Merge branch 'bugifx/VNC-361-xvnc-segfault-in-rfb-utf-8-to-latin-1-triggers-window-manager-crash-on-kasm-vnc-container' into 'master'

VNC-361 Handle null clipboard data in vncSelection

Closes VNC-361

See merge request kasm-technologies/internal/KasmVNC!239
This commit is contained in:
Matthew McClaskey 2026-05-07 19:02:28 +00:00
commit 002f3d8fa5
4 changed files with 13 additions and 6 deletions

View file

@ -49,9 +49,8 @@ RUN zypper install -ny \
zlib-devel \
libva-devel
RUN useradd -u 1000 docker && \
groupadd -g 1000 docker && \
usermod -a -G docker docker
RUN groupadd -g 1000 docker && \
useradd -u 1000 -g docker docker
RUN ARCH=$(arch) && \
CMAKE_URL="https://cmake.org/files/v3.22/cmake-3.22.0" && \

View file

@ -20,8 +20,7 @@ COPY opensuse/kasmvncserver.spec /tmp
RUN zypper -n install $(grep BuildRequires /tmp/*.spec | cut -d' ' -f2 | xargs)
RUN useradd -u 1000 -m -d /home/docker docker && \
groupadd -g 1000 docker && \
usermod -a -G docker docker
RUN groupadd -g 1000 docker && \
useradd -u 1000 -g docker docker
USER docker

View file

@ -593,6 +593,9 @@ void VNCServerST::sendBinaryClipboardData(const char* mime, const unsigned char
void VNCServerST::getBinaryClipboardData(const char* mime, const unsigned char **data,
unsigned *len)
{
*data = nullptr;
*len = 0;
if (!clipboardClient)
return;
clipboardClient->getBinaryClipboardData(mime, data, len);

View file

@ -417,6 +417,9 @@ static int vncConvertSelection(ClientPtr client, Atom selection,
const unsigned char *data;
unsigned len;
vncGetBinaryClipboardData(dlp_get_mimetype(binatomidx), &data, &len);
if (data == NULL)
return BadMatch;
rc = dixChangeWindowProperty(serverClient, pWin, realProperty,
xaBinclips[binatomidx], 8, PropModeReplace,
len, (unsigned char *) data, TRUE);
@ -427,6 +430,9 @@ static int vncConvertSelection(ClientPtr client, Atom selection,
unsigned len;
vncGetBinaryClipboardData("text/plain", &data, &len);
if (data == NULL)
return BadMatch;
if ((target == xaSTRING) || (target == xaTEXT)) {
char* latin1;
latin1 = vncUTF8ToLatin1(data, (size_t)-1);