[vlc-commits] [Git][videolan/vlc][3.0.x] 3 commits: access: vnc: handle NDEBUG assert check

[François Cartegnie (@fcartegnie)]

François Cartegnie pushed to branch 3.0.x at VideoLAN / VLC


Commits:
a7ffe084 by François Cartegnie at 2026-09-01T08:10:37+02:00
access: vnc: handle NDEBUG assert check

assert does not prevent of anything

(cherry picked from commit 2b2b471738ddda930e202d6cdf23182ae6e99689)

- - - - -
955a87a6 by François Cartegnie at 2026-09-01T08:10:37+02:00
access: vnc: fix potential overflow

mul_overflow parameter could also overflow before check

(adapted from commit 4c11606bc9197bf433bb48935090679937054167)

- - - - -
04955c76 by François Cartegnie at 2026-09-01T08:10:37+02:00
access: vnc: check es

(cherry picked from commit e042b3285bdfae28417da27ec341c9266a91e89c)

- - - - -


1 changed file:

- modules/access/vnc.c


Changes:

=====================================
modules/access/vnc.c
=====================================
@@ -34,6 +34,7 @@
 # include "config.h"
 #endif
 #include <assert.h>
+#include <limits.h>
 
 #include <vlc_common.h>
 #include <vlc_plugin.h>
@@ -144,11 +145,14 @@ static rfbBool mallocFrameBufferHandler( rfbClient* p_client )
         p_sys->es = NULL;
     }
 
-    assert(!(p_client->width & ~0xffff)); // fits in 16 bits
-    uint16_t i_width = p_client->width;
-
-    assert(!(p_client->height & ~0xffff)); // fits in 16 bits
-    uint16_t i_height = p_client->height;
+    if ( p_client->width > UINT16_MAX || p_client->height > UINT16_MAX )
+    {
+        assert(p_client->width <= UINT16_MAX); // fits in 16 bits
+        assert(p_client->height <= UINT16_MAX); // fits in 16 bits
+        return FALSE;
+    }
+    unsigned int i_width = p_client->width;
+    unsigned int i_height = p_client->height;
 
     uint8_t i_bits_per_pixel = p_client->format.bitsPerPixel;
     assert((i_bits_per_pixel & 0x7) == 0); // multiple of 8
@@ -186,7 +190,8 @@ static rfbBool mallocFrameBufferHandler( rfbClient* p_client )
     }
 
     /* Set up framebuffer */
-    if (mul_overflow(i_width, i_height * (i_bits_per_pixel / 8), &p_sys->i_framebuffersize)) {
+    if (mul_overflow(i_height, i_bits_per_pixel / 8, &p_sys->i_framebuffersize) ||
+        mul_overflow(i_width, p_sys->i_framebuffersize, &p_sys->i_framebuffersize)) {
         msg_Err(p_demux, "VNC framebuffersize overflow");
         return FALSE;
     }
@@ -366,7 +371,8 @@ static void *DemuxThread( void *p_data )
             if ( ! i_status )
             {
                 msg_Warn( p_demux, "Cannot get announced data. Server closed ?" );
-                es_out_Del( p_demux->out, p_sys->es );
+                if ( p_sys->es )
+                    es_out_Del( p_demux->out, p_sys->es );
                 p_sys->es = NULL;
                 return NULL;
             }
@@ -377,7 +383,10 @@ static void *DemuxThread( void *p_data )
                 {
                     p_sys->p_block->i_dts = p_sys->p_block->i_pts = mdate();
                     es_out_SetPCR( p_demux->out, p_sys->p_block->i_pts );
-                    es_out_Send( p_demux->out, p_sys->es, p_sys->p_block );
+                    if ( p_sys->es )
+                        es_out_Send( p_demux->out, p_sys->es, p_sys->p_block );
+                    else
+                        block_Release( p_sys->p_block );
                     p_sys->p_block = p_block;
                 }
             }



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/f817dce9e2f2005c0ec01b21a148affdbe1f669e...04955c76b15d4cae13f1c16e508b2fe91893e041

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/f817dce9e2f2005c0ec01b21a148affdbe1f669e...04955c76b15d4cae13f1c16e508b2fe91893e041
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help