diff --git a/libfreerdp/core/channel.c b/libfreerdp/core/channel.c index f0a5855a4..2740bf9c3 100644 --- a/libfreerdp/core/channel.c +++ b/libfreerdp/core/channel.c @@ -91,30 +91,36 @@ BOOL freerdp_channel_send(rdpRdp* rdp, UINT16 channel_id, BYTE* data, int size) return TRUE; } -void freerdp_channel_process(freerdp* instance, STREAM* s, UINT16 channel_id) +BOOL freerdp_channel_process(freerdp* instance, STREAM* s, UINT16 channel_id) { UINT32 length; UINT32 flags; int chunk_length; + if(stream_get_left(s) < 4) + return FALSE; stream_read_UINT32(s, length); stream_read_UINT32(s, flags); chunk_length = stream_get_left(s); IFCALL(instance->ReceiveChannelData, instance, channel_id, stream_get_tail(s), chunk_length, flags, length); + return TRUE; } -void freerdp_channel_peer_process(freerdp_peer* client, STREAM* s, UINT16 channel_id) +BOOL freerdp_channel_peer_process(freerdp_peer* client, STREAM* s, UINT16 channel_id) { UINT32 length; UINT32 flags; int chunk_length; + if(stream_get_left(s) < 8) + return FALSE; stream_read_UINT32(s, length); stream_read_UINT32(s, flags); chunk_length = stream_get_left(s); IFCALL(client->ReceiveChannelData, client, channel_id, stream_get_tail(s), chunk_length, flags, length); + return TRUE; } diff --git a/libfreerdp/core/channel.h b/libfreerdp/core/channel.h index 0e8d8fe3a..7956873bf 100644 --- a/libfreerdp/core/channel.h +++ b/libfreerdp/core/channel.h @@ -21,7 +21,7 @@ #define __CHANNEL_H BOOL freerdp_channel_send(rdpRdp* rdp, UINT16 channel_id, BYTE* data, int size); -void freerdp_channel_process(freerdp* instance, STREAM* s, UINT16 channel_id); -void freerdp_channel_peer_process(freerdp_peer* client, STREAM* s, UINT16 channel_id); +BOOL freerdp_channel_process(freerdp* instance, STREAM* s, UINT16 channel_id); +BOOL freerdp_channel_peer_process(freerdp_peer* client, STREAM* s, UINT16 channel_id); #endif /* __CHANNEL_H */