CVE-2018-7226

An attacker can send a specially crafted VNC packet to the vulnerable server. This packet contains a message length that, when processed by `vcSetXCutTextProc()`, causes an integer overflow. The overflow can lead to a `malloc(0)` call followed by a `memcpy` with a negative length, resulting in writing beyond allocated memory.

The vulnerability lies within the `vcSetXCutTextProc()` function located in `VNConsole.c` within the LibVNC/vncterm distribution. The implementation uses `int` for the length parameter and performs a `malloc(len+1)` operation without adequate checks, which can lead to integer overflows and subsequent memory corruption.

The patch, as described in the reference write-ups, addresses the integer overflow by ensuring proper sanitization of the length parameter before it is used in memory allocation and copying operations. Specifically, it prevents `len+1` from overflowing and ensures that `malloc` is checked for null returns before `memcpy` is called, mitigating the risk of buffer overflows and null pointer dereferences.