applications/droidVncServer
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fixed two off-by-one errors in droidvncserver.c

Browse Source 
the msg string is a concatenation of two strings and a '\n' character
(strlen(str1) + strlen(str2) + 1) is one byte off because the
string needs to be terminated by a NUL byte.
This commit is contained in:
Christian Fiedler 2016-05-21 21:49:26 +02:00
parent be8ba34a15
commit 0aa7d2f8c2
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
jni/vnc/droidvncserver.c
View File

@ -104,7 +104,7 @@ rfbNewClientHookPtr clientHook(rfbClientPtr cl)
cl->clientGoneHook=(ClientGoneHookPtr)clientGone; cl->clientGoneHook=(ClientGoneHookPtr)clientGone;
char *header="~CONNECTED|"; char *header="~CONNECTED|";
char *msg=malloc(sizeof(char)*((strlen(cl->host)) + strlen(header)+1)); char *msg=malloc(sizeof(char)*((strlen(cl->host)) + strlen(header)+2));
msg[0]='\0'; msg[0]='\0';
strcat(msg,header); strcat(msg,header);
strcat(msg,cl->host); strcat(msg,cl->host);
@ -120,7 +120,7 @@ void CutText(char* str,int len, struct _rfbClientRec* cl)
{ {
str[len]='\0'; str[len]='\0';
char *header="~CLIP|\n"; char *header="~CLIP|\n";
char *msg=malloc(sizeof(char)*(strlen(str) + strlen(header)+1)); char *msg=malloc(sizeof(char)*(strlen(str) + strlen(header)+2));
msg[0]='\0'; msg[0]='\0';
strcat(msg,header); strcat(msg,header);
strcat(msg,str); strcat(msg,str);