morgan/FreeRDP
1
0
Fork 0
mirror of https://github.com/morgan9e/FreeRDP synced 2026-04-15 00:44:19 +09:00
Code Issues Packages Projects Releases Wiki Activity

Additional checks (#8279)

Browse Source 
* Fix length checks in parallel driver

The length requested was not checked against the length read from
the port.

* Fixed missing length check in video channel

Data received in video redirection channel was not checked for
proper length.

* Fixed video presentation reference counter

Video channel presentation reference counter was not updated with
Video_Frame_new. A failing H264 decoding step could trigger a reference
decrement and the presentation was freed by accident.
Also clean up the increment and decrement of presentation

* Fixed tsmf ffmpeg context extra data size checks

tsmf_ffmpeg_init_stream did not abort if the video format ExtraDataSize
was not sufficiently large to satisfy expectations.

* Fixed missing input data length check

tsmf_ifman_exchange_capability_request did not check if the input
data stream actually contained the amount of bytes requested to
copy.

* Fixed TSMF tsmf_ffmpeg_set_format length checks

ExtraDataSize of format was not checked for expected minimum length

* Fixed TSMF tsmf_read_format_type length checks

ExtraDataSize of format was not checked for expected minimum
length

* Fixed TSMF tsmf_gstreamer_set_format length checks

ExtraDataSize of format was not checked for expected minimum
length
This commit is contained in:
akallabeth
2022-10-06 15:30:54 +02:00
committed by GitHub
parent 229e047231
commit 26ac2f0b27
6 changed files with 84 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
channels/parallel/client/parallel_main.c
View File

@@ -157,7 +157,7 @@ static UINT parallel_process_irp_read(PARALLEL_DEVICE* parallel, IRP* irp)
return ERROR_INVALID_DATA;
Stream_Read_UINT32(irp->input, Length);
Stream_Read_UINT64(irp->input, Offset);
buffer = (BYTE*)malloc(Length);
buffer = (BYTE*)calloc(Length, sizeof(BYTE));
if (!buffer)
{
@@ -176,6 +176,7 @@ static UINT parallel_process_irp_read(PARALLEL_DEVICE* parallel, IRP* irp)
}
else
{
Length = status;
}
Stream_Write_UINT32(irp->output, Length);