|
 |
b460d2 |
From b62b942e805cdfdfd1e71ec752c08091d4c3229f Mon Sep 17 00:00:00 2001
|
|
|
b460d2 |
From: akallabeth <akallabeth@posteo.net>
|
|
|
b460d2 |
Date: Mon, 30 Mar 2020 18:05:17 +0200
|
|
|
b460d2 |
Subject: [PATCH] Fix CVE-2020-11524: out of bounds access in interleaved
|
|
|
b460d2 |
|
|
|
b460d2 |
Thanks to Sunglin and HuanGMz from Knownsec 404
|
|
|
b460d2 |
---
|
|
|
b460d2 |
libfreerdp/codec/include/bitmap.c | 4 ++++
|
|
|
b460d2 |
libfreerdp/codec/interleaved.c | 2 +-
|
|
|
b460d2 |
2 files changed, 5 insertions(+), 1 deletion(-)
|
|
|
b460d2 |
|
|
|
b460d2 |
diff --git a/libfreerdp/codec/include/bitmap.c b/libfreerdp/codec/include/bitmap.c
|
|
|
b460d2 |
index 602d1b333..734ed136d 100644
|
|
|
b460d2 |
--- a/libfreerdp/codec/include/bitmap.c
|
|
|
b460d2 |
+++ b/libfreerdp/codec/include/bitmap.c
|
|
|
b460d2 |
@@ -338,6 +338,10 @@ static INLINE BOOL RLEDECOMPRESS(const BYTE* pbSrcBuffer, UINT32 cbSrcBuffer,
|
|
|
b460d2 |
case MEGA_MEGA_COLOR_IMAGE:
|
|
|
b460d2 |
runLength = ExtractRunLength(code, pbSrc, &advance);
|
|
|
b460d2 |
pbSrc = pbSrc + advance;
|
|
|
b460d2 |
+
|
|
|
b460d2 |
+ if (!ENSURE_CAPACITY(pbDest, pbDestEnd, runLength))
|
|
|
b460d2 |
+ return FALSE;
|
|
|
b460d2 |
+
|
|
|
b460d2 |
UNROLL(runLength,
|
|
|
b460d2 |
{
|
|
|
b460d2 |
SRCREADPIXEL(temp, pbSrc);
|
|
|
b460d2 |
diff --git a/libfreerdp/codec/interleaved.c b/libfreerdp/codec/interleaved.c
|
|
|
b460d2 |
index a3fe7dd3f..0d36e9b9f 100644
|
|
|
b460d2 |
--- a/libfreerdp/codec/interleaved.c
|
|
|
b460d2 |
+++ b/libfreerdp/codec/interleaved.c
|
|
|
b460d2 |
@@ -215,7 +215,7 @@ static INLINE BOOL ensure_capacity(const BYTE* start, const BYTE* end, size_t si
|
|
|
b460d2 |
{
|
|
|
b460d2 |
const size_t available = (uintptr_t)end - (uintptr_t)start;
|
|
|
b460d2 |
const BOOL rc = available >= size * base;
|
|
|
b460d2 |
- return rc;
|
|
|
b460d2 |
+ return rc && (start <= end);
|
|
|
b460d2 |
}
|
|
|
b460d2 |
|
|
|
b460d2 |
static INLINE void write_pixel_8(BYTE* _buf, BYTE _pix)
|
|
|
b460d2 |
--
|
|
|
b460d2 |
2.26.2
|
|
|
b460d2 |
|