libvncclient: handle negative payload sizes for ultra encoding

Spotted by Lukas Kupczyk, thanks!

Author: bk138

libvncclient/ultra.c

@@ -45,6 +45,11 @@ HandleUltraBPP (rfbClient* client, int rx, int ry, int rw, int rh)
   toRead = rfbClientSwap32IfLE(hdr.nBytes);
   if (toRead==0) return TRUE;
 
+  if (toRead < 0) {
+      rfbClientErr("ultra error: remote sent negative payload size\n");
+      return FALSE;
+  }
+
   if (uncompressedBytes==0)
   {
       rfbClientLog("ultra error: rectangle has 0 uncomressed bytes ((%dw * %dh) * (%d / 8))\n", rw, rh, BPP); 
@@ -131,6 +136,11 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh)
 
   if (toRead==0) return TRUE;
 
+  if (toRead < 0) {
+      rfbClientErr("ultrazip error: remote sent negative payload size\n");
+      return FALSE;
+  }
+
   if (uncompressedBytes==0)
   {
       rfbClientLog("ultrazip error: rectangle has 0 uncomressed bytes (%dy + (%dw * 65535)) (%d rectangles)\n", ry, rw, rx);