mirrors/FreeRDP
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed oob read in parallel_process_irp_read

Browse Source
This commit is contained in:
akallabeth 2020-04-15 17:06:35 +02:00
parent 917daa8b56
commit 6efa8290d8
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
channels/parallel/client/parallel_main.c
View File

@ -149,6 +149,8 @@ static UINT parallel_process_irp_read(PARALLEL_DEVICE* parallel, IRP* irp)
UINT64 Offset; UINT64 Offset;
ssize_t status; ssize_t status;
BYTE* buffer = NULL; BYTE* buffer = NULL;
if (Stream_GetRemainingLength(irp->input) < 12)
return ERROR_INVALID_DATA;
Stream_Read_UINT32(irp->input, Length); Stream_Read_UINT32(irp->input, Length);
Stream_Read_UINT64(irp->input, Offset); Stream_Read_UINT64(irp->input, Offset);
buffer = (BYTE*)malloc(Length); buffer = (BYTE*)malloc(Length);