Skip to content

Commit 74e8a70

Browse files
committed
libvncserver: encodings: prevent OOB accesses
1 parent 4616de6 commit 74e8a70

File tree

3 files changed

+3
-3
lines changed

3 files changed

+3
-3
lines changed

Diff for: libvncserver/corre.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -233,7 +233,7 @@ subrectEncode##bpp(rfbClientPtr client, uint##bpp##_t *data, int w, int h) {
233233
seg = data+(j*w); \
234234
if (seg[x] != cl) {break;} \
235235
i = x; \
236-
while ((seg[i] == cl) && (i < w)) i += 1; \
236+
while ((i < w) && (seg[i] == cl)) i += 1; \
237237
i -= 1; \
238238
if (j == y) vx = hx = i; \
239239
if (i < vx) vx = i; \

Diff for: libvncserver/hextile.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -224,7 +224,7 @@ subrectEncode##bpp(rfbClientPtr cl, uint##bpp##_t *data, int w, int h,
224224
seg = data+(j*w); \
225225
if (seg[x] != cl2) {break;} \
226226
i = x; \
227-
while ((seg[i] == cl2) && (i < w)) i += 1; \
227+
while ((i < w) && (seg[i] == cl2)) i += 1; \
228228
i -= 1; \
229229
if (j == y) vx = hx = i; \
230230
if (i < vx) vx = i; \

Diff for: libvncserver/rre.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -200,7 +200,7 @@ static int \
200200
seg = data+(j*w); \
201201
if (seg[x] != cl) {break;} \
202202
i = x; \
203-
while ((seg[i] == cl) && (i < w)) i += 1; \
203+
while ((i < w) && (seg[i] == cl)) i += 1; \
204204
i -= 1; \
205205
if (j == y) vx = hx = i; \
206206
if (i < vx) vx = i; \

0 commit comments

Comments
 (0)