mirrors/FreeRDP
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Added missing bounds check.

Browse Source 
(cherry picked from commit 2e6069d95b)
This commit is contained in:
Armin Novak 2021-03-12 10:15:51 +01:00 committed by akallabeth
parent bd3f9cfd9f
commit 602fb7d788
1 changed files with 19 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
libfreerdp/codec/planar.c
View File

@ -508,7 +508,7 @@ static INLINE BOOL writeLine(BYTE** ppRgba, UINT32 DstFormat, UINT32 width, cons
static INLINE BOOL planar_decompress_planes_raw(const BYTE* pSrcData[4], BYTE* pDstData, static INLINE BOOL planar_decompress_planes_raw(const BYTE* pSrcData[4], BYTE* pDstData,
UINT32 DstFormat, UINT32 nDstStep, UINT32 nXDst, UINT32 DstFormat, UINT32 nDstStep, UINT32 nXDst,
UINT32 nYDst, UINT32 nWidth, UINT32 nHeight, UINT32 nYDst, UINT32 nWidth, UINT32 nHeight,
BOOL vFlip) BOOL vFlip, UINT32 totalHeight)
{ {
INT32 y; INT32 y;
INT32 beg, end, inc; INT32 beg, end, inc;
@ -516,6 +516,7 @@ static INLINE BOOL planar_decompress_planes_raw(const BYTE* pSrcData[4], BYTE* p
const BYTE* pG = pSrcData[1]; const BYTE* pG = pSrcData[1];
const BYTE* pB = pSrcData[2]; const BYTE* pB = pSrcData[2];
const BYTE* pA = pSrcData[3]; const BYTE* pA = pSrcData[3];
const UINT32 bpp = GetBytesPerPixel(DstFormat);
if (vFlip) if (vFlip)
{ {
@ -530,9 +531,20 @@ static INLINE BOOL planar_decompress_planes_raw(const BYTE* pSrcData[4], BYTE* p
inc = 1; inc = 1;
} }
if (nYDst + nHeight > totalHeight)
return FALSE;
if ((nXDst + nWidth) * bpp > nDstStep)
return FALSE;
for (y = beg; y != end; y += inc) for (y = beg; y != end; y += inc)
{ {
BYTE* pRGB = &pDstData[((nYDst + y) * nDstStep) + (nXDst * GetBytesPerPixel(DstFormat))]; BYTE* pRGB;
if (y > (INT64)nHeight)
return FALSE;
pRGB = &pDstData[((nYDst + y) * nDstStep) + (nXDst * bpp)];
if (!writeLine(&pRGB, DstFormat, nWidth, &pR, &pG, &pB, &pA)) if (!writeLine(&pRGB, DstFormat, nWidth, &pR, &pG, &pB, &pA))
return FALSE; return FALSE;
@ -739,6 +751,7 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
UINT32 TempFormat; UINT32 TempFormat;
BYTE* pTempData = pDstData; BYTE* pTempData = pDstData;
UINT32 nTempStep = nDstStep; UINT32 nTempStep = nDstStep;
UINT32 nTotalHeight = nYDst + nDstHeight;
if (useAlpha) if (useAlpha)
TempFormat = PIXEL_FORMAT_BGRA32; TempFormat = PIXEL_FORMAT_BGRA32;
@ -749,12 +762,13 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
{ {
pTempData = planar->pTempData; pTempData = planar->pTempData;
nTempStep = planar->nTempStep; nTempStep = planar->nTempStep;
nTotalHeight = planar->maxHeight;
} }
if (!rle) /* RAW */ if (!rle) /* RAW */
{ {
if (!planar_decompress_planes_raw(planes, pTempData, TempFormat, nTempStep, nXDst, if (!planar_decompress_planes_raw(planes, pTempData, TempFormat, nTempStep, nXDst,
nYDst, nSrcWidth, nSrcHeight, vFlip)) nYDst, nSrcWidth, nSrcHeight, vFlip, nTotalHeight))
return FALSE; return FALSE;
if (alpha) if (alpha)
@ -819,6 +833,7 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
UINT32 TempFormat; UINT32 TempFormat;
BYTE* pTempData = planar->pTempData; BYTE* pTempData = planar->pTempData;
UINT32 nTempStep = planar->nTempStep; UINT32 nTempStep = planar->nTempStep;
UINT32 nTotalHeight = planar->maxHeight;
if (useAlpha) if (useAlpha)
TempFormat = PIXEL_FORMAT_BGRA32; TempFormat = PIXEL_FORMAT_BGRA32;
@ -901,7 +916,7 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
} }
if (!planar_decompress_planes_raw(planes, pTempData, TempFormat, nTempStep, nXDst, if (!planar_decompress_planes_raw(planes, pTempData, TempFormat, nTempStep, nXDst,
nYDst, nSrcWidth, nSrcHeight, vFlip)) nYDst, nSrcWidth, nSrcHeight, vFlip, nTotalHeight))
return FALSE; return FALSE;
if (alpha) if (alpha)