diff --git a/libfreerdp-gdi/graphics.c b/libfreerdp-gdi/graphics.c index 04816334c..5a49bd365 100644 --- a/libfreerdp-gdi/graphics.c +++ b/libfreerdp-gdi/graphics.c @@ -30,6 +30,8 @@ #include #include +#include + #include "graphics.h" /* Bitmap Class */ @@ -89,9 +91,18 @@ void gdi_Bitmap_Paint(rdpContext* context, rdpBitmap* bitmap) void gdi_Bitmap_Decompress(rdpContext* context, rdpBitmap* bitmap, uint8* data, int width, int height, int bpp, int length, boolean compressed) { - uint16 size; + uint32 size = width * height; + int bpp_op = (bpp + 7) / 8; + + if ((bpp == 0) || + (width == 0) || (height == 0) || (width > UINT32_MAX / height) || + (size > (UINT32_MAX / bpp_op))) + { + printf("gdi_Bitmap_Decompress failed\n"); + abort(); + } - size = width * height * (bpp + 7) / 8; + size *= bpp_op; if (bitmap->data == NULL) bitmap->data = (uint8*) xmalloc(size);