Swatantra-66 opened a new pull request, #3949: URL: https://github.com/apache/nuttx-apps/pull/3949
## Summary Fixes #3942 by bounding stack usage when reading security types during the RFB handshake. During the RFB 3.7+ security handshake, `rfb_negotiate_security()` received the 1-byte server-supplied count `num_types` (1..255) and called `rfb_recv_exact(sockfd, types, num_types)` into a fixed 16-byte stack buffer `types[16]`. A malicious or malfunctioning server could send up to 255 bytes, causing an unauthenticated 239-byte stack buffer overflow. This fix: 1. Receives and scans the security types in bounded chunks of up to `sizeof(types)` (16 bytes) at a time, preventing stack buffer overflow regardless of `num_types`. 2. Inspects all server-offered security types across all chunks so supported types placed after the 16th entry are not dropped. 3. Preserves preference order (`None` > `VNC Auth`). 4. If `None` is selected, drains any remaining types via `rfb_discard_exact(sockfd, remaining)` to keep the RFB stream synchronized. ## Impact * Security: Fixes a pre-authentication stack buffer overflow vulnerability in `vncviewer`. * Compatibility: Fully compatible with RFC 6143 / RFB 3.7+ specifications. * User: No user-facing API or configuration changes. ## Testing * Host: Linux / x86_64 * Style: Verified with `nuttx/tools/checkpatch.sh` (0 warnings, 0 errors). * Logic Verification: Tested chunking boundaries and stream drainage logic when `num_types` is smaller than, equal to, and larger than `sizeof(types)`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
