CVE-2020-14402: Out-of-bounds Write (CWE-787)
value: An issue was discovered in LibVNCServer before 0.9.13. libvncserver/corre.c allows out-of-bounds access via encodings.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.4
Published: 2020-06-17T16:15Z
Repository: https://github.com/LibVNC/libvncserver
Language: C
Files changed: libvncserver/corre.c, libvncserver/hextile.c, libvncserver/rre.c
Commit date: 2020-05-28 08:40:09 +0200
Commit message: libvncserver: encodings: prevent OOB accesses

Diff: diff --git a/libvncserver/corre.c b/libvncserver/corre.c
index 8a845ea92..86ab99a60 100644
--- a/libvncserver/corre.c
+++ b/libvncserver/corre.c
@@ -231,11 +231,11 @@ subrectEncode##bpp(rfbClientPtr client, uint##bpp##_t *data, int w, int h) {
           hyflag = 1;                                                         \
           for (j=y; j<h; j++) {                                               \
             seg = data+(j*w);                                                 \
             if (seg[x] != cl) {break;}                                        \
             i = x;                                                            \
-            while ((seg[i] == cl) && (i < w)) i += 1;                         \
+            while ((i < w) && (seg[i] == cl)) i += 1;                         \
             i -= 1;                                                           \
             if (j == y) vx = hx = i;                                          \
             if (i < vx) vx = i;                                               \
             if ((hyflag > 0) && (i >= hx)) {hy += 1;} else {hyflag = 0;}      \
           }                                                                   \
diff --git a/libvncserver/hextile.c b/libvncserver/hextile.c
index 52920d888..6e1bf82e3 100644
--- a/libvncserver/hextile.c
+++ b/libvncserver/hextile.c
@@ -222,11 +222,11 @@ subrectEncode##bpp(rfbClientPtr cl, uint##bpp##_t *data, int w, int h,
                 hyflag = 1;                                                     \
                 for (j=y; j<h; j++) {                                           \
                     seg = data+(j*w);                                           \
                     if (seg[x] != cl2) {break;}                                 \
                     i = x;                                                      \
-                    while ((seg[i] == cl2) && (i < w)) i += 1;                  \
+                    while ((i < w) && (seg[i] == cl2)) i += 1;                  \
                     i -= 1;                                                     \
                     if (j == y) vx = hx = i;                                    \
                     if (i < vx) vx = i;                                         \
                     if ((hyflag > 0) && (i >= hx)) {                            \
                         hy += 1;                                                \
diff --git a/libvncserver/rre.c b/libvncserver/rre.c
index 2103153ce..4a65682fe 100644
--- a/libvncserver/rre.c
+++ b/libvncserver/rre.c
@@ -198,11 +198,11 @@ static int                                                                    \
           hyflag = 1;                                                         \
           for (j=y; j<h; j++) {                                               \
             seg = data+(j*w);                                                 \
             if (seg[x] != cl) {break;}                                        \
             i = x;                                                            \
-            while ((seg[i] == cl) && (i < w)) i += 1;                         \
+            while ((i < w) && (seg[i] == cl)) i += 1;                         \
             i -= 1;                                                           \
             if (j == y) vx = hx = i;                                          \
             if (i < vx) vx = i;                                               \
             if ((hyflag > 0) && (i >= hx)) {hy += 1;} else {hyflag = 0;}      \
           }                                                                   \

Vulnerable code:             while ((seg[i] == cl) && (i < w)) i += 1;                         \
                    while ((seg[i] == cl2) && (i < w)) i += 1;                  \
            while ((seg[i] == cl) && (i < w)) i += 1;                         \
Fixed code:             while ((i < w) && (seg[i] == cl)) i += 1;                         \
                    while ((i < w) && (seg[i] == cl2)) i += 1;                  \
            while ((i < w) && (seg[i] == cl)) i += 1;                         \