qvnc: Arbitrary memory read vulnerability

qtbase/src/plugins/platforms/vnc/qvncclient.cpp:
QVncClient::frameBufferUpdateRequest() does no boundary checks on client provided rectangle size.

qtbase/src/plugins/platforms/vnc/qvnc.cpp:

void QRfbRawEncoder::write()
{
    // ...
        const uchar *screendata = screenImage.scanLine(rect.y)
                                  + rect.x * screenImage.depth() / 8;

The unchecked rectangle size is used to calculate a memory offset. Whatever is at that location is encoded into pixels and sent to the client.