|
 |
c45e68 |
diff --git a/libfreerdp-codec/nsc.c b/libfreerdp-codec/nsc.c
|
|
|
c45e68 |
index a39bdd33e..a86ea80f4 100644
|
|
|
c45e68 |
--- a/libfreerdp-codec/nsc.c
|
|
|
c45e68 |
+++ b/libfreerdp-codec/nsc.c
|
|
|
c45e68 |
@@ -217,6 +217,11 @@ void nsc_rle_decode(STREAM* in, STREAM* out, uint32 origsz)
|
|
|
c45e68 |
|
|
|
c45e68 |
if (i == 5)
|
|
|
c45e68 |
{
|
|
|
c45e68 |
+ if (stream_get_left(out) < 1)
|
|
|
c45e68 |
+ {
|
|
|
c45e68 |
+ printf("nsc_rle_decode failed");
|
|
|
c45e68 |
+ abort();
|
|
|
c45e68 |
+ }
|
|
|
c45e68 |
stream_write_uint8(out,value);
|
|
|
c45e68 |
i-=1;
|
|
|
c45e68 |
}
|
|
|
c45e68 |
@@ -228,6 +233,11 @@ void nsc_rle_decode(STREAM* in, STREAM* out, uint32 origsz)
|
|
|
c45e68 |
{
|
|
|
c45e68 |
uint8 len;
|
|
|
c45e68 |
stream_read_uint8(in, len);
|
|
|
c45e68 |
+ if (stream_get_left(out) < len+2)
|
|
|
c45e68 |
+ {
|
|
|
c45e68 |
+ printf("nsc_rle_decode failed");
|
|
|
c45e68 |
+ abort();
|
|
|
c45e68 |
+ }
|
|
|
c45e68 |
stream_set_byte(out, value, len+2);
|
|
|
c45e68 |
i -= (len+2);
|
|
|
c45e68 |
}
|
|
|
c45e68 |
@@ -236,17 +246,32 @@ void nsc_rle_decode(STREAM* in, STREAM* out, uint32 origsz)
|
|
|
c45e68 |
uint32 len;
|
|
|
c45e68 |
stream_seek(in, 1);
|
|
|
c45e68 |
stream_read_uint32(in, len);
|
|
|
c45e68 |
+ if (stream_get_left (out) < len)
|
|
|
c45e68 |
+ {
|
|
|
c45e68 |
+ printf("nsc_rle_decode failed");
|
|
|
c45e68 |
+ abort();
|
|
|
c45e68 |
+ }
|
|
|
c45e68 |
stream_set_byte(out, value, len);
|
|
|
c45e68 |
i -= len;
|
|
|
c45e68 |
}
|
|
|
c45e68 |
}
|
|
|
c45e68 |
else
|
|
|
c45e68 |
{
|
|
|
c45e68 |
+ if (stream_get_left(out) < 1)
|
|
|
c45e68 |
+ {
|
|
|
c45e68 |
+ printf("nsc_rle_decode failed");
|
|
|
c45e68 |
+ abort();
|
|
|
c45e68 |
+ }
|
|
|
c45e68 |
stream_write_uint8(out, value);
|
|
|
c45e68 |
i -= 1;
|
|
|
c45e68 |
}
|
|
|
c45e68 |
}
|
|
|
c45e68 |
|
|
|
c45e68 |
+ if (stream_get_left(out) < 4)
|
|
|
c45e68 |
+ {
|
|
|
c45e68 |
+ printf("nsc_rle_decode failed");
|
|
|
c45e68 |
+ abort();
|
|
|
c45e68 |
+ }
|
|
|
c45e68 |
stream_copy(out, in, 4);
|
|
|
c45e68 |
}
|
|
|
c45e68 |
|
|
|
c45e68 |
@@ -264,11 +289,25 @@ void nsc_rle_decompress_data(NSC_CONTEXT* context)
|
|
|
c45e68 |
origsize = context->OrgByteCount[i];
|
|
|
c45e68 |
|
|
|
c45e68 |
if (i == 3 && context->nsc_stream->PlaneByteCount[i] == 0)
|
|
|
c45e68 |
+ {
|
|
|
c45e68 |
+ if (stream_get_left(context->org_buf[i]) < origsize)
|
|
|
c45e68 |
+ {
|
|
|
c45e68 |
+ printf("nsc_rle_decompress_data failed");
|
|
|
c45e68 |
+ abort();
|
|
|
c45e68 |
+ }
|
|
|
c45e68 |
stream_set_byte(context->org_buf[i], 0xff, origsize);
|
|
|
c45e68 |
+ }
|
|
|
c45e68 |
else if (context->nsc_stream->PlaneByteCount[i] < origsize)
|
|
|
c45e68 |
nsc_rle_decode(rles, context->org_buf[i], origsize);
|
|
|
c45e68 |
else
|
|
|
c45e68 |
+ {
|
|
|
c45e68 |
+ if (stream_get_left(context->org_buf[i]) < origsize)
|
|
|
c45e68 |
+ {
|
|
|
c45e68 |
+ printf("nsc_rle_decompress_data failed");
|
|
|
c45e68 |
+ abort();
|
|
|
c45e68 |
+ }
|
|
|
c45e68 |
stream_copy(context->org_buf[i], rles, origsize);
|
|
|
c45e68 |
+ }
|
|
|
c45e68 |
|
|
|
c45e68 |
context->org_buf[i]->p = context->org_buf[i]->data;
|
|
|
c45e68 |
}
|
|
|
c45e68 |
|