Commit Graph

14515 Commits

Author SHA1 Message Date
akallabeth
eb1cf9a2ac Fixed broken const variable.
(cherry picked from commit 1c6a6923f8)
2020-06-22 12:13:31 +02:00
akallabeth
724ceade0f Reset freed HGDI_DC
CVE-2020-4031 thanks to @antonio-morales for finding this.

(cherry picked from commit f753c25ad3)
2020-06-22 12:13:20 +02:00
akallabeth
6780420343 Fixed out of bound read in RLEDECOMPRESS
CVE-2020-4033 thanks to @antonio-morales for finding this.

(cherry picked from commit 0a98c450c5)
2020-06-22 12:13:13 +02:00
akallabeth
12800786a8 Fixed OOB read in update_recv_secondary_order
CVE-2020-4032 thanks to @antonio-morales for finding this.

(cherry picked from commit e7bffa64ef)
2020-06-22 12:13:05 +02:00
akallabeth
ab18f07873 Fixed TrioParse and trio_length limts.
CVE-2020-4030 thanks to @antonio-morales for finding this.

(cherry picked from commit 05cd9ea229)
2020-06-22 12:12:56 +02:00
akallabeth
746d10179c Fixed OOB read in update_read_cache_bitmap_v3_order
CVE-2020-11096 thanks @antonio-morales for finding this.

(cherry picked from commit b8beb55913)
2020-06-22 12:12:50 +02:00
akallabeth
c687b8c267 Fixed invalid access in update_recv_primary_order
CVE-2020-11095 thanks @antonio-morales for finding this.

(cherry picked from commit 733ee32083)
2020-06-22 12:12:41 +02:00
akallabeth
ac9f5e8f5d Use localtime_s on windows
(cherry picked from commit c3a1ed780c)
2020-06-22 12:12:35 +02:00
akallabeth
32717ff9db Replaced gmtime with gmtime_r
(cherry picked from commit a45afe9db7)
2020-06-22 12:12:29 +02:00
akallabeth
23161efa62 Fixed codition with side effects
(cherry picked from commit 1a02af5a12)
2020-06-22 12:12:21 +02:00
akallabeth
69eef641d0 Fixed pcap cleanup
(cherry picked from commit 3ac7bb5d6a)
2020-06-22 12:12:14 +02:00
akallabeth
85b0354dfa Fixed double free
(cherry picked from commit 6d86e20e1e)
2020-06-22 12:12:08 +02:00
akallabeth
3606dfa921 Replaced getlogin with getlogin_r
(cherry picked from commit 36478d3d0b)
2020-06-22 12:12:02 +02:00
akallabeth
8c3f6d2b19 Replaced localtime with localtime_r
(cherry picked from commit 240fdd07b1)
2020-06-22 12:11:54 +02:00
akallabeth
efb99f144b Fixed memory leaks in ntlm
(cherry picked from commit 057b6df4ae)
2020-06-22 12:11:48 +02:00
akallabeth
d1da09f7e1 Fixed Out-of-bound read in glyph_cache_put
CVE-2020-11098 thanks to @antonio-morales for finding this.

(cherry picked from commit c0fd449ec0)
2020-06-22 12:11:41 +02:00
akallabeth
d5609e5467 Fixed OOB Read in license_read_new_or_upgrade_license_packet
CVE-2020-11099 thanks to @antonio-morales for finding this.

(cherry picked from commit 6ade7b4cbf)
2020-06-22 12:11:35 +02:00
Armin Novak
c3c02c83ab Respect SECBUFFER_READONLY flag in NTLM EncryptMessage
(cherry picked from commit 8e45a2dd50)
2020-06-22 09:31:07 +02:00
Armin Novak
da15d1a3a1 Added missing SECBUFFER_READONLY flag in rpc_client_write_call
(cherry picked from commit 0d80353bf3)
2020-06-22 09:31:02 +02:00
Armin Novak
2d166aea89 TSG improvements
* Respect connection timeout during connect
* Better debug output
* Cleaned up data types,

(cherry picked from commit ff79636d33)
2020-06-22 09:30:57 +02:00
akallabeth
4d6a800850 Fixed missing lock during buffer submit.
(cherry picked from commit c902f583d0)
2020-06-22 09:30:52 +02:00
Bernhard Miklautz
ecf172d881 Revert "winpr/library: Use RTLD_GLOBAL for dlopen"
Using RTLD_GLOBAL in LoadLibraryA introduces a different behavior than
expected.

This reverts commit d566e00258.

(cherry picked from commit 529e30c273)
2020-06-22 09:30:46 +02:00
Bernhard Miklautz
7f2de8419a fix [client channels]: move exported API calls to client/common
The functions mappedGeometryRef and mappedGeometryUnref are API
functions ([1]) but were implemented in the geometry channel.
In case FreeRDP was built with BUILTIN_CHANNELS=OFF those functions
weren't available globally but used by the video channel.

Now the functions are fixed part of the freerdp-client library and
therefore available for all channels.

[1] exported in freerdp/client/geometry.h

Fixes #6236

(cherry picked from commit 1628939227)
2020-06-22 09:30:42 +02:00
akallabeth
f1e46894cb Fixed double free for uwac buffers
(cherry picked from commit 1bc48b058f)
2020-06-22 09:30:36 +02:00
akallabeth
809a86f0fb Lock wayland buffer updates
(cherry picked from commit 7361f75d11)
2020-06-22 09:30:15 +02:00
Kubistika
c0da1a959f server: proxy: cap plugin: fix var and func declaration
(cherry picked from commit 0cf764f170)
2020-06-22 09:29:45 +02:00
Kobi Mizrachi
f96a95aca5 server: proxy: implement session capture plugin
(cherry picked from commit 19809bf338)
2020-06-22 09:29:38 +02:00
Kobi Mizrachi
0dba34e642 winpr: image: add API to construct bmp header
(cherry picked from commit 920acd4c0e)
2020-06-22 09:29:32 +02:00
akallabeth
1e248ef7a2 Fixed compilation issue with shadow pam code
(cherry picked from commit e1e0f965e8)
2020-06-16 14:03:52 +02:00
akallabeth
9a13ba347d Fixed surface locking for shadow server.
(cherry picked from commit a38d6c53a6)
2020-06-16 11:42:55 +02:00
Armin Novak
b300c8a738 Do not remove transfer data on usb cancel transfer
(cherry picked from commit a5e2d62e48)
2020-06-16 11:20:18 +02:00
Armin Novak
fd42acc594 Fixed double free in urb_isoch_transfer_cb
(cherry picked from commit ef4de12887)
2020-06-16 11:20:18 +02:00
Armin Novak
192f922502 Fixed sign compare warnings with constants.
(cherry picked from commit 5ec66cc6c7)
2020-06-16 11:20:18 +02:00
makki_d
0121f726d8 fix +unmap-buttons option having the opposite effect
(cherry picked from commit 4607a2766a)
2020-06-16 11:19:41 +02:00
akallabeth
ab107eb640 Improve X11 shadow authentication reason failure log
(cherry picked from commit e66ee477c0)
2020-06-16 11:19:04 +02:00
Martin Fleisz
cb07d5a4f6 Fix usage of DsMakeSpn with IP address hostnames
(cherry picked from commit 4e7b60b002)
2020-06-16 09:09:33 +02:00
Patrick Chin
ab1c021b70 MessageQueue write time to current message not the next
(cherry picked from commit ea4df3f91a)
2020-06-16 09:09:22 +02:00
akallabeth
072b3d9a00 Fixed #6267: adjust write_pixel_16 endian handling
(cherry picked from commit 51d3e07c8a)
2020-06-16 09:09:11 +02:00
Kyle Evans
dd9c07ca61 uwac: don't try to use O_TMPFILE on FreeBSD
Currently, this sets an invalid open flag and attempts to open(), which
will fail.  Instead of doing that, don't try to define O_TMPFILE where
such a definition can't exist and force the fallback rather than making
an always-fail open() call.

(cherry picked from commit 082ddb3d2b)
2020-06-16 09:09:02 +02:00
Kubistika
66dfa56cc2 drdynvc: client: fix #6252 use-after-free
(cherry picked from commit 6ed765c960)
2020-06-16 09:08:52 +02:00
akallabeth
bc8ace351f Fixed formatting.
(cherry picked from commit d1b310d970)
2020-06-16 09:08:41 +02:00
Ondrej Holy
3f86260eaa smartcard: Teoretical fix of uninitialized values
This tries to fixes the following defects reported by covscan tool:
 - channels/smartcard/client/smartcard_operations.c:958: uninit_use_in_call: Using uninitialized value "ret.cReaders" when calling "smartcard_pack_locate_cards_return".
 - channels/smartcard/client/smartcard_operations.c:932: uninit_use_in_call: Using uninitialized value "ret.cReaders" when calling "smartcard_pack_locate_cards_return".

But I am not sure about it...

(cherry picked from commit 5345988352)
2020-06-16 09:08:34 +02:00
Ondrej Holy
5dbb255feb smartcard: Fix usage of uninitialized values
This fixes the following defect reported by covscan tool:
 - channels/smartcard/client/smartcard_pack.c:942: uninit_use_in_call: Using uninitialized value "tmp" when calling "ConvertFromUnicode".
 - channels/smartcard/client/smartcard_pack.c:894: uninit_use_in_call: Using uninitialized value "tmp" when calling "ConvertFromUnicode".
 - channels/smartcard/client/smartcard_pack.c:475: uninit_use_in_call: Using uninitialized value "tmp" when calling "ConvertFromUnicode".

(cherry picked from commit e70e25715f)
2020-06-16 09:08:28 +02:00
Ondrej Holy
9a7180cf90 wlfreerdp: Fix array overrun
This fixes the following defects reported by covscan tool:
 - client/Wayland/wlf_input.c:251: overrun-local: Overrunning array "contacts" of 10 32-byte elements at element index 10 (byte offset 351) using index "i" (which evaluates to 10).
 - client/Wayland/wlf_input.c:308: overrun-local: Overrunning array "contacts" of 10 32-byte elements at element index 10 (byte offset 351) using index "i" (which evaluates to 10).
 - client/Wayland/wlf_input.c:360: overrun-local: Overrunning array "contacts" of 10 32-byte elements at element index 10 (byte offset 351) using index "i" (which evaluates to 10).
 - client/Wayland/wlf_input.c:251: error[arrayIndexOutOfBounds]: Array 'contacts[10]' accessed at index 10, which is out of bounds.
 - client/Wayland/wlf_input.c:308: error[arrayIndexOutOfBounds]: Array 'contacts[10]' accessed at index 10, which is out of bounds.
 - client/Wayland/wlf_input.c:360: error[arrayIndexOutOfBounds]: Array 'contacts[10]' accessed at index 10, which is out of bounds.
 - client/Wayland/wlf_input.c:246: uninit_use_in_call: Using uninitialized value "y" when calling "wlf_scale_coordinates".
 - client/Wayland/wlf_input.c:246: uninit_use_in_call: Using uninitialized value "x" when calling "wlf_scale_coordinates".

The maximal number of touches can be higher then 10, see:
https://wayland.freedesktop.org/libinput/doc/latest/touchpads.html

Let's increse the MAX_CONTACTS count and add checks to prevent usage of
uninitialized values.

(cherry picked from commit 6ab79961ef)
2020-06-16 09:08:22 +02:00
Ondrej Holy
25ac571dd7 gdi: Fix missing unlock
This fixes the following defect reported by covscan tool:
libfreerdp/gdi/gfx.c:144: missing_unlock: Returning without unlocking "update->mux".

(cherry picked from commit 914808f62c)
2020-06-16 09:08:15 +02:00
Simon Tatham
dc735d3d36 [generate_argument_docbook] Fix typo in XML entity.
The character '>' was being rendered as < instead of >.

(cherry picked from commit 98930bf275)
2020-06-16 09:07:48 +02:00
Patrick Chin
fa647175cb Fix memory leaks in client/encomsp_main.c and client/remdesk_main.c
(cherry picked from commit 28e29f8ad5)
2020-06-16 09:07:37 +02:00
Armin Novak
39c5243247 Fixed #6245: Added additional tests to assistance parser
(cherry picked from commit 69141aa830)
2020-06-16 09:07:27 +02:00
Florian Staudacher
5491795588 report only actual bytes received, not allocated buffer size (interrupt produces data, timeout doesn't)
(cherry picked from commit 2e4f27ac9f)
2020-06-16 09:07:16 +02:00
akallabeth
d2c653baf3 Lock remaining occurances of security_encrypt/security_decrypt variables
(cherry picked from commit f01ae7d257)
2020-06-16 09:07:04 +02:00