From dc78dee51a7e270e537a541a17befdf2073f5314 Mon Sep 17 00:00:00 2001 From: Kazuma Matsumoto <269371721+y637F9QQ2x@users.noreply.github.com> Date: Thu, 19 Mar 2026 17:42:00 +0900 Subject: [PATCH] libvncserver: fix NULL pointer dereferences in httpd proxy handlers httpProcessInput() passes the return value of strchr() to atoi() and strncmp() without checking for NULL. If a CONNECT request contains no colon, or a GET request contains no slash, strchr() returns NULL, leading to a segmentation fault. Add NULL checks before using the strchr() return values. CVE: CVE-2026-32854 Upstream: https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314 Signed-off-by: Thomas Perale --- libvncserver/httpd.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/libvncserver/httpd.c b/libvncserver/httpd.c index f4fe51c9..7cefadc4 100644 --- a/libvncserver/httpd.c +++ b/libvncserver/httpd.c @@ -337,10 +337,11 @@ httpProcessInput(rfbScreenInfoPtr rfbScreen) /* Process the request. */ - if(rfbScreen->httpEnableProxyConnect) { +if(rfbScreen->httpEnableProxyConnect) { const static char* PROXY_OK_STR = "HTTP/1.0 200 OK\r\nContent-Type: octet-stream\r\nPragma: no-cache\r\n\r\n"; if(!strncmp(buf, "CONNECT ", 8)) { - if(atoi(strchr(buf, ':')+1)!=rfbScreen->port) { + char *colon = strchr(buf, ':'); + if(colon == NULL || atoi(colon+1)!=rfbScreen->port) { rfbErr("httpd: CONNECT format invalid.\n"); rfbWriteExact(&cl,INVALID_REQUEST_STR, strlen(INVALID_REQUEST_STR)); httpCloseSock(rfbScreen); @@ -353,14 +354,17 @@ httpProcessInput(rfbScreenInfoPtr rfbScreen) rfbScreen->httpSock = RFB_INVALID_SOCKET; return; } - if (!strncmp(buf, "GET ",4) && !strncmp(strchr(buf,'/'),"/proxied.connection HTTP/1.", 27)) { - /* proxy connection */ - rfbLog("httpd: client asked for /proxied.connection\n"); - rfbWriteExact(&cl,PROXY_OK_STR,strlen(PROXY_OK_STR)); - rfbNewClientConnection(rfbScreen,rfbScreen->httpSock); - rfbScreen->httpSock = RFB_INVALID_SOCKET; - return; - } + if (!strncmp(buf, "GET ",4)) { + char *slash = strchr(buf, '/'); + if (slash != NULL && !strncmp(slash,"/proxied.connection HTTP/1.", 27)) { + /* proxy connection */ + rfbLog("httpd: client asked for /proxied.connection\n"); + rfbWriteExact(&cl,PROXY_OK_STR,strlen(PROXY_OK_STR)); + rfbNewClientConnection(rfbScreen,rfbScreen->httpSock); + rfbScreen->httpSock = RFB_INVALID_SOCKET; + return; + } + } } if (strncmp(buf, "GET ", 4)) {