Details
-
Bug
-
Resolution: Done
-
P1: Critical
-
4.5.1, 4.5.2, 4.5.3, 4.6.1, 4.6.2
-
None
-
-embedded x86
-qt-gfx-vnc -qt-gfx-multiscreen
-
57fcc060fdce0874309ec94bb7ab77b44554e91b
Description
In the function QVNCServer::convertPixels() (src/plugins/gfxdrivers/vnc/qscreenvnc_qws.cp around line 1450) in certain situation byte counter used as index for writing into last element of quint32 array (dereferences dst32 pointer)
quint32 *dst32 = reinterpret_cast<quint32*>(dst); int count32 = count * sizeof(quint16) / sizeof(quint32); while (count32--) { ... *dst32++ = result2; *dst32++ = result1; } if (count & 0x1) { ... dst32[count - 1] = qt_conv16ToRgb(src16[count - 1]); }
write to dst32[count - 1] will cause memory corruption outside of intended buffer.
To fix the issue we replaced last assignment with:
*dst32 = qt_conv16ToRgb(src16[count - 1]);