LibVNCServer: fix heap out-of-bound write access

Closes #243
6 years ago · 502821828e
parent 7b1ef0ffc4
commit 502821828e
1 changed files with 1 additions and 1 deletions
--- a/libvncserver/rfbserver.c
+++ b/libvncserver/rfbserver.c
@ -1465,7 +1465,7 @@ char *rfbProcessFileTransferReadBuffer(rfbClientPtr cl, uint32_t length)
    rfbLog("rfbProcessFileTransferReadBuffer(%dlen)\n", length);
    */
    if (length>0) {
-        buffer=malloc(length+1);
+        buffer=malloc((uint64_t)length+1);
        if (buffer!=NULL) {
            if ((n = rfbReadExact(cl, (char *)buffer, length)) <= 0) {
                if (n != 0)