mirrors/xrdp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

VUL: check bytes remaining in xrdp_rdp_process_data_input

Browse Source
This commit is contained in:
Jay Sorg 2013-09-10 11:28:30 -07:00
parent 7ea609e91a
commit 64e2291274
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libxrdp/xrdp_rdp.c
View File

@ -1237,11 +1237,19 @@ xrdp_rdp_process_data_input(struct xrdp_rdp* self, struct stream* s)
int param2; int param2;
int time; int time;
if (!s_check_rem(s, 4))
{
return 1;
}
in_uint16_le(s, num_events); in_uint16_le(s, num_events);
in_uint8s(s, 2); /* pad */ in_uint8s(s, 2); /* pad */
DEBUG(("in xrdp_rdp_process_data_input %d events", num_events)); DEBUG(("in xrdp_rdp_process_data_input %d events", num_events));
for (index = 0; index < num_events; index++) for (index = 0; index < num_events; index++)
{ {
if (!s_check_rem(s, 12))
{
return 1;
}
in_uint32_le(s, time); in_uint32_le(s, time);
in_uint16_le(s, msg_type); in_uint16_le(s, msg_type);
in_uint16_le(s, device_flags); in_uint16_le(s, device_flags);