SECURITY: memory leak in libvncclient in ConnectToRFBRepeater function

[PaulCher]

ConnectToRFBRepeater

libvncserver/libvncclient/rfbproto.c

Line 401 in 79516a6

snprintf(tmphost, sizeof(tmphost), "%s:%d", destHost, destPort);

function leaks memory, because tmphost buffer is filled by using snprintf function, but after buffer is being sent back to client using WriteToRFBServer(client, tmphost, sizeof(tmphost)), which sent the whole tmphost buffer including its uninitialized part, which would expose uninitialized memory of client application.

Example file examples/repeater.c contains same kind of vulnerability as well.

This security issue is a result of my work at Kaspersky Lab ICS CERT Vulnerability Research Group at position of Security Researcher.

For more information about ICS CERT please contact:
ics-cert@kaspersky.com
https://ics-cert.kaspersky.com/

Best regards,
Pavel Cheremushkin