Files
zoneminder/src
SteveGilvarry 45099e53a7 fix: address review feedback on camera buffer overflow fix
- zm_libvnc_camera.cpp resize(): return FALSE and log if av_malloc fails,
  rather than returning TRUE with a null frameBuffer (libVNC would then
  write into it and crash). Matters more now that size_t sizing can
  request large allocations for server-advertised dimensions.
- zm_libvnc_camera.cpp: compute the buffer sizes in the scale Debug() in
  size_t with %zu, so the logged sizes can't overflow int and match the
  values passed to SWScale::Convert.
- zm_libvlc_camera: widen LibvlcPrivateData::bufferSize to size_t and
  compute it in size_t in PrimeCapture, so the allocation itself can't
  overflow. Image::Assign now passes the same stored bufferSize used for
  the allocation, so the read size can't exceed the buffer. Widen the
  compare loop index to size_t to match.

Verified: both translation units compile with -Werror -fsyntax-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-18 07:54:15 +10:00
..