mirrors/FreeRDP
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[codec,color] fix freerdp_image_fill

Browse Source 
in case width or height == 0 out of bounds write might happen.
reported by @pwn2carr
This commit is contained in:
Armin Novak 2023-08-04 16:42:05 +02:00 committed by Martin Fleisz
parent e204fc8be5
commit 9f967b4942
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libfreerdp/codec/color.c
View File

@ -754,7 +754,8 @@ BOOL freerdp_image_copy(BYTE* pDstData, DWORD DstFormat, UINT32 nDstStep, UINT32
BOOL freerdp_image_fill(BYTE* pDstData, DWORD DstFormat, UINT32 nDstStep, UINT32 nXDst, BOOL freerdp_image_fill(BYTE* pDstData, DWORD DstFormat, UINT32 nDstStep, UINT32 nXDst,
UINT32 nYDst, UINT32 nWidth, UINT32 nHeight, UINT32 color) UINT32 nYDst, UINT32 nWidth, UINT32 nHeight, UINT32 color)
{ {
UINT32 x, y; if ((nWidth == 0) || (nHeight == 0))
return TRUE;
const UINT32 bpp = FreeRDPGetBytesPerPixel(DstFormat); const UINT32 bpp = FreeRDPGetBytesPerPixel(DstFormat);
BYTE* pFirstDstLine; BYTE* pFirstDstLine;
BYTE* pFirstDstLineXOffset; BYTE* pFirstDstLineXOffset;
@ -765,13 +766,13 @@ BOOL freerdp_image_fill(BYTE* pDstData, DWORD DstFormat, UINT32 nDstStep, UINT32
pFirstDstLine = &pDstData[nYDst * nDstStep]; pFirstDstLine = &pDstData[nYDst * nDstStep];
pFirstDstLineXOffset = &pFirstDstLine[nXDst * bpp]; pFirstDstLineXOffset = &pFirstDstLine[nXDst * bpp];
for (x = 0; x < nWidth; x++) for (UINT32 x = 0; x < nWidth; x++)
{ {
BYTE* pDst = &pFirstDstLine[(x + nXDst) * bpp]; BYTE* pDst = &pFirstDstLine[(x + nXDst) * bpp];
FreeRDPWriteColor(pDst, DstFormat, color); FreeRDPWriteColor(pDst, DstFormat, color);
} }
for (y = 1; y < nHeight; y++) for (UINT32 y = 1; y < nHeight; y++)
{ {
BYTE* pDstLine = &pDstData[(y + nYDst) * nDstStep + nXDst * bpp]; BYTE* pDstLine = &pDstData[(y + nYDst) * nDstStep + nXDst * bpp];
memcpy(pDstLine, pFirstDstLineXOffset, nWidth * bpp * 1ULL); memcpy(pDstLine, pFirstDstLineXOffset, nWidth * bpp * 1ULL);