From a64b788f24d8f5c133b75cee2f920b1258e3fb09 Mon Sep 17 00:00:00 2001
From: matt335672 <30179339+matt335672@users.noreply.github.com>
Date: Wed, 15 Apr 2026 10:50:10 +0100
Subject: [PATCH] CVE-2026-41252: lib_palette_update Heap Buffer Overflow

(cherry picked from commit 9834a58ca65018d09b04ed7550dfa71aecb09b10)
---
 vnc/vnc.c | 7 +++++++
 vnc/vnc.h | 4 +++-
 2 files changed, 10 insertions(+), 1 deletion(-)

--- a/vnc/vnc.c
+++ b/vnc/vnc.c
@@ -1484,6 +1484,13 @@ lib_palette_update(struct vnc *v)
         in_uint8s(s, 1);
         in_uint16_be(s, first_color);
         in_uint16_be(s, num_colors);
+        if ((first_color + num_colors) > VNC_PALETTE_SIZE)
+        {
+            LOG(LOG_LEVEL_ERROR, "lib_palette_update: palette overflow");
+            free_stream(s);
+            return 1;
+        }
+
         init_stream(s, 8192);
         error = trans_force_read_s(v->trans, s, num_colors * 6);
     }
--- a/vnc/vnc.h
+++ b/vnc/vnc.h
@@ -65,6 +65,8 @@ struct source_info;
 /* Defined in vnc_clip.c */
 struct vnc_clipboard_data;
 
+#define VNC_PALETTE_SIZE 256
+
 struct vnc
 {
     int size; /* size of this struct */
@@ -147,7 +149,7 @@ struct vnc
     int server_bpp;
     char mod_name[256];
     int mod_mouse_state;
-    int palette[256];
+    int palette[VNC_PALETTE_SIZE];
     int vnc_desktop;
     char username[256];
     char password[256];