|
 |
1069f6 |
From babbd1e433d273634637f5199429986714864033 Mon Sep 17 00:00:00 2001
|
|
|
1069f6 |
From: akallabeth <akallabeth@posteo.net>
|
|
|
1069f6 |
Date: Thu, 13 Oct 2022 09:09:28 +0200
|
|
|
1069f6 |
Subject: [PATCH] Added missing length checks in zgfx_decompress_segment
|
|
|
1069f6 |
|
|
|
1069f6 |
(cherry picked from commit 64716b335858109d14f27b51acc4c4d71a92a816)
|
|
|
1069f6 |
---
|
|
|
1069f6 |
libfreerdp/codec/zgfx.c | 11 +++++++----
|
|
|
1069f6 |
1 file changed, 7 insertions(+), 4 deletions(-)
|
|
|
1069f6 |
|
|
|
1069f6 |
diff --git a/libfreerdp/codec/zgfx.c b/libfreerdp/codec/zgfx.c
|
|
|
1069f6 |
index 1a2878bd9..04ddeadb2 100644
|
|
|
1069f6 |
--- a/libfreerdp/codec/zgfx.c
|
|
|
1069f6 |
+++ b/libfreerdp/codec/zgfx.c
|
|
|
1069f6 |
@@ -230,19 +230,19 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t
|
|
|
1069f6 |
BYTE* pbSegment;
|
|
|
1069f6 |
size_t cbSegment;
|
|
|
1069f6 |
|
|
|
1069f6 |
- if (!zgfx || !stream)
|
|
|
1069f6 |
+ if (!zgfx || !stream || (segmentSize < 2))
|
|
|
1069f6 |
return FALSE;
|
|
|
1069f6 |
|
|
|
1069f6 |
cbSegment = segmentSize - 1;
|
|
|
1069f6 |
|
|
|
1069f6 |
- if ((Stream_GetRemainingLength(stream) < segmentSize) || (segmentSize < 1) ||
|
|
|
1069f6 |
- (segmentSize > UINT32_MAX))
|
|
|
1069f6 |
+ if ((Stream_GetRemainingLength(stream) < segmentSize) || (segmentSize > UINT32_MAX))
|
|
|
1069f6 |
return FALSE;
|
|
|
1069f6 |
|
|
|
1069f6 |
Stream_Read_UINT8(stream, flags); /* header (1 byte) */
|
|
|
1069f6 |
zgfx->OutputCount = 0;
|
|
|
1069f6 |
pbSegment = Stream_Pointer(stream);
|
|
|
1069f6 |
- Stream_Seek(stream, cbSegment);
|
|
|
1069f6 |
+ if (!Stream_SafeSeek(stream, cbSegment))
|
|
|
1069f6 |
+ return FALSE;
|
|
|
1069f6 |
|
|
|
1069f6 |
if (!(flags & PACKET_COMPRESSED))
|
|
|
1069f6 |
{
|
|
|
1069f6 |
@@ -346,6 +346,9 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t
|
|
|
1069f6 |
if (count > sizeof(zgfx->OutputBuffer) - zgfx->OutputCount)
|
|
|
1069f6 |
return FALSE;
|
|
|
1069f6 |
|
|
|
1069f6 |
+ if (count > zgfx->cBitsRemaining / 8)
|
|
|
1069f6 |
+ return FALSE;
|
|
|
1069f6 |
+
|
|
|
1069f6 |
CopyMemory(&(zgfx->OutputBuffer[zgfx->OutputCount]), zgfx->pbInputCurrent,
|
|
|
1069f6 |
count);
|
|
|
1069f6 |
zgfx_history_buffer_ring_write(zgfx, zgfx->pbInputCurrent, count);
|
|
|
1069f6 |
--
|
|
|
1069f6 |
2.37.1
|
|
|
1069f6 |
|