morgan/FreeRDP
1
0
Fork 0
mirror of https://github.com/morgan9e/FreeRDP synced 2026-04-15 00:44:19 +09:00
Code Issues Packages Projects Releases Wiki Activity

[allocations] fix growth of preallocated buffers

Browse Source 
* Replace * 2 with * sizeof(WCHAR) for string usages
* Grow streams and other buffers reasonably, e.g. add 128 elements per
  try and check for possible overflows
* Add constant postfix to force them to 64bit
This commit is contained in:
Armin Novak
2026-02-17 12:05:42 +01:00
parent fac35c3abb
commit 118afc0b95
28 changed files with 154 additions and 105 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
channels/drive/client/drive_file.c
View File

@@ -1052,7 +1052,7 @@ BOOL drive_file_query_directory(DRIVE_FILE* file, UINT32 FsInformationClass, BYT
else if (!FindNextFileW(file->find_handle, &file->find_data))
goto out_fail;
length = _wcslen(file->find_data.cFileName) * 2;
length = _wcslen(file->find_data.cFileName) * sizeof(WCHAR);
switch (FsInformationClass)
{

2
channels/remdesk/common/remdesk_common.c
View File

@@ -36,7 +36,7 @@ UINT remdesk_write_channel_header(wStream* s, const REMDESK_CHANNEL_HEADER* head
}
const size_t ChannelNameLen =
(strnlen(header->ChannelName, sizeof(header->ChannelName)) + 1) * 2;
(strnlen(header->ChannelName, sizeof(header->ChannelName)) + 1) * sizeof(WCHAR);
WINPR_ASSERT(ChannelNameLen <= ARRAYSIZE(header->ChannelName));
Stream_Write_UINT32(s, (UINT32)ChannelNameLen); /* ChannelNameLen (4 bytes) */

4
channels/remdesk/server/remdesk_main.c
View File

@@ -185,7 +185,7 @@ static UINT remdesk_recv_ctl_remote_control_desktop_pdu(RemdeskServerContext* co
return ERROR_INVALID_DATA;
cchStringW++;
const size_t cbRaConnectionStringW = cchStringW * 2;
const size_t cbRaConnectionStringW = cchStringW * sizeof(WCHAR);
pdu.raConnectionString =
ConvertWCharNToUtf8Alloc(raConnectionStringW, cbRaConnectionStringW / sizeof(WCHAR), NULL);
if (!pdu.raConnectionString)
@@ -240,7 +240,7 @@ static UINT remdesk_recv_ctl_authenticate_pdu(WINPR_ATTR_UNUSED RemdeskServerCon
return ERROR_INVALID_DATA;
cchStringW++;
const size_t cbExpertBlobW = cchStringW * 2;
const size_t cbExpertBlobW = cchStringW * sizeof(WCHAR);
pdu.raConnectionString =
ConvertWCharNToUtf8Alloc(raConnectionStringW, cbRaConnectionStringW / sizeof(WCHAR), NULL);
if (!pdu.raConnectionString)

4
channels/tsmf/client/ffmpeg/tsmf_ffmpeg.c
View File

@@ -488,12 +488,12 @@ static BOOL tsmf_ffmpeg_decode_audio(ITSMFDecoder* decoder, const BYTE* data, UI
if (mdecoder->decoded_size_max - mdecoder->decoded_size < MAX_AUDIO_FRAME_SIZE)
{
BYTE* tmp_data = NULL;
tmp_data = realloc(mdecoder->decoded_data, mdecoder->decoded_size_max * 2 + 16);
tmp_data = realloc(mdecoder->decoded_data, mdecoder->decoded_size_max * 2ull + 16ull);
if (!tmp_data)
return FALSE;
mdecoder->decoded_size_max = mdecoder->decoded_size_max * 2 + 16;
mdecoder->decoded_size_max = mdecoder->decoded_size_max * 2ull + 16ull;
mdecoder->decoded_data = tmp_data;
dst = (BYTE*)(((uintptr_t)mdecoder->decoded_data + 15) & ~0x0F);

2
channels/tsmf/client/tsmf_media.c
View File

@@ -387,7 +387,7 @@ static char* guid_to_string(const BYTE* guid, char* str, size_t len)
TSMF_PRESENTATION* tsmf_presentation_find_by_id(const BYTE* guid)
{
BOOL found = FALSE;
char guid_str[GUID_SIZE * 2 + 1] = { 0 };
char guid_str[GUID_SIZE * 2ull + 1] = { 0 };
TSMF_PRESENTATION* presentation = NULL;
ArrayList_Lock(presentation_list);
const size_t count = ArrayList_Count(presentation_list);

4
channels/urbdrc/client/libusb/libusb_udevice.c
View File

@@ -917,10 +917,10 @@ static UINT32 libusb_udev_control_query_device_text(IUDEVICE* idev, UINT32 TextT
* So also check the string length returned as server side does
* not honor strings with multi '\0' characters well.
*/
const size_t rchar = _wcsnlen((WCHAR*)&data[2], sizeof(data) / 2);
const size_t rchar = _wcsnlen((WCHAR*)&data[2], sizeof(data) / sizeof(WCHAR));
len = MIN((BYTE)ret - 2, slen);
len = MIN(len, inSize);
len = MIN(len, rchar * 2 + sizeof(WCHAR));
len = MIN(len, rchar * sizeof(WCHAR) + sizeof(WCHAR));
memcpy(Buffer, &data[2], len);
/* Just as above, the returned WCHAR string should be '\0'