mirrors
/
FreeRDP
mirror of https://github.com/FreeRDP/FreeRDP
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixed CVE-2020-11525: Out of bounds read in bitmap_cache_new 

Thanks to Sunglin and HuanGMz from Knownsec 404
This commit is contained in:
akallabeth 2020-03-30 17:13:51 +02:00 committed by akallabeth
parent b52cc2cd48
commit 0b6b92a25a
1 changed files with 7 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
libfreerdp/cache/bitmap.c vendored
View File

@ -214,7 +214,7 @@ rdpBitmap* bitmap_cache_get(rdpBitmapCache* bitmapCache, UINT32 id, UINT32 index
{
rdpBitmap* bitmap;
if (id > bitmapCache->maxCells)
if (id >= bitmapCache->maxCells)
{
WLog_ERR(TAG, "get invalid bitmap cell id: %" PRIu32 "", id);
return NULL;
@ -271,7 +271,7 @@ void bitmap_cache_register_callbacks(rdpUpdate* update)
rdpBitmapCache* bitmap_cache_new(rdpSettings* settings)
{
int i;
UINT32 i;
rdpBitmapCache* bitmapCache;
bitmapCache = (rdpBitmapCache*)calloc(1, sizeof(rdpBitmapCache));
@ -288,7 +288,7 @@ rdpBitmapCache* bitmap_cache_new(rdpSettings* settings)
goto fail;
bitmapCache->maxCells = settings->BitmapCacheV2NumCells;
for (i = 0; i < (int)bitmapCache->maxCells; i++)
for (i = 0; i < bitmapCache->maxCells; i++)
{
bitmapCache->cells[i].number = settings->BitmapCacheV2CellInfo[i].numEntries;
/* allocate an extra entry for BITMAP_CACHE_WAITING_LIST_INDEX */
@ -302,26 +302,20 @@ rdpBitmapCache* bitmap_cache_new(rdpSettings* settings)
return bitmapCache;
fail:
if (bitmapCache->cells)
{
for (i = 0; i < (int)bitmapCache->maxCells; i++)
free(bitmapCache->cells[i].entries);
}
free(bitmapCache);
bitmap_cache_free(bitmapCache);
return NULL;
}
void bitmap_cache_free(rdpBitmapCache* bitmapCache)
{
int i, j;
UINT32 i, j;
rdpBitmap* bitmap;
if (bitmapCache)
{
for (i = 0; i < (int)bitmapCache->maxCells; i++)
for (i = 0; i < bitmapCache->maxCells; i++)
{
for (j = 0; j < (int)bitmapCache->cells[i].number + 1; j++)
for (j = 0; j < bitmapCache->cells[i].number + 1; j++)
{
bitmap = bitmapCache->cells[i].entries[j];
Bitmap_Free(bitmapCache->context, bitmap);