File LibVNCServer-CVE-2014-6054.patch of Package LibVNCServer.7946

Overview Repositories Revisions Requests Users Attributes Meta

File LibVNCServer-CVE-2014-6054.patch of Package LibVNCServer.7946

From 05a9bd41a8ec0a9d580a8f420f41718bdd235446 Mon Sep 17 00:00:00 2001
From: Nicolas Ruff <nruff@google.com>
Date: Mon, 18 Aug 2014 15:22:48 +0200
Subject: [PATCH] Do not accept a scaling factor of zero on
 PalmVNCSetScaleFactor and SetScale client->server messages. This would cause
 a division by zero and crash the server.

---
 libvncserver/rfbserver.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

Index: LibVNCServer-0.9.9/libvncserver/rfbserver.c
===================================================================
--- LibVNCServer-0.9.9.orig/libvncserver/rfbserver.c
+++ LibVNCServer-0.9.9/libvncserver/rfbserver.c
@@ -2487,6 +2487,20 @@
           rfbCloseClient(cl);
           return;
       }
+
+      if (msg.ssc.scale == 0) {
+          rfbLogPerror("rfbProcessClientNormalMessage: will not accept a scale factor of zero");
+          rfbCloseClient(cl);
+          return;
+      }
+
+
+      if (msg.ssc.scale == 0) {
+          rfbLogPerror("rfbProcessClientNormalMessage: will not accept a scale factor of zero");
+          rfbCloseClient(cl);
+          return;
+      }
+
       rfbStatRecordMessageRcvd(cl, msg.type, sz_rfbSetScaleMsg, sz_rfbSetScaleMsg);
       rfbLog("rfbSetScale(%d)\n", msg.ssc.scale);
       rfbScalingSetup(cl,cl->screen->width/msg.ssc.scale, cl->screen->height/msg.ssc.scale);

Places

File LibVNCServer-CVE-2014-6054.patch of Package LibVNCServer.7946

Places