File LibVNCServer-CVE-2014-6052.patch of Package LibVNCServer.10271
Index: LibVNCServer-0.9.9/libvncclient/rfbproto.c
===================================================================
--- LibVNCServer-0.9.9.orig/libvncclient/rfbproto.c
+++ LibVNCServer-0.9.9/libvncclient/rfbproto.c
@@ -1807,7 +1807,9 @@
client->updateRect.x = client->updateRect.y = 0;
client->updateRect.w = client->width;
client->updateRect.h = client->height;
- client->MallocFrameBuffer(client);
+ if (!client->MallocFrameBuffer(client))
+ return FALSE;
+
SendFramebufferUpdateRequest(client, 0, 0, rect.r.w, rect.r.h, FALSE);
rfbClientLog("Got new framebuffer size: %dx%d\n", rect.r.w, rect.r.h);
continue;
@@ -2260,7 +2262,9 @@
client->updateRect.x = client->updateRect.y = 0;
client->updateRect.w = client->width;
client->updateRect.h = client->height;
- client->MallocFrameBuffer(client);
+ if (!client->MallocFrameBuffer(client))
+ return FALSE;
+
SendFramebufferUpdateRequest(client, 0, 0, client->width, client->height, FALSE);
rfbClientLog("Got new framebuffer size: %dx%d\n", client->width, client->height);
break;
@@ -2276,7 +2280,9 @@
client->updateRect.x = client->updateRect.y = 0;
client->updateRect.w = client->width;
client->updateRect.h = client->height;
- client->MallocFrameBuffer(client);
+ if (!client->MallocFrameBuffer(client))
+ return FALSE;
+
SendFramebufferUpdateRequest(client, 0, 0, client->width, client->height, FALSE);
rfbClientLog("Got new framebuffer size: %dx%d\n", client->width, client->height);
break;
Index: LibVNCServer-0.9.9/libvncclient/vncviewer.c
===================================================================
--- LibVNCServer-0.9.9.orig/libvncclient/vncviewer.c
+++ LibVNCServer-0.9.9/libvncclient/vncviewer.c
@@ -243,8 +243,9 @@
client->width=client->si.framebufferWidth;
client->height=client->si.framebufferHeight;
- client->MallocFrameBuffer(client);
-
+ if (!client->MallocFrameBuffer(client))
+ return FALSE;
+
if (!SetFormatAndEncodings(client))
return FALSE;