morgan/FreeRDP
1
0
Fork 0
mirror of https://github.com/morgan9e/FreeRDP synced 2026-04-15 00:44:19 +09:00
Code Issues Packages Projects Releases Wiki Activity

[out-of-bounds] fix oob reads

Browse Source
This commit is contained in:
akallabeth
2025-03-11 09:24:02 +01:00
parent 7e0e62c5ce
commit 3d9dcaece7
3 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libfreerdp/core/gateway/rpc_client.c
View File

@@ -1116,7 +1116,7 @@ BOOL rpc_client_write_call(rdpRpc* rpc, wStream* s, UINT16 opnum)
CopyMemory(&buffer[offset], &request_pdu.auth_verifier.auth_type, 8); CopyMemory(&buffer[offset], &request_pdu.auth_verifier.auth_type, 8);
offset += 8; offset += 8;
if (offset > UINT32_MAX) if (offset > request_pdu.header.frag_length)
goto fail; goto fail;
plaintext.pvBuffer = buffer; plaintext.pvBuffer = buffer;

2
uwac/libuwac/uwac-clipboard.c
View File

@@ -256,7 +256,7 @@ void* UwacClipboardDataGet(UwacSeat* seat, const char* mime, size_t* size)
data = tmp; data = tmp;
if (pos > alloc) if (pos >= alloc)
goto fail; goto fail;
r = read(pipefd[0], &data[pos], alloc - pos); r = read(pipefd[0], &data[pos], alloc - pos);

1
winpr/libwinpr/utils/ini.c
View File

@@ -181,6 +181,7 @@ static BOOL IniFile_Load_File(wIniFile* ini, const char* filename)
goto out_file; goto out_file;
ini->buffer[fileSize] = '\n'; ini->buffer[fileSize] = '\n';
ini->buffer[fileSize + 1] = '\0';
IniFile_Load_NextLine(ini, ini->buffer); IniFile_Load_NextLine(ini, ini->buffer);
rc = TRUE; rc = TRUE;