aboutsummaryrefslogtreecommitdiffstats
path: root/common
Commit message (Collapse)AuthorAgeFilesLines
* Limit size of cursor accepted by client.Michal Srb2017-04-062-0/+11
| | | | | | | | | Width and height of a cursor are received as U16 from network. Accepting full range of U16 values can cause integer overflows in multiple places. The worst is probably VLA in CMsgReader::readSetXCursor: rdr::U8 buf[width*height*4]; The width*height*4 can be too big to fit on stack or it can overflow into negative numbers. Both cases are undefined behaviour. Following writes to buf can overwrite other data on stack.
* Merge branches 'fix-vencrypt-leak' and 'fixes-ssecurityplain' of ↵Pierre Ossman2017-03-302-1/+11
|\ | | | | | | https://github.com/michalsrb/tigervnc
| * Limit max username/password size in SSecurityPlain.Michal Srb2017-03-302-0/+10
| | | | | | | | | | | | | | | | | | | | | | Setting the limit to 1024 which should be still more than enough. Unlimited ulen and plen can cause various security problems: * Overflow in `is->checkNoWait(ulen + plen)` causing it to contine when there is not enough data and then wait forever. * Overflow in `new char[plen + 1]` that would allocate zero sized array which succeeds but returns pointer that should not be written into. * Allocation failure in `new char[plen + 1]` from trying to allocate too much and crashing the whole server. All those issues can be triggered by a client before authentication.
| * Fix checkNoWait logic in SSecurityPlain.Michal Srb2017-03-301-1/+1
| | | | | | | | | | | | | | Currently it proceeds only if there aren't enough data in queue and then it blocks waiting. Also the required amount to receive from network is (ulen + plen), not (ulen + plen + 2). This allowed not authenticated clients to deny service to everyone.
* | Delete underlying ssecurity in SSecurityVeNCrypt.Michal Srb2017-03-291-0/+2
|/ | | | Otherwise it gets leaked which would allow even not authenticated clients to exhaust server memory.
*-. Merge branches 'fix' and 'fix-double-free-fences' of ↵Pierre Ossman2017-03-297-14/+17
|\ \ | | | | | | | | | https://github.com/michalsrb/tigervnc
| | * Prevent double free by crafted fences.Michal Srb2017-03-272-1/+4
| |/ |/| | | | | If client sent fence with some data, followed by fence with no data (length 0), the original fence data were freed, but the pointer kept pointing at them. Sending one more fence would attempt to free them again.
| * Prevent leak of SecurityServer and ClientServer.Michal Srb2017-03-274-13/+10
| | | | | | | | | | | | They are created in SConnection's and CConnection's constructors but never destroyed. There is no reason for the indirection, so lets make them direct members.
| * Fix crash from integer overflow in SMsgReader::readClientCutTextMichal Srb2017-03-271-0/+3
|/ | | | | | The length sent by client is U32, but is converted into int. If it was bigger than 0x7fffffff the resulting int is negative, it passes the check against maxCutText and later throws std::bad_alloc from CharArray which takes down the whole server. All the Streaming API deals with lengths in ints, so we can't tell it to skip that big amount of data. And it is not realistic to expect more than 2GB of clipboard data anyway. So lets just throw rdr::Exception that will disconnect this client and keep the server alive.
* Merge branch 'fps' of https://github.com/CendioOssman/tigervncPierre Ossman2017-02-247-160/+175
|\
| * Send updates with a fixed intervalPierre Ossman2017-02-245-84/+66
| | | | | | | | | | | | | | | | This redesigns the old "deferred updates" mechanism in to a frame clock that governs how often updates are sent out. The goal is still the same, to aggregate updates and avoid pointless updates, all in the name of efficiency. This model should however be more robust against delays that sometimes causes us to miss the desired rate.
| * Avoid flicker with a rendered cursorPierre Ossman2017-02-241-9/+4
| | | | | | | | | | This is not the code path commonly used in performance sensitive scenarios, so favour correctness over performance.
| * Only update rendered cursor when requestedPierre Ossman2017-02-243-28/+26
| |
| * Clean up VNCSConnectionST::needRenderedCursor()Pierre Ossman2017-02-241-3/+10
| | | | | | | | Make it a bit more readable.
| * Split up VNCSConnectionST::writeFramebufferUpdate()Pierre Ossman2017-02-242-38/+55
| | | | | | | | Make the control flow a bit clearer.
| * Better handling of slow timersPierre Ossman2017-02-241-7/+23
| | | | | | | | | | Make sure the code deals more gracefully with timers that take a long time to execute, and therefore might miss their deadlines.
* | Display performance statistics in viewerPierre Ossman2017-02-242-8/+10
| | | | | | | | | | | | Adds an optional graph to the viewer to display current frame rate, pixel rate and network bandwidth. Makes it easier to debug and test performance related issues.
* | Don't try to render cursors with no sizePierre Ossman2017-02-231-0/+5
| | | | | | | | | | Even if there are no pixels it will still trigger sanity checks when we start throwing bogus coordinates around.
* | Remove reallocation log message from ManagedPixelBufferPierre Ossman2017-02-221-1/+0
| | | | | | | | It adds a lot of noise to the debug output with little gain.
* | Server support for cursor with alphaPierre Ossman2017-02-225-6/+69
| |
* | Client support for cursors with full alphaPierre Ossman2017-02-227-0/+68
| |
* | Properly handle depth > 24 in ZRLE decoderPierre Ossman2017-02-221-16/+20
| |
* | Client support for X CursorPierre Ossman2017-02-223-1/+62
| |
* | Dither cursors when reducing depthPierre Ossman2017-02-221-19/+119
| |
* | Change cursor API to use RGBA dataPierre Ossman2017-02-2214-315/+190
| | | | | | | | | | This will allow us to use better formats that preserve the entire alpha channel.
* | Fix for exception handling in decoder threadsPierre Ossman2017-02-221-1/+1
| |
* | spelling fixesklemens2017-01-287-8/+8
| |
* | Crop cursor before calling maskRect()Pierre Ossman2017-01-201-4/+6
| | | | | | | | We can no longer assume maskRect() will tolerate uncropped data.
* | Restore cropping API to maskRect()Pierre Ossman2017-01-202-23/+31
| | | | | | | | | | | | We need to restore the previous, more complex API in order to easily handle masks now that we no longer accept out-of-bounds operations.
* | Prevent invalid PixelBuffer accessesPierre Ossman2017-01-181-73/+126
| | | | | | | | | | | | There has been multiple attempts at tricking decoders to exceed the boundaries of the active pixel buffer. Add extra checks to prevent such invalid access.
* | Check invalid RRE rectsPierre Ossman2017-01-181-0/+5
| |
* | Fix buffer overflow in ModifiablePixelBuffer::fillRect.Michal Srb2017-01-171-4/+15
|/ | | | | | It can be triggered by RRE message with subrectangle out of framebuffer boundaries. It may prevent the same kind of issue caused by evil message from another encoding too.
* Merge branch 'master' of https://github.com/atalax/tigervncPierre Ossman2016-11-101-0/+4
|\
| * hextileDecode.h: Fix buffer overflowJosef Gajdusek2016-11-041-0/+4
| | | | | | | | | | The hextileDecodexx functions do not properly check for out-of-bounds writes, which allows a malicious server to overwrite parts of the stack.
* | Log statistics from ComparingUpdateTrackerPierre Ossman2016-11-083-1/+42
|/
* Fix busy loop in FdOutStream::flush()Pierre Ossman2016-10-101-1/+6
| | | | | | | This bug was introduced in c6df31db. A non-blocking socket that did not have any more space would busy loop until the write succeeded. Instead now it returns without any action, just as it did before the bug was introduced.
* Move getSockets() to SocketServer interfacePierre Ossman2016-10-053-15/+14
| | | | | Any caller using add or remove should also be able to list the sockets.
* Fix temporary decoder buffer sizesPierre Ossman2016-10-053-8/+8
| | | | | Some of these were excessively large because of redundant factors in the size calculation.
* Apply -fPIC on all compilersPierre Ossman2016-09-221-1/+1
|
* Fix minor typo in framebuffer initializationBrian P. Hinz2016-09-051-1/+1
|
* Proper global init/deinit of GnuTLSPierre Ossman2016-08-234-33/+10
| | | | | | These are reference counted so it is important to retain symmetry between the calls. Failure to do so will result in bad memory access and crashes.
* Fix display/port switch at display 100Pierre Ossman2016-07-111-8/+5
| | | | | 168b92c broke the handling that assumes display 100 and above are actually a port number.
* Replace Windows specific thread handlingPierre Ossman2016-07-078-67/+42
| | | | Use the platform independent primitives instead.
* Include stddef.h to get access to size_tPierre Ossman2016-07-071-0/+2
|
* Fix typo in include protectorPierre Ossman2016-07-071-1/+1
|
* Clean up getHostAndPort()Pierre Ossman2016-06-281-15/+61
| | | | | It now does more validation, and handles unescaped IPv6 addresses better.
* Avoid symbol clash for Xregion functionsPierre Ossman2016-05-131-0/+16
| | | | | | | We might be linking our Xregion and libX11 into the same binary, causing a clash between the symbols. In theory they should be compatible, but that's not guaranteed. Avoid the issue by adding a "vnc" prefix to our version.
* Update Xregion to latest upstreamPierre Ossman2016-05-133-384/+269
|
* Split Xregion headers according to upstreamPierre Ossman2016-05-137-342/+419
| | | | | We've stolen the Xregion code from libX11, so let's keep the same header naming so that it is easier to keep things in sync.
* Fix mistake in TightEncoder::setCompressLevel.Michal Srb2016-05-061-1/+1
|
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-05 17:26:22 +0000