From 3fe9363592b8ef109014830a1887d25bdc7460d0 Mon Sep 17 00:00:00 2001
From: akallabeth <akallabeth@posteo.net>
Date: Tue, 23 Apr 2024 15:54:49 +0200
Subject: [PATCH] [core,capabilities] abort on invalid protocolVersion

* TS_GENERAL_CAPABILITYSET::protocolVersion must be
  TS_CAPS_PROTOCOLVERSION(0x200) see [MS-RDPBCGR] 2.2.7.1.1
  General Capability Set (TS_GENERAL_CAPABILITYSET)
* Default value of FreeRDP_CapsProtocolVersion must be
  TS_CAPS_PROTOCOLVERSION(0x200)
---
 include/freerdp/settings_types.h |  3 +++
 libfreerdp/core/capabilities.c   | 16 ++++++++++++++++
 libfreerdp/core/settings.c       |  4 ++++
 3 files changed, 23 insertions(+)

diff --git a/include/freerdp/settings_types.h b/include/freerdp/settings_types.h
index ef489e3b9..cf4780252 100644
--- a/include/freerdp/settings_types.h
+++ b/include/freerdp/settings_types.h
@@ -239,6 +239,9 @@ extern "C"
 #define MSTSC_COOKIE_MAX_LENGTH 9
 #define DEFAULT_COOKIE_MAX_LENGTH 0xFF
 
+	/* General capability set */
+#define TS_CAPS_PROTOCOLVERSION 0x200
+
 /* Order Support */
 #define NEG_DSTBLT_INDEX 0x00
 #define NEG_PATBLT_INDEX 0x01
diff --git a/libfreerdp/core/capabilities.c b/libfreerdp/core/capabilities.c
index 0762e30d7..c8336bd4d 100644
--- a/libfreerdp/core/capabilities.c
+++ b/libfreerdp/core/capabilities.c
@@ -211,6 +211,14 @@ static BOOL rdp_read_general_capability_set(wStream* s, rdpSettings* settings)
 	Stream_Read_UINT16(s, settings->OsMinorType); /* osMinorType (2 bytes) */
 
 	Stream_Read_UINT16(s, settings->CapsProtocolVersion); /* protocolVersion (2 bytes) */
+	if (settings->CapsProtocolVersion != TS_CAPS_PROTOCOLVERSION)
+	{
+		WLog_ERR(TAG,
+		         "TS_GENERAL_CAPABILITYSET::protocolVersion(0x%04" PRIx16
+		         ") != TS_CAPS_PROTOCOLVERSION(0x%04" PRIx32 ")",
+		         settings->CapsProtocolVersion, TS_CAPS_PROTOCOLVERSION);
+		return FALSE;
+	}
 	Stream_Seek_UINT16(s);                                /* pad2OctetsA (2 bytes) */
 	Stream_Read_UINT16(
 	    s, settings->CapsGeneralCompressionTypes); /* generalCompressionTypes (2 bytes) */
@@ -271,6 +279,14 @@ static BOOL rdp_write_general_capability_set(wStream* s, const rdpSettings* sett
 		         settings->OsMajorType, settings->OsMinorType, UINT16_MAX);
 		return FALSE;
 	}
+	if (settings->CapsProtocolVersion != TS_CAPS_PROTOCOLVERSION)
+	{
+		WLog_ERR(TAG,
+		         "TS_GENERAL_CAPABILITYSET::protocolVersion(0x%04" PRIx16
+		         ") != TS_CAPS_PROTOCOLVERSION(0x%04" PRIx32 ")",
+		         settings->CapsProtocolVersion, TS_CAPS_PROTOCOLVERSION);
+		return FALSE;
+	}
 	Stream_Write_UINT16(s, (UINT16)settings->OsMajorType); /* osMajorType (2 bytes) */
 	Stream_Write_UINT16(s, (UINT16)settings->OsMinorType); /* osMinorType (2 bytes) */
 	Stream_Write_UINT16(s, settings->CapsProtocolVersion); /* protocolVersion (2 bytes) */
diff --git a/libfreerdp/core/settings.c b/libfreerdp/core/settings.c
index d1ff61234..23bd2e51c 100644
--- a/libfreerdp/core/settings.c
+++ b/libfreerdp/core/settings.c
@@ -361,6 +361,10 @@ rdpSettings* freerdp_settings_new(DWORD flags)
 	if (!settings)
 		return NULL;
 
+	if (!freerdp_settings_set_uint16(settings, FreeRDP_CapsProtocolVersion,
+	                                 TS_CAPS_PROTOCOLVERSION))
+		goto out_fail;
+
 	if (!freerdp_settings_set_uint32(settings, FreeRDP_ClipboardFeatureMask,
 	                                 CLIPRDR_FLAG_DEFAULT_MASK))
 		goto out_fail;