From 7a245a5949116795325c1ef2ae29425cc778ab75 Mon Sep 17 00:00:00 2001 From: Armin Novak Date: Wed, 3 Jul 2024 15:36:37 +0200 Subject: [PATCH] [core,gateway] fix reading TSG strings The [MS-TSGU] 2.2.9.2.1.6 TSG_PACKET_QUARENC_RESPONSE::certChainLen represents the number of WCHAR not the size in bytes. --- libfreerdp/core/gateway/tsg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libfreerdp/core/gateway/tsg.c b/libfreerdp/core/gateway/tsg.c index 8101e5358..fdd010898 100644 --- a/libfreerdp/core/gateway/tsg.c +++ b/libfreerdp/core/gateway/tsg.c @@ -629,7 +629,9 @@ static BOOL tsg_ndr_read_quarenc_data(wLog* log, wStream* s, UINT32* index, if (quarenc->certChainLen > 0) { - if (!tsg_ndr_read_string(log, s, &quarenc->certChainData, quarenc->certChainLen)) + /* [MS-TSGU] 2.2.9.2.1.6 TSG_PACKET_QUARENC_RESPONSE::certChainLen number of WCHAR */ + if (!tsg_ndr_read_string(log, s, &quarenc->certChainData, + quarenc->certChainLen * sizeof(WCHAR))) return FALSE; /* 4-byte alignment */ if (!tsg_stream_align(log, s, 4))