From c18152cb3a8ac8f46945b50b783d95dbef054610 Mon Sep 17 00:00:00 2001
From: Eirik Aavitsland <eirik.aavitsland@qt.io>
Date: Thu, 29 Apr 2021 13:46:15 +0200
Subject: QVnc: clip requested screen region to available screen image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid potential oob memory access.

Fixes: QTBUG-91770
Change-Id: I34fff1cf8dec5275572a027288b0e8310359d9f8
Reviewed-by: Tor Arne Vestbø <tor.arne.vestbo@qt.io>
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
(cherry picked from commit c494c1e8754ed13b409133196d9db00bf7e0f2b5)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
(cherry picked from commit 29b06697843851cd577cef7d69c428195cf08f4b)
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
---
 src/plugins/platforms/vnc/qvnc.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/plugins/platforms/vnc/qvnc.cpp b/src/plugins/platforms/vnc/qvnc.cpp
index ffe00de2b1..43fbc9daf7 100644
--- a/src/plugins/platforms/vnc/qvnc.cpp
+++ b/src/plugins/platforms/vnc/qvnc.cpp
@@ -477,6 +477,9 @@ void QRfbRawEncoder::write()
 //                     server->screen()->geometry().height());
 //    }
 
+    const QImage screenImage = client->server()->screenImage();
+    rgn &= screenImage.rect();
+
     const auto rectsInRegion = rgn.rectCount();
 
     {
@@ -492,8 +495,6 @@ void QRfbRawEncoder::write()
     if (rectsInRegion <= 0)
         return;
 
-    const QImage screenImage = client->server()->screenImage();
-
     for (const QRect &tileRect: rgn) {
         const QRfbRect rect(tileRect.x(), tileRect.y(),
                             tileRect.width(), tileRect.height());
-- 
cgit v1.2.3