1. 10 Oct, 2014 1 commit
    • Christian Beier's avatar
      Fix potential memory corruption in libvncclient. · 95efcfbf
      Christian Beier authored
      Fixes (maybe amongst others) the following oCERT report ([oCERT-2014-008]):
      
      LibVNCServer HandleRFBServerMessage rfbServerCutText malicious msg.sct.length
      
      It looks like there may be a chance for potential memory corruption when a LibVNCServer client attempts to process a Server Cut Text message.
      
        case rfbServerCutText:
        {
          char *buffer;
      
          if (!ReadFromRFBServer(client, ((char *)&msg) + 1,
      			   sz_rfbServerCutTextMsg - 1))
            return FALSE;
      
          msg.sct.length = rfbClientSwap32IfLE(msg.sct.length); << Retrieve malicious length
      
          buffer = malloc(msg.sct.length+1); << Allocate buffer. Can return 0x0
      
          if (!ReadFromRFBServer(client, buffer, msg.sct.length)) << Attempt to write to buffer
            return FALSE;
      
          buffer[msg.sct.length] = 0; << Attempt to write to buffer
      
          if (client->GotXCutText)
            client->GotXCutText(client, buffer, msg.sct.length); << Attempt to write to buffer
      
          free(buffer);
      
          break;
        }
      
      If a message is provided with an extremely large size it is possible to cause the malloc to fail, further leading to an attempt to write 0x0.
      95efcfbf
  2. 09 Oct, 2014 2 commits
  3. 07 Oct, 2014 5 commits
  4. 06 Oct, 2014 3 commits
  5. 03 Oct, 2014 1 commit
  6. 02 Oct, 2014 8 commits
  7. 30 Sep, 2014 4 commits
  8. 20 Sep, 2014 13 commits
  9. 09 Sep, 2014 3 commits