- VNC: ZRLE and Tight inflation is capped at what the rectangle can
legitimately decode to; a ~64 KiB zlib bomb previously expanded to
gigabytes and the OOM killer took the whole app. Large scratch buffers
are released after use. Queued input and a local close are now handled
after every read, so a server that streams without pause can't starve
keystrokes or keep a closed tab's connection alive.
- Telnet: option replies are sent only when the option's state changes
(RFC 854), ending DONT/WONT ping-pong and 1:1 reply amplification; NAWS
doubles 0xFF so 255/511-column windows don't emit a bare IAC.
- Telnet/RAW: writes time out after 10 s and close() shuts the socket via
a second handle without waiting for the stream lock, so a peer that
stops reading can no longer wedge the UI thread or the tab's close.
- Local shells skip non-UTF-8 environment entries instead of panicking.
Andy Dixon
00f110f39b