[winpr,stream] use new Stream_CheckAndLogRequiredLength*

This commit is contained in:
akallabeth 2023-01-24 14:53:36 +01:00 committed by akallabeth
parent de40b43037
commit 075506f6c8
25 changed files with 55 additions and 48 deletions

View File

@ -154,8 +154,8 @@ static UINT disp_recv_display_control_monitor_layout_pdu(wStream* s, DispServerC
return ERROR_INVALID_DATA;
}
if (!Stream_CheckAndLogRequiredLength(
TAG, s, pdu.NumMonitors * 1ull * DISPLAY_CONTROL_MONITOR_LAYOUT_SIZE))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, pdu.NumMonitors,
DISPLAY_CONTROL_MONITOR_LAYOUT_SIZE))
return ERROR_INVALID_DATA;
pdu.Monitors = (DISPLAY_CONTROL_MONITOR_LAYOUT*)calloc(pdu.NumMonitors,

View File

@ -92,7 +92,7 @@ static UINT encomsp_read_unicode_string(wStream* s, ENCOMSP_UNICODE_STRING* str)
return ERROR_INVALID_DATA;
}
if (!Stream_CheckAndLogRequiredLength(TAG, s, sizeof(WCHAR) * str->cchString))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, str->cchString, sizeof(WCHAR)))
return ERROR_INVALID_DATA;
Stream_Read(s, &(str->wString), (str->cchString * 2)); /* String (variable) */

View File

@ -67,7 +67,7 @@ static int encomsp_read_unicode_string(wStream* s, ENCOMSP_UNICODE_STRING* str)
if (str->cchString > 1024)
return -1;
if (!Stream_CheckAndLogRequiredLength(TAG, s, (str->cchString * 2ull)))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, str->cchString, sizeof(WCHAR)))
return -1;
Stream_Read(s, &(str->wString), (str->cchString * 2)); /* String (variable) */

View File

@ -51,7 +51,7 @@ static UINT rdpgfx_read_h264_metablock(RDPGFX_PLUGIN* gfx, wStream* s, RDPGFX_H2
Stream_Read_UINT32(s, meta->numRegionRects); /* numRegionRects (4 bytes) */
if (!Stream_CheckAndLogRequiredLength(TAG, s, 8ull * meta->numRegionRects))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, meta->numRegionRects, 8ull))
goto error_out;
meta->regionRects = (RECTANGLE_16*)calloc(meta->numRegionRects, sizeof(RECTANGLE_16));
@ -91,7 +91,7 @@ static UINT rdpgfx_read_h264_metablock(RDPGFX_PLUGIN* gfx, wStream* s, RDPGFX_H2
index, regionRect->left, regionRect->top, regionRect->right, regionRect->bottom);
}
if (!Stream_CheckAndLogRequiredLength(TAG, s, 2ull * meta->numRegionRects))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, meta->numRegionRects, 2ull))
{
error = ERROR_INVALID_DATA;
goto error_out;

View File

@ -521,7 +521,7 @@ static UINT rdpgfx_recv_reset_graphics_pdu(GENERIC_CHANNEL_CALLBACK* callback, w
Stream_Read_UINT32(s, pdu.height); /* height (4 bytes) */
Stream_Read_UINT32(s, pdu.monitorCount); /* monitorCount (4 bytes) */
if (!Stream_CheckAndLogRequiredLength(TAG, s, 20ull * pdu.monitorCount))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, pdu.monitorCount, 20ull))
return ERROR_INVALID_DATA;
pdu.monitorDefArray = (MONITOR_DEF*)calloc(pdu.monitorCount, sizeof(MONITOR_DEF));
@ -1001,7 +1001,7 @@ static UINT rdpgfx_recv_cache_import_reply_pdu(GENERIC_CHANNEL_CALLBACK* callbac
Stream_Read_UINT16(s, pdu.importedEntriesCount); /* cacheSlot (2 bytes) */
if (!Stream_CheckAndLogRequiredLength(TAG, s, 2ull * pdu.importedEntriesCount))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, pdu.importedEntriesCount, 2ull))
return ERROR_INVALID_DATA;
if (pdu.importedEntriesCount > RDPGFX_CACHE_ENTRY_MAX_COUNT)
@ -1477,7 +1477,7 @@ static UINT rdpgfx_recv_solid_fill_pdu(GENERIC_CHANNEL_CALLBACK* callback, wStre
Stream_Read_UINT16(s, pdu.fillRectCount); /* fillRectCount (2 bytes) */
if (!Stream_CheckAndLogRequiredLength(TAG, s, 8ull * pdu.fillRectCount))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, pdu.fillRectCount, 8ull))
return ERROR_INVALID_DATA;
pdu.fillRects = (RECTANGLE_16*)calloc(pdu.fillRectCount, sizeof(RECTANGLE_16));
@ -1547,7 +1547,7 @@ static UINT rdpgfx_recv_surface_to_surface_pdu(GENERIC_CHANNEL_CALLBACK* callbac
Stream_Read_UINT16(s, pdu.destPtsCount); /* destPtsCount (2 bytes) */
if (!Stream_CheckAndLogRequiredLength(TAG, s, 4ULL * pdu.destPtsCount))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, pdu.destPtsCount, 4ull))
return ERROR_INVALID_DATA;
pdu.destPts = (RDPGFX_POINT16*)calloc(pdu.destPtsCount, sizeof(RDPGFX_POINT16));
@ -1663,7 +1663,7 @@ static UINT rdpgfx_recv_cache_to_surface_pdu(GENERIC_CHANNEL_CALLBACK* callback,
Stream_Read_UINT16(s, pdu.surfaceId); /* surfaceId (2 bytes) */
Stream_Read_UINT16(s, pdu.destPtsCount); /* destPtsCount (2 bytes) */
if (!Stream_CheckAndLogRequiredLength(TAG, s, 4ull * pdu.destPtsCount))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, pdu.destPtsCount, 4ull))
return ERROR_INVALID_DATA;
pdu.destPts = (RDPGFX_POINT16*)calloc(pdu.destPtsCount, sizeof(RDPGFX_POINT16));

View File

@ -1141,7 +1141,7 @@ static UINT rdpgfx_recv_cache_import_offer_pdu(RdpgfxServerContext* context, wSt
return ERROR_INVALID_DATA;
}
if (!Stream_CheckAndLogRequiredLength(TAG, s, 12ull * pdu.cacheEntriesCount))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, pdu.cacheEntriesCount, 12ull))
return ERROR_INVALID_DATA;
for (index = 0; index < pdu.cacheEntriesCount; index++)

View File

@ -281,7 +281,7 @@ static UINT rdpsnd_recv_server_audio_formats_pdu(rdpsndPlugin* rdpsnd, wStream*
Stream_Seek_UINT8(s); /* bPad */
rdpsnd->NumberOfServerFormats = wNumberOfFormats;
if (!Stream_CheckAndLogRequiredLength(TAG, s, 14ull * wNumberOfFormats))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, wNumberOfFormats, 14ull))
return ERROR_BAD_LENGTH;
if (rdpsnd->NumberOfServerFormats > 0)

View File

@ -198,7 +198,7 @@ static UINT rdpsnd_server_recv_formats(RdpsndServerContext* context, wStream* s)
Stream_Seek_UINT8(s); /* bPad */
/* this check is only a guess as cbSize can influence the size of a format record */
if (!Stream_CheckAndLogRequiredLength(TAG, s, 18ull * context->num_client_formats))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, context->num_client_formats, 18ull))
return ERROR_INVALID_DATA;
if (!context->num_client_formats)

View File

@ -825,11 +825,14 @@ static UINT urb_isoch_transfer(IUDEVICE* pdev, GENERIC_CHANNEL_CALLBACK* callbac
Stream_Read_UINT32(s, NumberOfPackets); /** NumberOfPackets */
Stream_Read_UINT32(s, ErrorCount); /** ErrorCount */
if (!Stream_CheckAndLogRequiredLength(TAG, s, NumberOfPackets * 12ULL + 4ULL))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, NumberOfPackets, 12ull))
return ERROR_INVALID_DATA;
packetDescriptorData = Stream_Pointer(s);
Stream_Seek(s, NumberOfPackets * 12);
if (!Stream_CheckAndLogRequiredLength(TAG, s, sizeof(UINT32)))
return ERROR_INVALID_DATA;
Stream_Read_UINT32(s, OutputBufferSize);
if (transferDir == USBD_TRANSFER_DIRECTION_OUT)

View File

@ -176,7 +176,7 @@ static BOOL clear_decompress_subcode_rlex(wStream* s, UINT32 bitmapDataByteCount
return FALSE;
}
if (!Stream_CheckAndLogRequiredLength(TAG, s, 3ull * paletteCount))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, paletteCount, 3ull))
return FALSE;
for (i = 0; i < paletteCount; i++)
@ -689,7 +689,7 @@ static BOOL clear_decompress_bands_data(CLEAR_CONTEXT* clear, wStream* s, UINT32
return FALSE;
}
if (!Stream_CheckAndLogRequiredLength(TAG, s, 3ull * vBarShortPixelCount))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, vBarShortPixelCount, 3ull))
return FALSE;
if (clear->ShortVBarStorageCursor >= CLEARCODEC_VBAR_SHORT_SIZE)

View File

@ -2253,7 +2253,7 @@ static INLINE INT32 progressive_wb_read_region_header(PROGRESSIVE_CONTEXT* progr
}
len = Stream_GetRemainingLength(s);
if (!Stream_CheckAndLogRequiredLength(TAG, s, 8ull * region->numRects))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, region->numRects, 8ull))
{
WLog_Print(progressive->log, WLOG_ERROR, "ProgressiveRegion data short for region->rects");
return -1015;

View File

@ -516,7 +516,7 @@ static BOOL rfx_process_message_channels(RFX_CONTEXT* context, wStream* s)
return FALSE;
}
if (!Stream_CheckAndLogRequiredLength(TAG, s, 5ull * numChannels))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, numChannels, 5ull))
return FALSE;
/* RFX_CHANNELT */
@ -679,7 +679,7 @@ static BOOL rfx_process_message_region(RFX_CONTEXT* context, RFX_MESSAGE* messag
return TRUE;
}
if (!Stream_CheckAndLogRequiredLength(TAG, s, 8ull * message->numRects))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, message->numRects, 8ull))
return FALSE;
tmpRects = realloc(message->rects, message->numRects * sizeof(RFX_RECT));
@ -796,7 +796,7 @@ static BOOL rfx_process_message_tileset(RFX_CONTEXT* context, RFX_MESSAGE* messa
quants = context->quants = (UINT32*)pmem;
/* quantVals */
if (!Stream_CheckAndLogRequiredLength(TAG, s, 5ull * context->numQuant))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, context->numQuant, 5ull))
return FALSE;
for (i = 0; i < context->numQuant; i++)

View File

@ -421,7 +421,7 @@ int zgfx_decompress(ZGFX_CONTEXT* zgfx, const BYTE* pSrcData, UINT32 SrcSize, BY
Stream_Read_UINT16(stream, segmentCount); /* segmentCount (2 bytes) */
Stream_Read_UINT32(stream, uncompressedSize); /* uncompressedSize (4 bytes) */
if (!Stream_CheckAndLogRequiredLength(TAG, stream, sizeof(UINT32) * segmentCount))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, stream, segmentCount, sizeof(UINT32)))
goto fail;
pConcatenated = aligned_zgfx_malloc(uncompressedSize);

View File

@ -46,7 +46,7 @@ static BOOL rdp_recv_sync_pdu(rdpRdp* rdp, wStream* s, const char* what)
UINT16 msgType, targetUser;
WINPR_UNUSED(rdp);
if (!Stream_CheckAndLogRequiredLengthEx(TAG, WLOG_WARN, s, 4, "%s(%s:%" PRIuz ") %s",
if (!Stream_CheckAndLogRequiredLengthEx(TAG, WLOG_WARN, s, 4, 1, "%s(%s:%" PRIuz ") %s",
__FUNCTION__, __FILE__, (size_t)__LINE__, what))
return FALSE;
Stream_Read_UINT16(s, msgType);

View File

@ -371,7 +371,7 @@ static BOOL rts_read_version(wStream* s, p_rt_version_t* version)
WINPR_ASSERT(s);
WINPR_ASSERT(version);
if (!Stream_CheckAndLogRequiredLength(TAG, s, 2 * sizeof(UINT8)))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, 2, sizeof(UINT8)))
return FALSE;
Stream_Read_UINT8(s, version->major);
Stream_Read_UINT8(s, version->minor);

View File

@ -2024,7 +2024,7 @@ BOOL gcc_read_server_network_data(wStream* s, rdpMcs* mcs)
mcs->channelCount = channelCount;
}
if (!Stream_CheckAndLogRequiredLength(TAG, s, 2ull * channelCount))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, channelCount, 2ull))
return FALSE;
for (UINT32 i = 0; i < parsedChannelCount; i++)

View File

@ -692,7 +692,7 @@ BOOL input_recv(rdpInput* input, wStream* s)
Stream_Seek(s, 2); /* pad2Octets (2 bytes) */
/* Each input event uses 6 exactly bytes. */
if (!Stream_CheckAndLogRequiredLength(TAG, s, 6ull * numberEvents))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, numberEvents, 6ull))
return FALSE;
for (i = 0; i < numberEvents; i++)

View File

@ -2457,7 +2457,7 @@ static CACHE_COLOR_TABLE_ORDER* update_read_cache_color_table_order(rdpUpdate* u
goto fail;
}
if (!Stream_CheckAndLogRequiredLength(TAG, s, 4ull * cache_color_table->numberColors))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, cache_color_table->numberColors, 4ull))
goto fail;
colorTable = (UINT32*)&cache_color_table->colorTable;
@ -2557,7 +2557,8 @@ static CACHE_GLYPH_ORDER* update_read_cache_glyph_order(rdpUpdate* update, wStre
if (!cache_glyph_order->unicodeCharacters)
goto fail;
if (!Stream_CheckAndLogRequiredLength(TAG, s, sizeof(WCHAR) * cache_glyph_order->cGlyphs))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, cache_glyph_order->cGlyphs,
sizeof(WCHAR)))
goto fail;
Stream_Read_UTF16_String(s, cache_glyph_order->unicodeCharacters,
@ -2664,7 +2665,7 @@ static CACHE_GLYPH_V2_ORDER* update_read_cache_glyph_v2_order(rdpUpdate* update,
if (!cache_glyph_v2->unicodeCharacters)
goto fail;
if (!Stream_CheckAndLogRequiredLength(TAG, s, sizeof(WCHAR) * cache_glyph_v2->cGlyphs))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, cache_glyph_v2->cGlyphs, sizeof(WCHAR)))
goto fail;
Stream_Read_UTF16_String(s, cache_glyph_v2->unicodeCharacters, cache_glyph_v2->cGlyphs);
@ -2729,7 +2730,7 @@ static BOOL update_decompress_brush(wStream* s, BYTE* output, size_t outSize, BY
const BYTE* palette = Stream_Pointer(s) + 16;
const size_t bytesPerPixel = ((bpp + 1) / 8);
if (!Stream_CheckAndLogRequiredLength(TAG, s, 16ULL + bytesPerPixel * 4ULL))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, 4ULL + bytesPerPixel, 4ULL))
return FALSE;
for (y = 7; y >= 0; y--)
@ -2829,7 +2830,7 @@ static CACHE_BRUSH_ORDER* update_read_cache_brush_order(rdpUpdate* update, wStre
/* uncompressed brush */
UINT32 scanline = (cache_brush->bpp / 8) * 8;
if (!Stream_CheckAndLogRequiredLength(TAG, s, 8ull * scanline))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, scanline, 8ull))
goto fail;
for (i = 7; i >= 0; i--)
@ -2967,7 +2968,7 @@ update_read_create_offscreen_bitmap_order(wStream* s,
deleteList->indices = new_indices;
}
if (!Stream_CheckAndLogRequiredLength(TAG, s, 2ull * deleteList->cIndices))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, deleteList->cIndices, 2ull))
return FALSE;
for (i = 0; i < deleteList->cIndices; i++)

View File

@ -948,7 +948,7 @@ static BOOL rdp_recv_monitor_layout_pdu(rdpRdp* rdp, wStream* s)
Stream_Read_UINT32(s, monitorCount); /* monitorCount (4 bytes) */
if (!Stream_CheckAndLogRequiredLength(TAG, s, 20ull * monitorCount))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, monitorCount, 20ull))
return FALSE;
monitorDefArray = (MONITOR_DEF*)calloc(monitorCount, sizeof(MONITOR_DEF));

View File

@ -274,7 +274,7 @@ PALETTE_UPDATE* update_read_palette(rdpUpdate* update, wStream* s)
if (palette_update->number > 256)
palette_update->number = 256;
if (!Stream_CheckAndLogRequiredLength(TAG, s, 3ull * palette_update->number))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, palette_update->number, 3ull))
goto fail;
/* paletteEntries */
@ -2341,7 +2341,7 @@ BOOL update_read_refresh_rect(rdpUpdate* update, wStream* s)
Stream_Read_UINT8(s, numberOfAreas);
Stream_Seek(s, 3); /* pad3Octects */
if (!Stream_CheckAndLogRequiredLength(TAG, s, 8ull * numberOfAreas))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, numberOfAreas, 8ull))
return FALSE;
for (BYTE index = 0; index < numberOfAreas; index++)

View File

@ -372,7 +372,7 @@ static BOOL update_read_window_state_order(wStream* s, WINDOW_ORDER_INFO* orderI
windowState->windowRects = newRect;
if (!Stream_CheckAndLogRequiredLength(TAG, s, 8ull * windowState->numWindowRects))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, windowState->numWindowRects, 8ull))
return FALSE;
/* windowRects */
@ -416,7 +416,8 @@ static BOOL update_read_window_state_order(wStream* s, WINDOW_ORDER_INFO* orderI
windowState->visibilityRects = newRect;
if (!Stream_CheckAndLogRequiredLength(TAG, s, 8ull * windowState->numVisibilityRects))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, windowState->numVisibilityRects,
8ull))
return FALSE;
/* visibilityRects */
@ -912,7 +913,7 @@ static BOOL update_read_desktop_actively_monitored_order(wStream* s, WINDOW_ORDE
Stream_Read_UINT8(s, monitored_desktop->numWindowIds); /* numWindowIds (1 byte) */
if (!Stream_CheckAndLogRequiredLength(TAG, s, 4ull * monitored_desktop->numWindowIds))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, monitored_desktop->numWindowIds, 4ull))
return FALSE;
if (monitored_desktop->numWindowIds > 0)

View File

@ -841,7 +841,7 @@ static UINT gdi_SurfaceCommand_Alpha(rdpGdi* gdi, RdpgfxClientContext* context,
if (compressed == 0)
{
if (!Stream_CheckAndLogRequiredLength(TAG, s, cmd->height * cmd->width * 1ULL))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, cmd->height, cmd->width))
return ERROR_INVALID_DATA;
for (UINT32 y = cmd->top; y < cmd->top + cmd->height; y++)

View File

@ -82,7 +82,7 @@ UINT cliprdr_parse_file_list(const BYTE* format_data, UINT32 format_data_length,
Stream_Read_UINT32(s, count); /* cItems (4 bytes) */
if (!Stream_CheckAndLogRequiredLength(TAG, s, CLIPRDR_FILEDESCRIPTOR_SIZE * count * 1ull))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, count, CLIPRDR_FILEDESCRIPTOR_SIZE))
{
result = ERROR_INCORRECT_SIZE;
goto out;

View File

@ -160,7 +160,7 @@ static LONG smartcard_ndr_read(wStream* s, BYTE** data, size_t min, size_t eleme
if (len > SIZE_MAX / 2)
return STATUS_BUFFER_TOO_SMALL;
if (!Stream_CheckAndLogRequiredLength(TAG, s, len * elementSize * 1ull))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, len, elementSize))
return STATUS_BUFFER_TOO_SMALL;
len *= elementSize;

View File

@ -133,22 +133,24 @@ typedef struct
} while (0)
#define Stream_CheckAndLogRequiredLengthSrv(log, s, len) \
Stream_CheckAndLogRequiredLengthWLogEx(log, WLOG_WARN, s, len, \
Stream_CheckAndLogRequiredLengthWLogEx(log, WLOG_WARN, s, len, 1, \
proxy_client_rx " %s(%s:%" PRIuz ")", __FUNCTION__, \
__FILE__, (size_t)__LINE__)
#define Stream_CheckAndLogRequiredLengthClient(log, s, len) \
Stream_CheckAndLogRequiredLengthWLogEx(log, WLOG_WARN, s, len, \
Stream_CheckAndLogRequiredLengthWLogEx(log, WLOG_WARN, s, len, 1, \
proxy_server_rx " %s(%s:%" PRIuz ")", __FUNCTION__, \
__FILE__, (size_t)__LINE__)
#define Stream_CheckAndLogRequiredLengthRx(srv, log, s, len) \
Stream_CheckAndLogRequiredLengthRx_(srv, log, s, len, __FUNCTION__, __FILE__, __LINE__)
static BOOL Stream_CheckAndLogRequiredLengthRx_(BOOL srv, wLog* log, wStream* s, size_t len,
const char* fkt, const char* file, size_t line)
Stream_CheckAndLogRequiredLengthRx_(srv, log, s, len, 1, __FUNCTION__, __FILE__, __LINE__)
static BOOL Stream_CheckAndLogRequiredLengthRx_(BOOL srv, wLog* log, wStream* s, size_t nmemb,
size_t size, const char* fkt, const char* file,
size_t line)
{
const char* fmt =
srv ? proxy_server_rx " %s(%s:%" PRIuz ")" : proxy_client_rx " %s(%s:%" PRIuz ")";
return Stream_CheckAndLogRequiredLengthWLogEx(log, WLOG_WARN, s, len, fmt, fkt, file, line);
return Stream_CheckAndLogRequiredLengthWLogEx(log, WLOG_WARN, s, nmemb, size, fmt, fkt, file,
line);
}
static const char* rdpdr_server_state_to_string(pf_channel_server_state state)
@ -1526,7 +1528,7 @@ static BOOL filter_smartcard_device_list_remove(pf_channel_server_context* rdpdr
if (count == 0)
return TRUE;
if (!Stream_CheckAndLogRequiredLength(TAG, s, count * sizeof(UINT32)))
if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, s, count, sizeof(UINT32)))
return TRUE;
for (x = 0; x < count; x++)