qvnc: Denial of Service due to unchecked allocation

void QVncClient::clientCutText()
{
    // ...
    // implicit uint32 to int32 conversion
    m_cutTextPending = ev.length;
    // ...
    // If the client sets ev.length to UINT_MAX - 1 then this condition is always true because m_cutTextPending == -2
    if (m_cutTextPending && m_clientSocket->bytesAvailable() >= m_cutTextPending) {
        // negative allocation
        char *text = new char [m_cutTextPending+1];
        // ...
    }