LibVNC/libvncserver — pull request #27 by newsoft (2014-09-01 12:43:22+00:00)
Title: Fix multiple stack-based buffer overflows in file transfer feature

Filename buffer is MAX_PATH in length, whereas filename size is 32-bit encoded by RFB protocol. This will lead to a stack-based buffer overflow on server-side in response to various messages (get directory content, file rename, etc.).

The fix is implemented at rfbFilenameTranslate2UNIX() level since all file transfer messages seem to go through that API.

Notes:
- rfbFilenameTranslate2DOS() is never called, and therefore has not been fixed.
- File transfer feature is UltraVNC-specific and not enabled by default.