mirrors/FreeRDP
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #2160 from nfedera/fix-2014-10-22-01

Browse Source 
core: fix pointer caps, slowpath kbd and a gcc fix
This commit is contained in:
Hardening 2014-10-22 13:49:15 +02:00
commit 6a282e0ec6
3 changed files with 33 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libfreerdp/core/capabilities.c
View File

@ -936,12 +936,17 @@ BOOL rdp_read_pointer_capability_set(wStream* s, UINT16 length, rdpSettings* set
UINT16 colorPointerCacheSize;
UINT16 pointerCacheSize;
if (length < 10)
if (length < 8)
return FALSE;
Stream_Read_UINT16(s, colorPointerFlag); /* colorPointerFlag (2 bytes) */
Stream_Read_UINT16(s, colorPointerCacheSize); /* colorPointerCacheSize (2 bytes) */
Stream_Read_UINT16(s, pointerCacheSize); /* pointerCacheSize (2 bytes) */
/* pointerCacheSize is optional */
if (length >= 10)
Stream_Read_UINT16(s, pointerCacheSize); /* pointerCacheSize (2 bytes) */
else
pointerCacheSize = 0;
if (colorPointerFlag == FALSE)
settings->ColorPointerFlag = FALSE;

5
libfreerdp/core/gcc.c
View File

@ -291,8 +291,9 @@ void gcc_write_conference_create_response(wStream* s, wStream* userData)
per_write_choice(s, 0);
per_write_object_identifier(s, t124_02_98_oid);
/* ConnectData::connectPDU (OCTET_STRING) */
per_write_length(s, Stream_GetPosition(userData) + 2);
/* ConnectPDULength */
/* This length MUST be ignored by the client according to [MS-RDPBCGR] */
per_write_length(s, 0);
/* ConnectGCCPDU */
per_write_choice(s, 0x14);

33
libfreerdp/core/input.c
View File

@ -333,6 +333,25 @@ static BOOL input_recv_keyboard_event(rdpInput* input, wStream* s)
Stream_Read_UINT16(s, keyCode); /* keyCode (2 bytes) */
Stream_Seek(s, 2); /* pad2Octets (2 bytes) */
/**
* Note: A lot of code in FreeRDP and in dependent projects checks the
* KBDFLAGS_DOWN flag in order to detect a key press.
* According to the specs only the absence of the slow-path
* KBDFLAGS_RELEASE flag indicates a key-down event.
* The slow-path KBDFLAGS_DOWN flag merely indicates that the key was
* down prior to this event.
* The checks for KBDFLAGS_DOWN only work successfully because the code
* handling the fast-path keyboard input sets the KBDFLAGS_DOWN flag if
* the FASTPATH_INPUT_KBDFLAGS_RELEASE flag is missing.
* Since the same input callback is used for slow- and fast-path events
* we have to follow that "convention" here.
*/
if (keyboardFlags & KBD_FLAGS_RELEASE)
keyboardFlags &= ~KBD_FLAGS_DOWN;
else
keyboardFlags |= KBD_FLAGS_DOWN;
IFCALL(input->KeyboardEvent, input, keyboardFlags, keyCode);
return TRUE;
@ -349,17 +368,11 @@ static BOOL input_recv_unicode_keyboard_event(rdpInput* input, wStream* s)
Stream_Read_UINT16(s, unicodeCode); /* unicodeCode (2 bytes) */
Stream_Seek(s, 2); /* pad2Octets (2 bytes) */
/*
* According to the specification, the slow path Unicode Keyboard Event
* (TS_UNICODE_KEYBOARD_EVENT) contains KBD_FLAGS_RELEASE flag when key
* is released, but contains no flags when it is pressed.
* This is different from the slow path Keyboard Event
* (TS_KEYBOARD_EVENT) which does contain KBD_FLAGS_DOWN flag when the
* key is pressed.
* Set the KBD_FLAGS_DOWN flag if the KBD_FLAGS_RELEASE flag is missing.
*/
/* "fix" keyboardFlags - see comment in input_recv_keyboard_event() */
if ((keyboardFlags & KBD_FLAGS_RELEASE) == 0)
if (keyboardFlags & KBD_FLAGS_RELEASE)
keyboardFlags &= ~KBD_FLAGS_DOWN;
else
keyboardFlags |= KBD_FLAGS_DOWN;
IFCALL(input->UnicodeKeyboardEvent, input, keyboardFlags, unicodeCode);