From 6037a9074d52b1963c97cb28ea1096c7c14cbf28 Mon Sep 17 00:00:00 2001
From: Nicolas Ruff <nruff@google.com>
Date: Mon, 18 Aug 2014 15:16:16 +0200
Subject: [PATCH] Check malloc() return value on client->server ClientCutText
 message. Client can send up to 2**32-1 bytes of text, and such a large
 allocation is likely to fail in case of high memory pressure. This would in a
 server crash (write at address 0).

[sunweaver] port libvncserver patch over to tightvnc's vnc server code

---
 libvncserver/rfbserver.c | 5 +++++
 1 file changed, 5 insertions(+)

--- a/Xvnc/programs/Xserver/hw/vnc/rfbserver.c
+++ b/Xvnc/programs/Xserver/hw/vnc/rfbserver.c
@@ -891,6 +891,12 @@
 
 	str = (char *)xalloc(msg.cct.length);
 
+	if (str == NULL) {
+		rfbLogPerror("rfbProcessClientNormalMessage: not enough memory");
+		rfbCloseSock(cl->sock);
+		return;
+	}
+
 	if ((n = ReadExact(cl->sock, str, msg.cct.length)) <= 0) {
 	    if (n != 0)
 		rfbLogPerror("rfbProcessClientNormalMessage: read");
