mirrors/FreeRDP
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libfreerdp-core: fix parsing of TsProxyCreateTunnel response with empty certificate

Browse Source
This commit is contained in:
Marc-André Moreau 2012-11-14 15:37:41 -05:00
parent d0c66ce767
commit 0dffd7bd49
1 changed files with 46 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
libfreerdp/core/tsg.c
View File

@ -287,20 +287,28 @@ BOOL TsProxyCreateTunnelReadResponse(rdpTsg* tsg)
offset += 4; /* 0x00000001 (4 bytes) */
}
Pointer = *((UINT32*) &buffer[offset]); /* Ptr (4 bytes): 0x00020014 */
offset += 4;
if (packetCapsResponse->pktQuarEncResponse.certChainLen)
{
Pointer = *((UINT32*) &buffer[offset]); /* Ptr (4 bytes): 0x00020014 */
offset += 4;
offset += 4; /* MaxCount (4 bytes) */
offset += 4; /* Offset (4 bytes) */
count = *((UINT32*) &buffer[offset]); /* ActualCount (4 bytes) */
offset += 4;
offset += 4; /* MaxCount (4 bytes) */
offset += 4; /* Offset (4 bytes) */
count = *((UINT32*) &buffer[offset]); /* ActualCount (4 bytes) */
offset += 4;
/*
* CertChainData is a wide character string, and the count is
* given in characters excluding the null terminator, therefore:
* size = ((count + 1) * 2)
*/
offset += ((count + 1) * 2); /* CertChainData */
/*
* CertChainData is a wide character string, and the count is
* given in characters excluding the null terminator, therefore:
* size = ((count + 1) * 2)
*/
offset += ((count + 1) * 2); /* CertChainData */
}
else
{
Pointer = *((UINT32*) &buffer[offset]); /* Ptr (4 bytes) */
offset += 4;
}
versionCaps = (PTSG_PACKET_VERSIONCAPS) malloc(sizeof(TSG_PACKET_VERSIONCAPS));
ZeroMemory(versionCaps, sizeof(TSG_PACKET_VERSIONCAPS));
@ -312,7 +320,8 @@ BOOL TsProxyCreateTunnelReadResponse(rdpTsg* tsg)
if (versionCaps->tsgHeader.ComponentId != TS_GATEWAY_TRANSPORT)
{
printf("Unexpected ComponentId: 0x%04X\n", versionCaps->tsgHeader.ComponentId);
printf("Unexpected ComponentId: 0x%04X, Expected TS_GATEWAY_TRANSPORT\n",
versionCaps->tsgHeader.ComponentId);
return FALSE;
}
@ -379,21 +388,29 @@ BOOL TsProxyCreateTunnelReadResponse(rdpTsg* tsg)
CopyMemory(&packetQuarEncResponse->nonce, &buffer[52], 16); /* Nonce */
offset = 68;
Pointer = *((UINT32*) &buffer[offset]); /* Ptr (4 bytes): 0x0002000C */
offset += 4;
offset += 4; /* MaxCount (4 bytes) */
offset += 4; /* Offset (4 bytes) */
count = *((UINT32*) &buffer[offset]); /* ActualCount (4 bytes) */
offset += 4;
/*
* CertChainData is a wide character string, and the count is
* given in characters excluding the null terminator, therefore:
* size = ((count + 1) * 2)
*/
offset += ((count + 1) * 2); /* CertChainData */
if (packetQuarEncResponse->certChainLen > 0)
{
Pointer = *((UINT32*) &buffer[offset]); /* Ptr (4 bytes): 0x0002000C */
offset += 4;
offset += 4; /* MaxCount (4 bytes) */
offset += 4; /* Offset (4 bytes) */
count = *((UINT32*) &buffer[offset]); /* ActualCount (4 bytes) */
offset += 4;
/*
* CertChainData is a wide character string, and the count is
* given in characters excluding the null terminator, therefore:
* size = ((count + 1) * 2)
*/
offset += ((count + 1) * 2); /* CertChainData */
}
else
{
Pointer = *((UINT32*) &buffer[offset]); /* Ptr (4 bytes): 0x00020008 */
offset += 4;
}
versionCaps = (PTSG_PACKET_VERSIONCAPS) malloc(sizeof(TSG_PACKET_VERSIONCAPS));
ZeroMemory(versionCaps, sizeof(TSG_PACKET_VERSIONCAPS));
packetQuarEncResponse->versionCaps = versionCaps;
@ -404,7 +421,8 @@ BOOL TsProxyCreateTunnelReadResponse(rdpTsg* tsg)
if (versionCaps->tsgHeader.ComponentId != TS_GATEWAY_TRANSPORT)
{
printf("Unexpected ComponentId: 0x%04X\n", versionCaps->tsgHeader.ComponentId);
printf("Unexpected ComponentId: 0x%04X, Expected TS_GATEWAY_TRANSPORT\n",
versionCaps->tsgHeader.ComponentId);
return FALSE;
}