Enforce Tight PNG restrictions

Tight PNG rects cannot use the basic compression variants, and PNG
cannot be used in a standard Tight rect.

This is a partial revert of 3e8b26a based on better understanding
of the encoding.

diff --git a/core/rfb.js b/core/rfb.js
index 54f0a04ee95b35d4826202db5acd1c7002811b9d..81e1e6adf974ddb833cfcabe9cbea8e4500ad1d5 100644 (file)
--- a/core/rfb.js
+++ b/core/rfb.js
@@ -169,8 +169,8 @@ export default function RFB(target, url, options) {
     this._encHandlers[encodings.encodingCopyRect] = RFB.encodingHandlers.COPYRECT.bind(this);
     this._encHandlers[encodings.encodingRRE] = RFB.encodingHandlers.RRE.bind(this);
     this._encHandlers[encodings.encodingHextile] = RFB.encodingHandlers.HEXTILE.bind(this);
-    this._encHandlers[encodings.encodingTight] = RFB.encodingHandlers.TIGHT.bind(this);
-    this._encHandlers[encodings.encodingTightPNG] = RFB.encodingHandlers.TIGHT.bind(this);
+    this._encHandlers[encodings.encodingTight] = RFB.encodingHandlers.TIGHT.bind(this, false);
+    this._encHandlers[encodings.encodingTightPNG] = RFB.encodingHandlers.TIGHT.bind(this, true);
 
     this._encHandlers[encodings.pseudoEncodingDesktopSize] = RFB.encodingHandlers.DesktopSize.bind(this);
     this._encHandlers[encodings.pseudoEncodingLastRect] = RFB.encodingHandlers.last_rect.bind(this);
@@ -2111,7 +2111,7 @@ RFB.encodingHandlers = {
         return true;
     },
 
-    TIGHT: function () {
+    TIGHT: function (isTightPNG) {
         this._FBU.bytes = 1;  // compression-control byte
         if (this._sock.rQwait("TIGHT compression-control", this._FBU.bytes)) { return false; }
 
@@ -2342,6 +2342,13 @@ RFB.encodingHandlers = {
         else return this._fail("Illegal tight compression received (ctl: " +
                                ctl + ")");
 
+        if (isTightPNG && (ctl < 0x08)) {
+            return this._fail("BasicCompression received in TightPNG rect");
+        }
+        if (!isTightPNG && (ctl === 0x0A)) {
+            return this._fail("PNG received in standard Tight rect");
+        }
+
         switch (cmode) {
             // fill use depth because TPIXELs drop the padding byte
             case "fill":  // TPIXEL