libvncserver: encodings: prevent OOB accesses

LibVNC · May 28, 2020 · 74e8a70 · 74e8a70
1 parent 4616de6
commit 74e8a70
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/libvncserver/corre.c b/libvncserver/corre.c
@@ -233,7 +233,7 @@ subrectEncode##bpp(rfbClientPtr client, uint##bpp##_t *data, int w, int h) {
             seg = data+(j*w);                                                 \
             if (seg[x] != cl) {break;}                                        \
             i = x;                                                            \
-            while ((seg[i] == cl) && (i < w)) i += 1;                         \
+            while ((i < w) && (seg[i] == cl)) i += 1;                         \
             i -= 1;                                                           \
             if (j == y) vx = hx = i;                                          \
             if (i < vx) vx = i;                                               \

diff --git a/libvncserver/hextile.c b/libvncserver/hextile.c
@@ -224,7 +224,7 @@ subrectEncode##bpp(rfbClientPtr cl, uint##bpp##_t *data, int w, int h,
                     seg = data+(j*w);                                           \
                     if (seg[x] != cl2) {break;}                                 \
                     i = x;                                                      \
-                    while ((seg[i] == cl2) && (i < w)) i += 1;                  \
+                    while ((i < w) && (seg[i] == cl2)) i += 1;                  \
                     i -= 1;                                                     \
                     if (j == y) vx = hx = i;                                    \
                     if (i < vx) vx = i;                                         \

diff --git a/libvncserver/rre.c b/libvncserver/rre.c
@@ -200,7 +200,7 @@ static int                                                                    \
             seg = data+(j*w);                                                 \
             if (seg[x] != cl) {break;}                                        \
             i = x;                                                            \
-            while ((seg[i] == cl) && (i < w)) i += 1;                         \
+            while ((i < w) && (seg[i] == cl)) i += 1;                         \
             i -= 1;                                                           \
             if (j == y) vx = hx = i;                                          \
             if (i < vx) vx = i;                                               \