tree f95be292b3ca307867ec831a3cef9720578ac04f
parent b3959efdbb2dc3d5959e3b0a8e188126930beca8
author Peter Lieven <pl@kamp.de> 1404115674 +0200
committer Gerd Hoffmann <kraxel@redhat.com> 1404214000 +0200

ui/vnc: limit client_cut_text msg payload size

currently a malicious client could define a payload
size of 2^32 - 1 bytes and send up to that size of
data to the vnc server. The server would allocated
that amount of memory which could easily create an
out of memory condition.

This patch limits the payload size to 1MB max.

Please note that client_cut_text messages are currently
silently ignored.

Signed-off-by: Peter Lieven <pl@kamp.de>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>