mirrors/FreeRDP
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[core,info] ensure stream length

Browse Source 
ensure the stream is large enough for all info packets
This commit is contained in:
Armin Novak 2022-12-14 10:43:07 +01:00 committed by Pascal Nowack
parent 8af5f15769
commit 87ae9dec0d
2 changed files with 62 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
libfreerdp/core/info.c
View File

@ -253,13 +253,23 @@ static BOOL rdp_read_client_auto_reconnect_cookie(rdpRdp* rdp, wStream* s)
* msdn{cc240541} * msdn{cc240541}
*/ */
static void rdp_write_client_auto_reconnect_cookie(rdpRdp* rdp, wStream* s) static BOOL rdp_write_client_auto_reconnect_cookie(rdpRdp* rdp, wStream* s)
{ {
BYTE* p; BYTE* p;
ARC_CS_PRIVATE_PACKET* autoReconnectCookie; ARC_CS_PRIVATE_PACKET* autoReconnectCookie;
rdpSettings* settings = rdp->settings; rdpSettings* settings;
WINPR_ASSERT(rdp);
settings = rdp->settings;
WINPR_ASSERT(settings);
autoReconnectCookie = settings->ClientAutoReconnectCookie; autoReconnectCookie = settings->ClientAutoReconnectCookie;
WINPR_ASSERT(autoReconnectCookie);
p = autoReconnectCookie->securityVerifier; p = autoReconnectCookie->securityVerifier;
WINPR_ASSERT(p);
WLog_DBG(TAG, WLog_DBG(TAG,
"ClientAutoReconnectCookie: Version: %" PRIu32 " LogonId: %" PRIu32 " ArcRandomBits: " "ClientAutoReconnectCookie: Version: %" PRIu32 " LogonId: %" PRIu32 " ArcRandomBits: "
"%02" PRIX8 "%02" PRIX8 "%02" PRIX8 "%02" PRIX8 "%02" PRIX8 "%02" PRIX8 "%02" PRIX8 "%02" PRIX8 "%02" PRIX8 "%02" PRIX8 "%02" PRIX8 "%02" PRIX8 "%02" PRIX8 "%02" PRIX8
@ -268,10 +278,13 @@ static void rdp_write_client_auto_reconnect_cookie(rdpRdp* rdp, wStream* s)
"%02" PRIX8 "", "%02" PRIX8 "",
autoReconnectCookie->version, autoReconnectCookie->logonId, p[0], p[1], p[2], p[3], autoReconnectCookie->version, autoReconnectCookie->logonId, p[0], p[1], p[2], p[3],
p[4], p[5], p[6], p[7], p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]); p[4], p[5], p[6], p[7], p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15]);
if (!Stream_EnsureRemainingCapacity(s, 12ull + 16ull))
return FALSE;
Stream_Write_UINT32(s, autoReconnectCookie->cbLen); /* cbLen (4 bytes) */ Stream_Write_UINT32(s, autoReconnectCookie->cbLen); /* cbLen (4 bytes) */
Stream_Write_UINT32(s, autoReconnectCookie->version); /* version (4 bytes) */ Stream_Write_UINT32(s, autoReconnectCookie->version); /* version (4 bytes) */
Stream_Write_UINT32(s, autoReconnectCookie->logonId); /* LogonId (4 bytes) */ Stream_Write_UINT32(s, autoReconnectCookie->logonId); /* LogonId (4 bytes) */
Stream_Write(s, autoReconnectCookie->securityVerifier, 16); /* SecurityVerifier (16 bytes) */ Stream_Write(s, autoReconnectCookie->securityVerifier, 16); /* SecurityVerifier (16 bytes) */
return TRUE;
} }
/* /*
@ -502,6 +515,9 @@ static BOOL rdp_write_extended_info_packet(rdpRdp* rdp, wStream* s)
goto fail; goto fail;
cbAutoReconnectCookie = (UINT16)settings->ServerAutoReconnectCookie->cbLen; cbAutoReconnectCookie = (UINT16)settings->ServerAutoReconnectCookie->cbLen;
if (!Stream_EnsureRemainingCapacity(s, 4ull + cbClientAddress + 2ull + cbClientDir))
goto fail;
Stream_Write_UINT16(s, clientAddressFamily); /* clientAddressFamily (2 bytes) */ Stream_Write_UINT16(s, clientAddressFamily); /* clientAddressFamily (2 bytes) */
Stream_Write_UINT16(s, cbClientAddress); /* cbClientAddress (2 bytes) */ Stream_Write_UINT16(s, cbClientAddress); /* cbClientAddress (2 bytes) */
@ -514,6 +530,9 @@ static BOOL rdp_write_extended_info_packet(rdpRdp* rdp, wStream* s)
if (!rdp_write_client_time_zone(s, settings)) /* clientTimeZone (172 bytes) */ if (!rdp_write_client_time_zone(s, settings)) /* clientTimeZone (172 bytes) */
goto fail; goto fail;
if (!Stream_EnsureRemainingCapacity(s, 10ull))
goto fail;
Stream_Write_UINT32( Stream_Write_UINT32(
s, settings->ClientSessionId); /* clientSessionId (4 bytes), should be set to 0 */ s, settings->ClientSessionId); /* clientSessionId (4 bytes), should be set to 0 */
freerdp_performance_flags_make(settings); freerdp_performance_flags_make(settings);
@ -524,7 +543,11 @@ static BOOL rdp_write_extended_info_packet(rdpRdp* rdp, wStream* s)
{ {
if (!rdp_compute_client_auto_reconnect_cookie(rdp)) if (!rdp_compute_client_auto_reconnect_cookie(rdp))
goto fail; goto fail;
rdp_write_client_auto_reconnect_cookie(rdp, s); /* autoReconnectCookie */ if (!rdp_write_client_auto_reconnect_cookie(rdp, s)) /* autoReconnectCookie */
goto fail;
if (!Stream_EnsureRemainingCapacity(s, 4ull))
goto fail;
Stream_Write_UINT16(s, 0); /* reserved1 (2 bytes) */ Stream_Write_UINT16(s, 0); /* reserved1 (2 bytes) */
Stream_Write_UINT16(s, 0); /* reserved2 (2 bytes) */ Stream_Write_UINT16(s, 0); /* reserved2 (2 bytes) */
} }

46
libfreerdp/core/timezone.c
View File

@ -20,6 +20,7 @@
#include <freerdp/config.h> #include <freerdp/config.h>
#include <winpr/crt.h> #include <winpr/crt.h>
#include <winpr/assert.h>
#include <winpr/timezone.h> #include <winpr/timezone.h>
#include "timezone.h" #include "timezone.h"
@ -27,8 +28,8 @@
#include <freerdp/log.h> #include <freerdp/log.h>
#define TAG FREERDP_TAG("core.timezone") #define TAG FREERDP_TAG("core.timezone")
static void rdp_read_system_time(wStream* s, SYSTEMTIME* system_time); static BOOL rdp_read_system_time(wStream* s, SYSTEMTIME* system_time);
static void rdp_write_system_time(wStream* s, SYSTEMTIME* system_time); static BOOL rdp_write_system_time(wStream* s, const SYSTEMTIME* system_time);
/** /**
* Read SYSTEM_TIME structure (TS_SYSTEMTIME). * Read SYSTEM_TIME structure (TS_SYSTEMTIME).
@ -37,8 +38,13 @@ static void rdp_write_system_time(wStream* s, SYSTEMTIME* system_time);
* @param system_time system time structure * @param system_time system time structure
*/ */
void rdp_read_system_time(wStream* s, SYSTEMTIME* system_time) BOOL rdp_read_system_time(wStream* s, SYSTEMTIME* system_time)
{ {
WINPR_ASSERT(system_time);
if (!Stream_CheckAndLogRequiredLength(TAG, s, 16ull))
return FALSE;
Stream_Read_UINT16(s, system_time->wYear); /* wYear, must be set to 0 */ Stream_Read_UINT16(s, system_time->wYear); /* wYear, must be set to 0 */
Stream_Read_UINT16(s, system_time->wMonth); /* wMonth */ Stream_Read_UINT16(s, system_time->wMonth); /* wMonth */
Stream_Read_UINT16(s, system_time->wDayOfWeek); /* wDayOfWeek */ Stream_Read_UINT16(s, system_time->wDayOfWeek); /* wDayOfWeek */
@ -47,6 +53,7 @@ void rdp_read_system_time(wStream* s, SYSTEMTIME* system_time)
Stream_Read_UINT16(s, system_time->wMinute); /* wMinute */ Stream_Read_UINT16(s, system_time->wMinute); /* wMinute */
Stream_Read_UINT16(s, system_time->wSecond); /* wSecond */ Stream_Read_UINT16(s, system_time->wSecond); /* wSecond */
Stream_Read_UINT16(s, system_time->wMilliseconds); /* wMilliseconds */ Stream_Read_UINT16(s, system_time->wMilliseconds); /* wMilliseconds */
return TRUE;
} }
/** /**
@ -56,8 +63,12 @@ void rdp_read_system_time(wStream* s, SYSTEMTIME* system_time)
* @param system_time system time structure * @param system_time system time structure
*/ */
void rdp_write_system_time(wStream* s, SYSTEMTIME* system_time) BOOL rdp_write_system_time(wStream* s, const SYSTEMTIME* system_time)
{ {
WINPR_ASSERT(system_time);
if (!Stream_EnsureRemainingCapacity(s, 16ull))
return FALSE;
Stream_Write_UINT16(s, system_time->wYear); /* wYear, must be set to 0 */ Stream_Write_UINT16(s, system_time->wYear); /* wYear, must be set to 0 */
Stream_Write_UINT16(s, system_time->wMonth); /* wMonth */ Stream_Write_UINT16(s, system_time->wMonth); /* wMonth */
Stream_Write_UINT16(s, system_time->wDayOfWeek); /* wDayOfWeek */ Stream_Write_UINT16(s, system_time->wDayOfWeek); /* wDayOfWeek */
@ -71,6 +82,7 @@ void rdp_write_system_time(wStream* s, SYSTEMTIME* system_time)
system_time->wYear, system_time->wMonth, system_time->wDayOfWeek, system_time->wYear, system_time->wMonth, system_time->wDayOfWeek,
system_time->wDay, system_time->wHour, system_time->wMinute, system_time->wDay, system_time->wHour, system_time->wMinute,
system_time->wSecond, system_time->wMilliseconds); system_time->wSecond, system_time->wMilliseconds);
return TRUE;
} }
/** /**
@ -84,7 +96,7 @@ void rdp_write_system_time(wStream* s, SYSTEMTIME* system_time)
BOOL rdp_read_client_time_zone(wStream* s, rdpSettings* settings) BOOL rdp_read_client_time_zone(wStream* s, rdpSettings* settings)
{ {
LPTIME_ZONE_INFORMATION tz; LPTIME_ZONE_INFORMATION tz = { 0 };
if (!s || !settings) if (!s || !settings)
return FALSE; return FALSE;
@ -100,11 +112,13 @@ BOOL rdp_read_client_time_zone(wStream* s, rdpSettings* settings)
Stream_Read_UINT32(s, tz->Bias); /* Bias */ Stream_Read_UINT32(s, tz->Bias); /* Bias */
/* standardName (64 bytes) */ /* standardName (64 bytes) */
Stream_Read(s, tz->StandardName, sizeof(tz->StandardName)); Stream_Read(s, tz->StandardName, sizeof(tz->StandardName));
rdp_read_system_time(s, &tz->StandardDate); /* StandardDate */ if (!rdp_read_system_time(s, &tz->StandardDate)) /* StandardDate */
return FALSE;
Stream_Read_UINT32(s, tz->StandardBias); /* StandardBias */ Stream_Read_UINT32(s, tz->StandardBias); /* StandardBias */
/* daylightName (64 bytes) */ /* daylightName (64 bytes) */
Stream_Read(s, tz->DaylightName, sizeof(tz->DaylightName)); Stream_Read(s, tz->DaylightName, sizeof(tz->DaylightName));
rdp_read_system_time(s, &tz->DaylightDate); /* DaylightDate */ if (!rdp_read_system_time(s, &tz->DaylightDate)) /* DaylightDate */
return FALSE;
Stream_Read_UINT32(s, tz->DaylightBias); /* DaylightBias */ Stream_Read_UINT32(s, tz->DaylightBias); /* DaylightBias */
return TRUE; return TRUE;
} }
@ -120,19 +134,26 @@ BOOL rdp_read_client_time_zone(wStream* s, rdpSettings* settings)
BOOL rdp_write_client_time_zone(wStream* s, rdpSettings* settings) BOOL rdp_write_client_time_zone(wStream* s, rdpSettings* settings)
{ {
LPTIME_ZONE_INFORMATION tz; LPTIME_ZONE_INFORMATION tz = { 0 };
WINPR_ASSERT(settings);
tz = settings->ClientTimeZone; tz = settings->ClientTimeZone;
if (!tz) if (!tz)
return FALSE; return FALSE;
GetTimeZoneInformation(tz); GetTimeZoneInformation(tz);
if (!Stream_EnsureRemainingCapacity(s, 4ull + sizeof(tz->StandardName)))
return FALSE;
/* Bias */ /* Bias */
Stream_Write_UINT32(s, tz->Bias); Stream_Write_UINT32(s, tz->Bias);
/* standardName (64 bytes) */ /* standardName (64 bytes) */
Stream_Write(s, tz->StandardName, sizeof(tz->StandardName)); Stream_Write(s, tz->StandardName, sizeof(tz->StandardName));
/* StandardDate */ /* StandardDate */
rdp_write_system_time(s, &tz->StandardDate); if (!rdp_write_system_time(s, &tz->StandardDate))
return FALSE;
#ifdef WITH_DEBUG_TIMEZONE #ifdef WITH_DEBUG_TIMEZONE
WLog_DBG(TIMEZONE_TAG, "bias=%" PRId32 "", tz->Bias); WLog_DBG(TIMEZONE_TAG, "bias=%" PRId32 "", tz->Bias);
WLog_DBG(TIMEZONE_TAG, "StandardName:"); WLog_DBG(TIMEZONE_TAG, "StandardName:");
@ -144,14 +165,19 @@ BOOL rdp_write_client_time_zone(wStream* s, rdpSettings* settings)
#endif #endif
/* Note that StandardBias is ignored if no valid standardDate is provided. */ /* Note that StandardBias is ignored if no valid standardDate is provided. */
/* StandardBias */ /* StandardBias */
if (!Stream_EnsureRemainingCapacity(s, 4ull + sizeof(tz->DaylightName)))
return FALSE;
Stream_Write_UINT32(s, tz->StandardBias); Stream_Write_UINT32(s, tz->StandardBias);
DEBUG_TIMEZONE("StandardBias=%" PRId32 "", tz->StandardBias); DEBUG_TIMEZONE("StandardBias=%" PRId32 "", tz->StandardBias);
/* daylightName (64 bytes) */ /* daylightName (64 bytes) */
Stream_Write(s, tz->DaylightName, sizeof(tz->DaylightName)); Stream_Write(s, tz->DaylightName, sizeof(tz->DaylightName));
/* DaylightDate */ /* DaylightDate */
rdp_write_system_time(s, &tz->DaylightDate); if (!rdp_write_system_time(s, &tz->DaylightDate))
return FALSE;
/* Note that DaylightBias is ignored if no valid daylightDate is provided. */ /* Note that DaylightBias is ignored if no valid daylightDate is provided. */
/* DaylightBias */ /* DaylightBias */
if (!Stream_EnsureRemainingCapacity(s, 4ull))
return FALSE;
Stream_Write_UINT32(s, tz->DaylightBias); Stream_Write_UINT32(s, tz->DaylightBias);
DEBUG_TIMEZONE("DaylightBias=%" PRId32 "", tz->DaylightBias); DEBUG_TIMEZONE("DaylightBias=%" PRId32 "", tz->DaylightBias);
return TRUE; return TRUE;