morgan/FreeRDP
1
0
Fork 0
mirror of https://github.com/morgan9e/FreeRDP synced 2026-04-15 00:44:19 +09:00
Code Issues Packages Projects Releases Wiki Activity

[codec,clear] check clear_decomress glyphData

Browse Source 
Check destination coordinates and lengths against the actual sizes. Log
every truncation accordingly
This commit is contained in:
akallabeth
2026-01-16 12:22:46 +01:00
parent 9f0eb3b7d4
commit 243ecf804b
1 changed files with 48 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
libfreerdp/codec/clear.c
View File

@@ -1139,8 +1139,54 @@ INT32 clear_decompress(CLEAR_CONTEXT* WINPR_RESTRICT clear, const BYTE* WINPR_RE
if (glyphData)
{
const uint32_t w = MIN(nWidth, nDstWidth);
const uint32_t h = MIN(nHeight, nDstHeight);
uint32_t w = MIN(nWidth, nDstWidth);
if (nXDst > nDstWidth)
{
WLog_WARN(TAG, "glyphData copy area x exceeds destination: x=%" PRIu32 " > %" PRIu32,
nXDst, nDstWidth);
w = 0;
}
else if (nXDst + w > nDstWidth)
{
WLog_WARN(TAG,
"glyphData copy area x + width exceeds destination: x=%" PRIu32 " + %" PRIu32
" > %" PRIu32,
nXDst, w, nDstWidth);
w = nDstWidth - nXDst;
}
if (w != nWidth)
{
WLog_WARN(TAG,
"glyphData copy area width truncated: requested=%" PRIu32
", truncated to %" PRIu32,
nWidth, w);
}
uint32_t h = MIN(nHeight, nDstHeight);
if (nYDst > nDstHeight)
{
WLog_WARN(TAG, "glyphData copy area y exceeds destination: y=%" PRIu32 " > %" PRIu32,
nYDst, nDstHeight);
h = 0;
}
else if (nYDst + h > nDstHeight)
{
WLog_WARN(TAG,
"glyphData copy area y + height exceeds destination: x=%" PRIu32 " + %" PRIu32
" > %" PRIu32,
nYDst, h, nDstHeight);
h = nDstHeight - nYDst;
}
if (h != nHeight)
{
WLog_WARN(TAG,
"glyphData copy area height truncated: requested=%" PRIu32
", truncated to %" PRIu32,
nHeight, h);
}
if (!freerdp_image_copy_no_overlap(glyphData, clear->format, 0, 0, 0, w, h, pDstData,
DstFormat, nDstStep, nXDst, nYDst, palette,
FREERDP_KEEP_DST_ALPHA))