mirrors/FreeRDP
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed missing input length check for color pointer.

Browse Source 
(cherry picked from commit 47d02a76ce07cbfc655754a1ccfe79a9b6bc9357)
This commit is contained in:
Armin Novak 2020-08-10 12:26:33 +02:00 committed by akallabeth
parent e805752c4e
commit 6004eefec5
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libfreerdp/codec/color.c
View File

@ -241,6 +241,10 @@ BOOL freerdp_image_copy_from_icon_data(BYTE* pDstData, UINT32 DstFormat, UINT32
return FALSE; return FALSE;
} }
/* Ensure we have enough source data bytes for image copy. */
if (cbBitsColor < nWidth * nHeight * GetBytesPerPixel(format))
return FALSE;
fill_gdi_palette_for_icon(colorTable, cbColorTable, &palette); fill_gdi_palette_for_icon(colorTable, cbColorTable, &palette);
if (!freerdp_image_copy(pDstData, DstFormat, nDstStep, nXDst, nYDst, nWidth, nHeight, bitsColor, if (!freerdp_image_copy(pDstData, DstFormat, nDstStep, nXDst, nYDst, nWidth, nHeight, bitsColor,
format, 0, 0, 0, &palette, FREERDP_FLIP_VERTICAL)) format, 0, 0, 0, &palette, FREERDP_FLIP_VERTICAL))
@ -576,6 +580,8 @@ static INLINE BOOL overlapping(const BYTE* pDstData, UINT32 nXDst, UINT32 nYDst,
const BYTE* pSrcStart = &pSrcData[nXSrc * srcBytesPerPixel + nYSrc * nSrcStep]; const BYTE* pSrcStart = &pSrcData[nXSrc * srcBytesPerPixel + nYSrc * nSrcStep];
const BYTE* pSrcEnd = pSrcStart + nHeight * nSrcStep; const BYTE* pSrcEnd = pSrcStart + nHeight * nSrcStep;
WINPR_UNUSED(nWidth);
if ((pDstStart >= pSrcStart) && (pDstStart <= pSrcEnd)) if ((pDstStart >= pSrcStart) && (pDstStart <= pSrcEnd))
return TRUE; return TRUE;
@ -771,8 +777,10 @@ BOOL freerdp_image_scale(BYTE* pDstData, DWORD DstFormat, UINT32 nDstStep, UINT3
UINT32 nSrcWidth, UINT32 nSrcHeight) UINT32 nSrcWidth, UINT32 nSrcHeight)
{ {
BOOL rc = FALSE; BOOL rc = FALSE;
#if defined(SWSCALE_FOUND) || defined(CAIRO_FOUND)
const BYTE* src = &pSrcData[nXSrc * GetBytesPerPixel(SrcFormat) + nYSrc * nSrcStep]; const BYTE* src = &pSrcData[nXSrc * GetBytesPerPixel(SrcFormat) + nYSrc * nSrcStep];
BYTE* dst = &pDstData[nXDst * GetBytesPerPixel(DstFormat) + nYDst * nDstStep]; BYTE* dst = &pDstData[nXDst * GetBytesPerPixel(DstFormat) + nYDst * nDstStep];
#endif
/* direct copy is much faster than scaling, so check if we can simply copy... */ /* direct copy is much faster than scaling, so check if we can simply copy... */
if ((nDstWidth == nSrcWidth) && (nDstHeight == nSrcHeight)) if ((nDstWidth == nSrcWidth) && (nDstHeight == nSrcHeight))