path: root/gst/vmnc/vmncdec.c
diff options
authorSebastian Dröge <>2016-11-16 20:41:39 +0200
committerSebastian Dröge <>2016-11-16 20:41:39 +0200
commit4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe (patch)
tree30ba305eb7f43a7d5a6c0ee8195db8d360d9873c /gst/vmnc/vmncdec.c
parentc7192f045009ec4a7cf6d1026f226bb3426f1fd0 (diff)
vmncdec: Sanity-check width/height before using it
We will allocate a screen area of width*height*bpp bytes, however this calculation can easily overflow if too high width or height are given inside the stream. Nonetheless we would just assume that enough memory was allocated, try to fill it and overwrite as much memory as wanted. Also allocate the screen area filled with zeroes to ensure that we start with full-black and not any random (or not so random) data. Ideally we should just remove this plugin in favour of the one in gst-libav, which generally seems to be of better code quality.
Diffstat (limited to 'gst/vmnc/vmncdec.c')
1 files changed, 5 insertions, 1 deletions
diff --git a/gst/vmnc/vmncdec.c b/gst/vmnc/vmncdec.c
index e8d498c27..b3c977883 100644
--- a/gst/vmnc/vmncdec.c
+++ b/gst/vmnc/vmncdec.c
@@ -260,7 +260,7 @@ vmnc_handle_wmvi_rectangle (GstVMncDec * dec, struct RfbRectangle *rect,
gst_video_codec_state_unref (state);
g_free (dec->imagedata);
- dec->imagedata = g_malloc (dec->format.width * dec->format.height *
+ dec->imagedata = g_malloc0 (dec->format.width * dec->format.height *
GST_DEBUG_OBJECT (dec, "Allocated image data at %p", dec->imagedata);
@@ -790,6 +790,10 @@ vmnc_handle_packet (GstVMncDec * dec, const guint8 * data, int len,
GST_WARNING_OBJECT (dec, "Rectangle out of range, type %d", r.type);
+ } else if (r.width > 16384 || r.height > 16384) {
+ GST_WARNING_OBJECT (dec, "Width or height too high: %ux%u", r.width,
+ r.height);
switch (r.type) {