[client] main: fix buffer overflow due to cursor data size change

gnif · Nov 1, 2021 · a21eee2 · a21eee2
1 parent 7075fe2
commit a21eee2
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/client/src/main.c b/client/src/main.c
@@ -305,6 +305,7 @@ int main_cursorThread(void * unused)
   LGMP_STATUS         status;
   LG_RendererCursor   cursorType = LG_CURSOR_COLOR;
   KVMFRCursor *       cursor     = NULL;
+  int                 cursorSize = 0;
 
   lgWaitEvent(e_startup, TIMEOUT_INFINITE);
 
@@ -377,6 +378,12 @@ int main_cursorThread(void * unused)
       break;
     }
 
+    if (cursor && msg.size > cursorSize)
+    {
+      free(cursor);
+      cursor = NULL;
+    }
+
     /* copy and release the message ASAP */
     if (!cursor)
     {
@@ -387,6 +394,7 @@ int main_cursorThread(void * unused)
         g_state.state = APP_STATE_SHUTDOWN;
         break;
       }
+      cursorSize = msg.size;
     }
 
     memcpy(cursor, msg.mem, msg.size);