From: Christian Beier Date: Mon, 1 Oct 2018 19:38:33 +0200 Subject: LibVNCClient: make sure Ultra decoding cannot dereference a null pointer Origin: https://github.com/LibVNC/libvncserver/commit/4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2018-20024 Bug-Debian: https://bugs.debian.org/916941 Bug: https://github.com/LibVNC/libvncserver/issues/254 Closes #254 --- libvncclient/ultra.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libvncclient/ultra.c b/libvncclient/ultra.c index a82e2eddbdc2..a2875267e790 100644 --- a/libvncclient/ultra.c +++ b/libvncclient/ultra.c @@ -66,6 +66,8 @@ HandleUltraBPP (rfbClient* client, int rx, int ry, int rw, int rh) if ((client->raw_buffer_size % 4)!=0) client->raw_buffer_size += (4-(client->raw_buffer_size % 4)); client->raw_buffer = (char*) malloc( client->raw_buffer_size ); + if(client->raw_buffer == NULL) + return FALSE; } /* allocate enough space to store the incoming compressed packet */ @@ -150,6 +152,8 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh) if ((client->raw_buffer_size % 4)!=0) client->raw_buffer_size += (4-(client->raw_buffer_size % 4)); client->raw_buffer = (char*) malloc( client->raw_buffer_size ); + if(client->raw_buffer == NULL) + return FALSE; } -- 2.20.1