rfb/rfbconfig.h.cmake | 3 1 + 2 - 0 !
1 file changed, 1 insertion(+), 2 deletions(-)

 remove libpng support.
Debian-Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725480

Makefile.am | 4 2 + 2 - 0 !
configure.ac | 3 0 + 3 - 0 !
2 files changed, 2 insertions(+), 5 deletions(-)

 ignore_webclients

libvncserver/rfbserver.c | 20 19 + 1 - 0 !
1 file changed, 19 insertions(+), 1 deletion(-)

 cve-2018-7225

Bug-Debian: https://bugs.debian.org/894045

libvncserver/tightvnc-filetransfer/handlefiletransferrequest.c | 3 1 + 2 - 0 !
libvncserver/tightvnc-filetransfer/rfbtightproto.h | 1 1 + 0 - 0 !
2 files changed, 2 insertions(+), 2 deletions(-)

 [1/5] tightvnc-filetransfer: tie the download thread to the control
 structure

libvncserver/tightvnc-filetransfer/filetransfermsg.c | 12 10 + 2 - 0 !
libvncserver/tightvnc-filetransfer/filetransfermsg.h | 3 2 + 1 - 0 !
libvncserver/tightvnc-filetransfer/handlefiletransferrequest.c | 8 4 + 4 - 0 !
3 files changed, 16 insertions(+), 7 deletions(-)

 [2/5] tightvnc-filetransfer: refactor closeundonefiletransfer() into
 two functions

libvncserver/tightvnc-filetransfer/filetransfermsg.c | 2 2 + 0 - 0 !
libvncserver/tightvnc-filetransfer/rfbtightserver.c | 7 5 + 2 - 0 !
2 files changed, 7 insertions(+), 2 deletions(-)

 [3/5] tightvnc-filetransfer: wait for download thread end in
 CloseUndoneFileDownload()

libvncserver/tightvnc-filetransfer/handlefiletransferrequest.c | 3 1 + 2 - 0 !
1 file changed, 1 insertion(+), 2 deletions(-)

 [4/5] tightvnc-filetransfer: when creating a new download thread,
 make sure the previous one ends

libvncserver/tightvnc-filetransfer/handlefiletransferrequest.c | 6 0 + 6 - 0 !
1 file changed, 6 deletions(-)

 [5/5] tightvnc-filetransfer: do not close stuff from within a thread

libvncserver/rfbserver.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 libvncserver: fix heap out-of-bound write access

libvncclient/rfbproto.c | 10 6 + 4 - 0 !
1 file changed, 6 insertions(+), 4 deletions(-)

 libvncclient: fix three possible heap buffer overflows

libvncclient/corre.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 libvncclient: make sure readfromrfbserver() does not write after
 buffer end in CoRRE decoding

libvncclient/corre.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 libvncclient: really fix #250

libvncclient/rfbproto.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 libvncclient: fix possible infinite loop

libvncclient/rfbproto.c | 2 2 + 0 - 0 !
1 file changed, 2 insertions(+)

 libvncclient: don't leak uninitialised memory to remote

examples/repeater.c | 10 8 + 2 - 0 !
libvncclient/rfbproto.c | 8 6 + 2 - 0 !
2 files changed, 14 insertions(+), 4 deletions(-)

 when connecting to a repeater, only send initialised string

libvncclient/ultra.c | 4 4 + 0 - 0 !
1 file changed, 4 insertions(+)

 libvncclient: make sure ultra decoding cannot dereference a null
 pointer

libvncserver/tightvnc-filetransfer/handlefiletransferrequest.c | 2 2 + 0 - 0 !
1 file changed, 2 insertions(+)

 tightvnc-filetransfer: fix heap use-after-free

libvncclient/rfbproto.c | 5 5 + 0 - 0 !
1 file changed, 5 insertions(+)

 libvncclient: ignore server-sent cut text longer than 1mb

libvncclient/rfbproto.c | 45 21 + 24 - 0 !
1 file changed, 21 insertions(+), 24 deletions(-)

 libvncclient: ignore server-sent reason strings longer than 1mb

libvncclient/rfbproto.c | 8 6 + 2 - 0 !
1 file changed, 6 insertions(+), 2 deletions(-)

 libvncclient: fail on server-sent desktop name lengths longer than
 1MB

libvncclient/rfbproto.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 libvncclient: remove now-useless cast

libvncserver/rfbserver.c | 14 12 + 2 - 0 !
1 file changed, 12 insertions(+), 2 deletions(-)

 error out in rfbprocessfiletransferreadbuffer if length can not be
 allocated

libvncserver/rfbserver.c | 7 6 + 1 - 0 !
1 file changed, 6 insertions(+), 1 deletion(-)

 limit lenght to int_max bytes in rfbprocessfiletransferreadbuffer()

libvncserver/rfbserver.c | 2 2 + 0 - 0 !
1 file changed, 2 insertions(+)

 [patch] rfbserver: don't leak stack memory to the remote

Thanks go to Pavel Cheremushkin of Kaspersky for reporting.

libvncserver/main.c | 18 12 + 6 - 0 !
1 file changed, 12 insertions(+), 6 deletions(-)

 [patch] fix use-after-free

libvncserver/main.c | 29 26 + 3 - 0 !
libvncserver/rfbserver.c | 5 5 + 0 - 0 !
rfb/rfb.h | 1 1 + 0 - 0 !
3 files changed, 32 insertions(+), 3 deletions(-)

 [patch] fix the concurrent issue hapenning between the freeing of the
 client and the clientOutput thread

libvncserver/main.c | 5 4 + 1 - 0 !
1 file changed, 4 insertions(+), 1 deletion(-)

 [patch] check the return code of pipe

libvncserver/rfbserver.c | 5 5 + 0 - 0 !
1 file changed, 5 insertions(+)

 [patch] rfbserver: don't close fd 0 accidentally

pipe_notify_client_thread needs to be initialized to -1

libvncserver/main.c | 2 2 + 0 - 0 !
1 file changed, 2 insertions(+)

 [patch] avoid pthread_join if backgroundloop is false

client_thread is created depending upon backgroundLoop, but joining
without checking for same condition. so we are trying to join a garbage
thread_id.

rfb/rfb.h | 4 3 + 1 - 0 !
1 file changed, 3 insertions(+), 1 deletion(-)

 [patch] move pipe_notify_client_thread to end of rfbclientrec

in order to retain ABI compatibility.

libvncclient/vncviewer.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 [patch] issue #141: set truecolour flag to 1 instead of 255

libvncclient/cursor.c | 5 5 + 0 - 0 !
1 file changed, 5 insertions(+)

---

libvncclient/sockets.c | 4 4 + 0 - 0 !
1 file changed, 4 insertions(+)

 [patch] libvncclient: bail out if unix socket name would overflow

Closes #291

libvncserver/rfbregion.c | 26 16 + 10 - 0 !
libvncserver/rfbserver.c | 4 3 + 1 - 0 !
2 files changed, 19 insertions(+), 11 deletions(-)

 [patch] libvncserver: add missing null pointer checks

libvncclient/rfbproto.c | 11 7 + 4 - 0 !
1 file changed, 7 insertions(+), 4 deletions(-)

 [patch] libvncclient: fix pointer aliasing/alignment issue

Accessing byte-aligned data through uint32_t pointers can cause crashes
on some platforms or reduce the performance. Therefore ensure a proper
stack alignment.

libvncserver/translate.c | 11 7 + 4 - 0 !
1 file changed, 7 insertions(+), 4 deletions(-)

 [patch] libvncserver: fix pointer aliasing/alignment issue

Accessing byte-aligned data through uint16_t pointers can cause crashes
on some platforms or reduce the performance. Therefore ensure a proper
stack alignment.

libvncserver/scale.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 [patch] libvncserver: scale: cast to 64 bit before shifting

Since pixel_value is 64 bit the data type of the shift operand should
be 64 bit too to prevent integer overflows.

libvncserver/corre.c | 2 1 + 1 - 0 !
libvncserver/hextile.c | 2 1 + 1 - 0 !
libvncserver/rre.c | 2 1 + 1 - 0 !
3 files changed, 3 insertions(+), 3 deletions(-)

 [patch] libvncserver: encodings: prevent oob accesses

libvncclient/rfbproto.c | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

 [patch] libvncclient/rfbproto: limit max textchat size

Addresses GitHub Security Lab (GHSL) Vulnerability Report
`GHSL-2020-063`.

Re #275