mirrors/FreeRDP
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #2416 from zavadovsky/transport_dead_end_fix

Browse Source 
libfreerdp-core: fix dead-end state in transport_read_pdu()
This commit is contained in:
Norbert Federa 2015-02-23 12:56:26 +01:00
commit 1fd5508afd
1 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
libfreerdp/core/transport.c
View File

@ -422,6 +422,8 @@ int transport_read_pdu(rdpTransport* transport, wStream* s)
return status;
}
/* update position value for further checks */
position = Stream_GetPosition(s);
header = Stream_Buffer(s);
if (transport->NlaMode)
@ -439,7 +441,9 @@ int transport_read_pdu(rdpTransport* transport, wStream* s)
{
if ((header[1] & ~(0x80)) == 1)
{
if ((status = transport_read_layer_bytes(transport, s, 1)) != 1)
/* check for header bytes already was readed in previous calls */
if (position < 3
&& (status = transport_read_layer_bytes(transport, s, 3 - position)) != 1)
return status;
pduLength = header[2];
@ -447,7 +451,9 @@ int transport_read_pdu(rdpTransport* transport, wStream* s)
}
else if ((header[1] & ~(0x80)) == 2)
{
if ((status = transport_read_layer_bytes(transport, s, 2)) != 1)
/* check for header bytes already was readed in previous calls */
if (position < 4
&& (status = transport_read_layer_bytes(transport, s, 4 - position)) != 1)
return status;
pduLength = (header[2] << 8) | header[3];
@ -471,7 +477,9 @@ int transport_read_pdu(rdpTransport* transport, wStream* s)
if (header[0] == 0x03)
{
/* TPKT header */
if ((status = transport_read_layer_bytes(transport, s, 2)) != 1)
/* check for header bytes already was readed in previous calls */
if (position < 4
&& (status = transport_read_layer_bytes(transport, s, 4 - position)) != 1)
return status;
pduLength = (header[2] << 8) | header[3];
@ -488,7 +496,9 @@ int transport_read_pdu(rdpTransport* transport, wStream* s)
/* Fast-Path Header */
if (header[1] & 0x80)
{
if ((status = transport_read_layer_bytes(transport, s, 1)) != 1)
/* check for header bytes already was readed in previous calls */
if (position < 3
&& (status = transport_read_layer_bytes(transport, s, 3 - position)) != 1)
return status;
pduLength = ((header[1] & 0x7F) << 8) | header[2];