From 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 Mon Sep 17 00:00:00 2001 From: Christian Beier Date: Mon, 1 Oct 2018 19:38:33 +0200 Subject: [PATCH] LibVNCClient: make sure Ultra decoding cannot dereference a null pointer Closes #254 --- libvncclient/ultra.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libvncclient/ultra.c b/libvncclient/ultra.c index a82e2ed..a287526 100644 --- a/libvncclient/ultra.c +++ b/libvncclient/ultra.c @@ -66,6 +66,8 @@ HandleUltraBPP (rfbClient* client, int rx, int ry, int rw, int rh) if ((client->raw_buffer_size % 4)!=0) client->raw_buffer_size += (4-(client->raw_buffer_size % 4)); client->raw_buffer = (char*) malloc( client->raw_buffer_size ); + if(client->raw_buffer == NULL) + return FALSE; } /* allocate enough space to store the incoming compressed packet */ @@ -150,6 +152,8 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh) if ((client->raw_buffer_size % 4)!=0) client->raw_buffer_size += (4-(client->raw_buffer_size % 4)); client->raw_buffer = (char*) malloc( client->raw_buffer_size ); + if(client->raw_buffer == NULL) + return FALSE; }