mirrors/xrdp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

coverity: fixed out of bounds read-write

Browse Source
This commit is contained in:
Laxmikant Rashinkar 2014-07-20 11:11:20 -07:00
parent ccd75bd4cd
commit 023c0b5bc1
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
rdp/rdp_rdp.c
View File

@ -427,6 +427,12 @@ rdp_rdp_process_color_pointer_pdu(struct rdp_rdp *self, struct stream *s)
return 1;
}
/* there are only 32 cursors */
if (cache_idx > 31)
{
return 1;
}
cursor = self->cursors + cache_idx;
in_uint16_le(s, cursor->x);
in_uint16_le(s, cursor->y);
@ -457,7 +463,7 @@ rdp_rdp_process_cached_pointer_pdu(struct rdp_rdp *self, struct stream *s)
in_uint16_le(s, cache_idx);
if (cache_idx >= sizeof(self->cursors) / sizeof(cursor))
if (cache_idx > 31)
{
return 1;
}

7
sesman/chansrv/clipboard.c
View File

@ -1048,8 +1048,11 @@ clipboard_process_format_announce(struct stream *s, int clip_msg_status,
log_debug("clipboard_process_format_announce: formatId 0x%8.8x "
"wszFormatName [%s] clip_msg_len %d", formatId, desc,
clip_msg_len);
g_formatIds[g_num_formatIds] = formatId;
g_num_formatIds++;
if (g_num_formatIds <= 15)
{
g_formatIds[g_num_formatIds] = formatId;
g_num_formatIds++;
}
if (g_num_formatIds > 15)
{
log_debug("clipboard_process_format_announce: max formats");