github/xrdp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

CVE-2026-41521: lib_framebuffer_update int overflow

Browse Source 
An integer overflow can lead to possible heap info leak and ASLR
bypass.
This commit is contained in:
matt335672
2026-04-15 11:35:39 +01:00
parent c3788a374a
commit 2a94fc9674
1 changed files with 31 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vnc/vnc.c
+29 -2
View File
@@ -978,6 +978,21 @@ skip_encoding(struct vnc *v, int x, int y, int cx, int cy,
return error;
}
/**************************************************************************//**
* Checks the size parameters from a framebuffer update are sane
* @param cx Width of update
* @param cy height of update
* @return 0 if the proposed sizes could result in overflow
*
* [MS-RDPBCGR] allows for a max desktop size of 32766 x 32766.
* Each pixel needs up to 4 bytes
*/
static int
framebuffer_update_size_ok(int cx, int cy)
{
return (cx <= 32766 && cy <= 32766 && (cx * cy) <= (INT_MAX / 4));
}
/**************************************************************************//**
* Parses an entire framebuffer update message from the wire, and returns the
* first matching ExtendedDesktopSize encoding if found.
@@ -1036,7 +1051,13 @@ find_matching_extended_rect(struct vnc *v,
in_uint16_be(s, cy);
in_uint32_be(s, encoding);
if (encoding == RFB_ENC_EXTENDED_DESKTOP_SIZE &&
if (!framebuffer_update_size_ok(cx, cy))
{
LOG(LOG_LEVEL_ERROR,
"find_matching_extended_rect: Frame buffer too large");
error = 1;
}
else if (encoding == RFB_ENC_EXTENDED_DESKTOP_SIZE &&
!found &&
match(x, y, cx, cy))
{
@@ -1467,7 +1488,13 @@ lib_framebuffer_update(struct vnc *v)
in_uint16_be(s, cy);
in_uint32_be(s, encoding);
if (encoding == RFB_ENC_RAW)
if (!framebuffer_update_size_ok(cx, cy))
{
LOG(LOG_LEVEL_ERROR,
"lib_framebuffer_update: Frame buffer too large");
error = 1;
}
else if (encoding == RFB_ENC_RAW)
{
need_size = cx * cy * get_bytes_per_pixel(v->server_bpp);
init_stream(pixel_s, need_size);