mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-21 08:08:29 +00:00
Code Issues Projects Releases Wiki Activity

libvncserver: patch CVE-2026-44988

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-44988

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and Khem Raj committed 2026-10-20 07:51:41 -07:00
1 parent cf06742a7c
commit 08a5882d96
2 files changed
+72
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-44988.patch
+71
View File
@@ -0,0 +1,71 @@
From db5779f2bec717f577fb66321b3b079ff156da95 Mon Sep 17 00:00:00 2001
From: Kang Hee chan <24s101h0659@sonline20.sen.go.kr>
Date: Wed, 6 May 2026 21:48:54 +0900
Subject: [PATCH] libvncclient: fix Tight gradient decoding overflow
(cherry picked from commit 5b270544b85233668b98161323297d418a8f5fd1)
CVE: CVE-2026-44988
Upstream-Status: Backport [https://github.com/LibVNC/libvncserver/commit/5b270544b85233668b98161323297d418a8f5fd1]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
include/rfb/rfbclient.h | 3 ++-
src/libvncclient/tight.c | 10 +++++++---
2 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/include/rfb/rfbclient.h b/include/rfb/rfbclient.h
index a974ff5f..666dcb90 100644
--- a/include/rfb/rfbclient.h
+++ b/include/rfb/rfbclient.h
@@ -314,10 +314,11 @@ typedef struct _rfbClient {
rfbBool zlibStreamActive[4];
/* Filter stuff. Should be initialized by filter initialization code. */
+#define TIGHT_GRADIENT_MAX_WIDTH 2048
rfbBool cutZeros;
int rectWidth, rectColors;
char tightPalette[256*4];
- uint8_t tightPrevRow[2048*3*sizeof(uint16_t)];
+ uint8_t tightPrevRow[TIGHT_GRADIENT_MAX_WIDTH*3*sizeof(uint16_t)];
#ifdef LIBVNCSERVER_HAVE_LIBJPEG
/** JPEG decoder state (obsolete-- do not use). */
diff --git a/src/libvncclient/tight.c b/src/libvncclient/tight.c
index 57a3715b..dad5514f 100644
--- a/src/libvncclient/tight.c
+++ b/src/libvncclient/tight.c
@@ -229,6 +229,11 @@ HandleTightBPP (rfbClient* client, int rx, int ry, int rw, int rh)
bitsPixel = InitFilterPaletteBPP(client, rw, rh);
break;
case rfbTightFilterGradient:
+ if (rw > TIGHT_GRADIENT_MAX_WIDTH) {
+ rfbClientLog("Tight Gradient rectangle width %d exceeds maximum %d.\n",
+ rw, TIGHT_GRADIENT_MAX_WIDTH);
+ return FALSE;
+ }
filterFn = FilterGradientBPP;
bitsPixel = InitFilterGradientBPP(client, rw, rh);
break;
@@ -430,7 +435,7 @@ FilterGradient24 (rfbClient* client, int srcx, int srcy, int numRows)
CARDBPP *dst =
(CARDBPP *)&client->frameBuffer[(srcy * client->width + srcx) * BPP / 8];
int x, y, c;
- uint8_t thisRow[2048*3];
+ uint8_t thisRow[TIGHT_GRADIENT_MAX_WIDTH*3];
uint8_t pix[3];
int est[3];
@@ -473,7 +478,7 @@ FilterGradientBPP (rfbClient* client, int srcx, int srcy, int numRows)
int x, y, c;
CARDBPP *src = (CARDBPP *)client->buffer;
uint16_t *thatRow = (uint16_t *)client->tightPrevRow;
- uint16_t thisRow[2048*3];
+ uint16_t thisRow[TIGHT_GRADIENT_MAX_WIDTH*3];
uint16_t pix[3];
uint16_t max[3];
int shift[3];
@@ -705,4 +710,3 @@ ReadCompactLen (rfbClient* client)
/* LIBVNCSERVER_HAVE_LIBZ and LIBVNCSERVER_HAVE_LIBJPEG */
#endif
#endif
-
meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
+1
View File
@@ -46,6 +46,7 @@ inherit cmake pkgconfig
SRC_URI = "git://github.com/LibVNC/libvncserver;branch=master;protocol=https;tag=LibVNCServer-${PV} \
file://0001-CMake-require-at-least-CMake-3.5.patch \
file://CVE-2026-44988.patch \
"
SRCREV = "9b54b1ec32731bd23158ca014dc18014db4194c3"