|
 |
b460d2 |
From bda8e5ebfb772c0de3832d77b49749538c61eb14 Mon Sep 17 00:00:00 2001
|
|
|
b460d2 |
From: akallabeth <akallabeth@posteo.net>
|
|
|
b460d2 |
Date: Mon, 30 Mar 2020 17:32:04 +0200
|
|
|
b460d2 |
Subject: [PATCH] Fix CVE-2020-11523: clamp invalid rectangles to size 0
|
|
|
b460d2 |
|
|
|
b460d2 |
Thanks to Sunglin and HuanGMz from Knownsec 404
|
|
|
b460d2 |
---
|
|
|
b460d2 |
libfreerdp/gdi/region.c | 36 ++++++++++++++++++++++++++++++++++--
|
|
|
b460d2 |
1 file changed, 34 insertions(+), 2 deletions(-)
|
|
|
b460d2 |
|
|
|
b460d2 |
diff --git a/libfreerdp/gdi/region.c b/libfreerdp/gdi/region.c
|
|
|
b460d2 |
index d3b28b562..1ffbf79bf 100644
|
|
|
b460d2 |
--- a/libfreerdp/gdi/region.c
|
|
|
b460d2 |
+++ b/libfreerdp/gdi/region.c
|
|
|
b460d2 |
@@ -37,6 +37,19 @@
|
|
|
b460d2 |
|
|
|
b460d2 |
#define TAG FREERDP_TAG("gdi.region")
|
|
|
b460d2 |
|
|
|
b460d2 |
+static char* gdi_rect_str(char* buffer, size_t size, const HGDI_RECT rect)
|
|
|
b460d2 |
+{
|
|
|
b460d2 |
+ if (!buffer || (size < 1) || !rect)
|
|
|
b460d2 |
+ return NULL;
|
|
|
b460d2 |
+
|
|
|
b460d2 |
+ _snprintf(buffer, size - 1,
|
|
|
b460d2 |
+ "[top/left=%" PRId32 "x%" PRId32 "-bottom/right%" PRId32 "x%" PRId32 "]", rect->top,
|
|
|
b460d2 |
+ rect->left, rect->bottom, rect->right);
|
|
|
b460d2 |
+ buffer[size - 1] = '\0';
|
|
|
b460d2 |
+
|
|
|
b460d2 |
+ return buffer;
|
|
|
b460d2 |
+}
|
|
|
b460d2 |
+
|
|
|
b460d2 |
/**
|
|
|
b460d2 |
* Create a region from rectangular coordinates.\n
|
|
|
b460d2 |
* @msdn{dd183514}
|
|
|
b460d2 |
@@ -134,10 +147,29 @@ INLINE void gdi_RectToCRgn(const HGDI_RECT rect,
|
|
|
b460d2 |
INT32* x, INT32* y,
|
|
|
b460d2 |
INT32* w, INT32* h)
|
|
|
b460d2 |
{
|
|
|
b460d2 |
+ INT64 tmp;
|
|
|
b460d2 |
*x = rect->left;
|
|
|
b460d2 |
*y = rect->top;
|
|
|
b460d2 |
- *w = rect->right - rect->left + 1;
|
|
|
b460d2 |
- *h = rect->bottom - rect->top + 1;
|
|
|
b460d2 |
+ tmp = rect->right - rect->left + 1;
|
|
|
b460d2 |
+ if ((tmp < 0) || (tmp > INT32_MAX))
|
|
|
b460d2 |
+ {
|
|
|
b460d2 |
+ char buffer[256];
|
|
|
b460d2 |
+ WLog_ERR(TAG, "[%s] rectangle invalid %s", __FUNCTION__,
|
|
|
b460d2 |
+ gdi_rect_str(buffer, sizeof(buffer), rect));
|
|
|
b460d2 |
+ *w = 0;
|
|
|
b460d2 |
+ }
|
|
|
b460d2 |
+ else
|
|
|
b460d2 |
+ *w = tmp;
|
|
|
b460d2 |
+ tmp = rect->bottom - rect->top + 1;
|
|
|
b460d2 |
+ if ((tmp < 0) || (tmp > INT32_MAX))
|
|
|
b460d2 |
+ {
|
|
|
b460d2 |
+ char buffer[256];
|
|
|
b460d2 |
+ WLog_ERR(TAG, "[%s] rectangle invalid %s", __FUNCTION__,
|
|
|
b460d2 |
+ gdi_rect_str(buffer, sizeof(buffer), rect));
|
|
|
b460d2 |
+ *h = 0;
|
|
|
b460d2 |
+ }
|
|
|
b460d2 |
+ else
|
|
|
b460d2 |
+ *h = tmp;
|
|
|
b460d2 |
}
|
|
|
b460d2 |
|
|
|
b460d2 |
/**
|
|
|
b460d2 |
--
|
|
|
b460d2 |
2.26.2
|
|
|
b460d2 |
|