From e34bcbb759ca5bef85809967a268fdf214c1ad2c Mon Sep 17 00:00:00 2001
From: Christian Beier <dontmind@freeshell.org>
Date: Sat, 29 Dec 2018 14:40:53 +0100
Subject: [PATCH] LibVNCClient: ignore server-sent reason strings longer than
 1MB

Fixes #273

[sunweaver] Extract these few lines from the above referenced patch and port to tightvnc.
            This patch was part of the fix series for CVE-2018-20748/libvncserver

---
 libvncclient/rfbproto.c | 5 +++++
 1 file changed, 5 insertions(+)

--- a/vncviewer/rfbproto.c
+++ b/vncviewer/rfbproto.c
@@ -1293,6 +1293,10 @@
 
   if (ReadFromRFBServer((char *)&reasonLen, sizeof(reasonLen))) {
     reasonLen = Swap32IfLE(reasonLen);
+    if(reasonLen > 1<<20) {
+      fprintf(stderr, "VNC connection failed, but sent reason length of %u exceeds limit of 1MB",(unsigned int)reasonLen);
+      return;
+    }
     if ((reason = malloc(reasonLen)) != NULL &&
         ReadFromRFBServer(reason, reasonLen)) {
       fprintf(stderr,"%.*s\n", (int)reasonLen, reason);
