LibVNC/libvncserver — pull request #21 by newsoft (2014-08-26 10:09:47+00:00)
Title: Fixing two more security issues (remote server crash)

Those 2 commits fix the following issues:

1/ ClientCutText message allows up to 2**32-1 bytes of text to be transferred. malloc() of such a large value is likely to fail on server-side, resulting in a server crash (NULL pointer dereference) if malloc() return value is not checked.

Note: this issue affects other VNC implementations
http://cross-site-scripting.blogspot.ch/2010/05/realvnc-vnc-server-free-edition-413.html

2/ SetScale message allows to setup a scale ratio of zero, which will obviously result in a "divide by zero" issue and server crash.