. Enforce that by throwing an exception if any one tries to get a writeable pointer to the data.
| * Restrict PixelBuffer dimensions to safe valuesPierre Ossman2019-11-151-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We do a lot of calculations based on pixel coordinates and we need to make sure they do not overflow. Restrict the maximum dimensions we support rather than try to switch over all calculations to use 64 bit integers. This prevents attackers from from injecting code by specifying a huge framebuffer size and relying on the values overflowing to access invalid areas of the heap. This primarily affects the client which gets both the screen dimensions and the pixel contents from the remote side. But the server might also be affected as a client can adjust the screen dimensions, as can applications inside the session. Issue found by Pavel Cheremushkin from Kaspersky Lab.
| * Encapsulate PixelBuffer internal detailsPierre Ossman2019-11-154-50/+78
| | | | | | | | | | | | Don't allow subclasses to just override dimensions or buffer details directly and instead force them to go via methods. This allows us to do sanity checks on the new values and catch bugs and attacks.
| * Make ZlibInStream more robust against failuresPierre Ossman2019-11-154-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | Move the checks around to avoid missing cases where we might access memory that is no longer valid. Also avoid touching the underlying stream implicitly (e.g. via the destructor) as it might also no longer be valid. A malicious server could theoretically use this for remote code execution in the client. Issue found by Pavel Cheremushkin from Kaspersky Lab
* | Correctly calculate rects with no CopyRect supportPierre Ossman2019-12-091-1/+3
|/ | | | | The copied rects have already been merged in to the changed rects at this point if the client doesn't support the CopyRect encoding.
* Merge branch 'fix-mistake' of https://github.com/gschwind/tigervncPierre Ossman2019-10-141-2/+2
|\
| * fix to early remove of iterator in VNCServerST::removeSocketBenoit Gschwind2019-08-241-2/+2
| |
* | Fix bad PixelBuffer reference in VNCServerST::setPixelBuffer()Pierre Ossman2019-10-041-1/+1
| | | | | | | | | | We need to examine the incoming PixelBuffer, not the previous one (which might not even be valid).
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-21 05:03:10 +0000