TightVNC 2.8.87

.Server for Windows: Fixed operation in application mode for environments with multiple simultaneous RDP sessions (bug #1647).
.Server for Windows: Increased maximum screen size (width or height) from 32,000 to 65,535 pixels.
.Server and Viewer for Windows: Fixed bugs in buffer size calculation when receiving and converting clipboard data.
.Installer for Windows: The uninstaller now correctly removes the TightVNC Service Control Application.

Author: chenall

desktop-ipc/DesktopServerProto.cpp

@@ -53,10 +53,10 @@ void DesktopServerProto::checkPixelFormat(const PixelFormat *pf)
 void DesktopServerProto::checkRectangle(const Rect *rect)
 {
   StringStorage errMess;
-  if (abs(rect->left)   > 32000 ||
-      abs(rect->top)    > 32000 ||
-      abs(rect->right)  > 32000 ||
-      abs(rect->bottom) > 32000 ||
+  if (abs(rect->left)   > 65535 ||
+      abs(rect->top)    > 65535 ||
+      abs(rect->right)  > 65535 ||
+      abs(rect->bottom) > 65535 ||
       !rect->isValid()) {
     errMess.format(_T("Wrong rectangle (%d, %d, %d, %d)"), rect->left,
                                                            rect->top,
@@ -69,8 +69,8 @@ void DesktopServerProto::checkRectangle(const Rect *rect)
 void DesktopServerProto::checkDimension(const Dimension *dim)
 {
   StringStorage errMess;
-  if (abs(dim->width)  > 64000 ||
-      abs(dim->height) > 64000) {
+  if (abs(dim->width)  > 65535 ||
+      abs(dim->height) > 65535) {
     errMess.format(_T("Wrong dimension (%dx%d)"), dim->width,
                                                   dim->height);
     throw Exception(errMess.getString());

desktop/WindowsClipboard.cpp

@@ -24,6 +24,8 @@
 
 #include "WindowsClipboard.h"
 #include "tvnserver-app/NamingDefs.h"
+#include "util/Exception.h"
+#include <vector>
 
 const HINSTANCE WindowsClipboard::m_hinst = GetModuleHandle(0);
 
@@ -179,7 +181,10 @@ void WindowsClipboard::convertToRfbFormat(const StringStorage *source,
 {
   const TCHAR *srcText = source->getString();
   size_t length = source->getLength();
-  TCHAR *rfbText = new TCHAR[length + 1];
+  if (length > SIZE_MAX - 1) {
+    throw Exception(_T("Integer overflow in clipboard allocation"));
+  }
+  std::vector<TCHAR> rfbText(length + 1);
 
   size_t j = 0;
   for (size_t i = 0; i < length; i++) {
@@ -189,8 +194,7 @@ void WindowsClipboard::convertToRfbFormat(const StringStorage *source,
     }
   }
   rfbText[j] = 0;
-  dest->setString(rfbText);
-  delete[] rfbText;
+  dest->setString(&rfbText.front());
 }
 
 void WindowsClipboard::convertFromRfbFormat(const TCHAR *source,
@@ -204,10 +208,15 @@ void WindowsClipboard::convertFromRfbFormat(const TCHAR *source,
       lfCount++;
     }
   }
-
+  if (lfCount > SIZE_MAX - sourceLen) {
+    throw Exception(_T("Integer overflow in size calculation"));
+  }
   size_t destLen = sourceLen + lfCount;
-  TCHAR *destText = new TCHAR[destLen + 1];
-  int j = 0;
+  if (destLen > SIZE_MAX - 1) {
+    throw Exception(_T("Integer overflow in clipboard allocation"));
+  }
+  std::vector<TCHAR> destText(destLen + 1);
+  size_t j = 0;
   for (size_t i = 0; i < sourceLen; i++) {
     if (source[i] == 0x0a) {
       destText[j] = 0x0d;
@@ -218,6 +227,5 @@ void WindowsClipboard::convertFromRfbFormat(const TCHAR *source,
   }
   destText[j] = 0;
 
-  dest->setString(destText);
-  delete[] destText;
+  dest->setString(&destText.front());
 }

hookldr/hookldr.rc

@@ -83,7 +83,11 @@ void ClipboardExchange::onRequest(UINT32 reqCode, RfbInputGate *input)
 }
 void ClipboardExchange::onRequestWorker(bool utf8flag, RfbInputGate *input)
 {
-  UINT32 length = input->readUInt32();
+  size_t length = input->readUInt32();
+
+  if (length > SIZE_MAX - 1) {
+    throw Exception(_T("Integer overflow in clipboard allocation"));
+  }
 
   std::vector<char> charBuff(length + 1);
 

rfb-sconn/ClipboardExchange.cpp

@@ -35,8 +35,12 @@ void ControlPipeName::createPipeName(bool forService, StringStorage *pipeName, L
     pipeName->setString(
       ServerApplicationNames::FOR_SERVICE_CONTROL_APP_PIPE_NAME);
   } else {
-    pipeName->format(_T("%s_On_Session_%d"),
-      ServerApplicationNames::FOR_APP_CONTROL_APP_SERVICE_PIPE_NAME,
-      WTS::getActiveConsoleSessionId(log));
+	try {
+	  pipeName->format(_T("%s_On_Session_%d"),
+        ServerApplicationNames::FOR_APP_CONTROL_APP_SERVICE_PIPE_NAME,
+        WTS::getProcessSessionId(log));
+	} catch (Exception &e) {
+      log->error(_T("getProcessSessionId failed: %s"), e.getMessage());
+    }
   }
 }

screen-hooks/screenhooks.rc

@@ -33,8 +33,6 @@ const TCHAR ProductNames::SERVER_PRODUCT_NAME[] = _T("TightVNC Server");
 const TCHAR RegistryPaths::SERVER_PATH[] = _T("Software\\TightVNC\\Server");
 const TCHAR RegistryPaths::SERVER_REVERSE_CONN_HISTORY_PATH[] =
   _T("Software\\TightVNC\\Control\\ReverseConnectionHistory");
-const TCHAR RegistryPaths::DISPATCHER_CONN_HISTORY_PATH[] =
-  _T("Software\\TightVNC\\Control\\DispatcherConnectionHistory");
 
 const TCHAR WindowNames::WINDOW_CLASS_NAME[] =
   _T("TvnWindowsApplicationClass");

setup-helper/setup-helper.rc

@@ -46,7 +46,6 @@ class RegistryPaths
 public:
   static const TCHAR SERVER_PATH[];
   static const TCHAR SERVER_REVERSE_CONN_HISTORY_PATH[];
-  static const TCHAR DISPATCHER_CONN_HISTORY_PATH[];
 };
 
 class WindowNames