From c2c4b81e6cb3b485fb1ec7ba9e7defeb889f6ba7 Mon Sep 17 00:00:00 2001
From: Christian Beier <dontmind@freeshell.org>
Date: Sun, 6 Jan 2019 14:20:37 +0100
Subject: [PATCH] LibVNCClient: fail on server-sent desktop name lengths longer
 than 1MB

re #273
---
 libvncclient/rfbproto.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

[sunweaver] Ported over to tightvnc.

--- a/vncviewer/rfbproto.c
+++ b/vncviewer/rfbproto.c
@@ -303,13 +303,11 @@
   si.format.blueMax = Swap16IfLE(si.format.blueMax);
   si.nameLength = Swap32IfLE(si.nameLength);
 
-  /* FIXME: Check arguments to malloc() calls. */
-  desktopName = malloc(si.nameLength + 1);
-  if (!desktopName) {
-    fprintf(stderr, "Error allocating memory for desktop name, %lu bytes\n",
-            (unsigned long)si.nameLength);
-    return False;
+  if (si.nameLength > 1<<20) {
+      fprintf(stderr, "Too big desktop name length sent by server: %u B > 1 MB\n", (unsigned int)si.nameLength);
+      return FALSE;
   }
+  desktopName = malloc(si.nameLength + 1);
 
   if (!ReadFromRFBServer(desktopName, si.nameLength)) return False;
 
