extern/KasmVNC
1
0
Fork 0
mirror of https://github.com/kasmtech/KasmVNC.git synced 2024-11-28 19:14:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add sanity checks for PixelFormat shift values

Browse Source 
Otherwise we might be tricked in to reading and writing things at
incorrect offsets for pixels which ultimately could result in an
attacker writing things to the stack or heap and executing things
they shouldn't.

This only affects the server as the client never uses the pixel
format suggested by th server.

Issue found by Pavel Cheremushkin from Kaspersky Lab.
This commit is contained in:
Pierre Ossman 2019-09-10 16:07:50 +02:00 committed by Lauri Kasanen
parent 9f7abaea3a
commit 1d5aaf54f8
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
common/rfb/PixelFormat.cxx
View File

@ -681,6 +681,13 @@ bool PixelFormat::isSane(void)
if (totalBits > depth) if (totalBits > depth)
return false; return false;
if ((bits(redMax) + redShift) > bpp)
return false;
if ((bits(greenMax) + greenShift) > bpp)
return false;
if ((bits(blueMax) + blueShift) > bpp)
return false;
if (((redMax << redShift) & (greenMax << greenShift)) != 0) if (((redMax << redShift) & (greenMax << greenShift)) != 0)
return false; return false;
if (((redMax << redShift) & (blueMax << blueShift)) != 0) if (((redMax << redShift) & (blueMax << blueShift)) != 0)