This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx-apps.git
The following commit(s) were added to refs/heads/master by this push:
new 5226be524 system/vncviewer: Drain truncated desktop names
5226be524 is described below
commit 5226be524c6fcfab97f0c2c65ac3a1b4fee3a7c5
Author: Old-Ding <[email protected]>
AuthorDate: Mon Jul 6 03:51:57 2026 +0800
system/vncviewer: Drain truncated desktop names
The RFB ServerInit message carries the desktop name as a length-prefixed
field. vncviewer caps the copied name to fit conn->name, but it must still
consume the remaining bytes from the socket when the advertised name is longer
than the local buffer.
Drain the unused suffix so the next RFB message is read from the correct
boundary. Reuse the same discard helper for other skipped RFB payloads.
Signed-off-by: Old-Ding <[email protected]>
---
system/vncviewer/rfb_protocol.c | 81 ++++++++++++++++++++++++++---------------
1 file changed, 52 insertions(+), 29 deletions(-)
diff --git a/system/vncviewer/rfb_protocol.c b/system/vncviewer/rfb_protocol.c
index ef324af83..e2d384b49 100644
--- a/system/vncviewer/rfb_protocol.c
+++ b/system/vncviewer/rfb_protocol.c
@@ -410,6 +410,36 @@ static int rfb_recv_exact(int sockfd, void *buf, size_t
len)
return OK;
}
+/****************************************************************************
+ * Name: rfb_discard_exact
+ *
+ * Description:
+ * Receive and discard exactly 'len' bytes from socket.
+ *
+ ****************************************************************************/
+
+static int rfb_discard_exact(int sockfd, size_t len)
+{
+ uint8_t buf[256];
+ size_t chunk;
+ int ret;
+
+ while (len > 0)
+ {
+ chunk = len > sizeof(buf) ? sizeof(buf) : len;
+
+ ret = rfb_recv_exact(sockfd, buf, chunk);
+ if (ret < 0)
+ {
+ return ret;
+ }
+
+ len -= chunk;
+ }
+
+ return OK;
+}
+
/****************************************************************************
* Name: rfb_send_exact
*
@@ -621,6 +651,7 @@ static int rfb_client_init(int sockfd, struct rfb_conn_s
*conn)
uint8_t shared = 1; /* shared session */
uint8_t buf[24];
uint32_t name_len;
+ uint32_t copy_len;
int ret;
/* Send ClientInit */
@@ -645,21 +676,31 @@ static int rfb_client_init(int sockfd, struct rfb_conn_s
*conn)
/* bytes 4..19 = server pixel format (we'll override it) */
name_len = ntohl(*(uint32_t *)&buf[20]);
- if (name_len > sizeof(conn->name) - 1)
+ copy_len = name_len;
+ if (copy_len > sizeof(conn->name) - 1)
{
- name_len = sizeof(conn->name) - 1;
+ copy_len = sizeof(conn->name) - 1;
}
- if (name_len > 0)
+ if (copy_len > 0)
{
- ret = rfb_recv_exact(sockfd, conn->name, name_len);
+ ret = rfb_recv_exact(sockfd, conn->name, copy_len);
if (ret < 0)
{
return ret;
}
}
- conn->name[name_len] = '\0';
+ conn->name[copy_len] = '\0';
+
+ if (name_len > copy_len)
+ {
+ ret = rfb_discard_exact(sockfd, name_len - copy_len);
+ if (ret < 0)
+ {
+ return ret;
+ }
+ }
printf("vncviewer: server desktop: \"%s\" %ux%u\n",
conn->name, conn->fb_width, conn->fb_height);
@@ -987,19 +1028,10 @@ int rfb_recv_update(struct rfb_conn_s *conn,
rfb_rect_cb_t rect_cb,
/* Skip color entries: num_colors * 6 bytes (R+G+B each 2B) */
- uint32_t skip = num_colors * 6;
- uint8_t tmp[256];
-
- while (skip > 0)
+ ret = rfb_discard_exact(conn->sockfd, (uint32_t)num_colors * 6);
+ if (ret < 0)
{
- uint32_t chunk = skip > sizeof(tmp) ? sizeof(tmp) : skip;
- ret = rfb_recv_exact(conn->sockfd, tmp, chunk);
- if (ret < 0)
- {
- return ret;
- }
-
- skip -= chunk;
+ return ret;
}
}
break;
@@ -1025,19 +1057,10 @@ int rfb_recv_update(struct rfb_conn_s *conn,
rfb_rect_cb_t rect_cb,
/* Skip text content */
- uint8_t tmp[256];
-
- while (text_len > 0)
+ ret = rfb_discard_exact(conn->sockfd, text_len);
+ if (ret < 0)
{
- uint32_t chunk = text_len > sizeof(tmp)
- ? sizeof(tmp) : text_len;
- ret = rfb_recv_exact(conn->sockfd, tmp, chunk);
- if (ret < 0)
- {
- return ret;
- }
-
- text_len -= chunk;
+ return ret;
}
}
break;
