morgan/FreeRDP
1
0
Fork 0
mirror of https://github.com/morgan9e/FreeRDP synced 2026-04-15 00:44:19 +09:00
Code Issues Packages Projects Releases Wiki Activity

[stream] use logging capacity checks

Browse Source
This commit is contained in:
akallabeth
2023-01-24 12:19:56 +01:00
committed by akallabeth
parent b6648288e4
commit 8ed37e68d2
14 changed files with 60 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
channels/audin/client/audin_main.c
View File

@@ -568,7 +568,7 @@ static UINT audin_on_data_received(IWTSVirtualChannelCallback* pChannelCallback,
if (!audin)
return ERROR_INTERNAL_ERROR;
if (Stream_GetRemainingCapacity(data) < 1)
if (!Stream_CheckAndLogRequiredCapacity(TAG, data, 1))
return ERROR_NO_DATA;
Stream_Read_UINT8(data, MessageId);

6
channels/urbdrc/common/msusb.c
View File

@@ -64,7 +64,7 @@ static MSUSB_PIPE_DESCRIPTOR** msusb_mspipes_read(wStream* s, UINT32 NumberOfPip
UINT32 pnum;
MSUSB_PIPE_DESCRIPTOR** MsPipes;
if (Stream_GetRemainingCapacity(s) / 12 < NumberOfPipes)
if (!Stream_CheckAndLogRequiredCapacityOfSize(TAG, (s), NumberOfPipes, 12ull))
return NULL;
MsPipes = (MSUSB_PIPE_DESCRIPTOR**)calloc(NumberOfPipes, sizeof(MSUSB_PIPE_DESCRIPTOR*));
@@ -149,7 +149,7 @@ MSUSB_INTERFACE_DESCRIPTOR* msusb_msinterface_read(wStream* s)
{
MSUSB_INTERFACE_DESCRIPTOR* MsInterface;
if (Stream_GetRemainingCapacity(s) < 12)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 12))
return NULL;
MsInterface = msusb_msinterface_new();
@@ -317,7 +317,7 @@ MSUSB_CONFIG_DESCRIPTOR* msusb_msconfig_read(wStream* s, UINT32 NumInterfaces)
MSUSB_CONFIG_DESCRIPTOR* MsConfig;
BYTE lenConfiguration, typeConfiguration;
if (Stream_GetRemainingCapacity(s) < 6ULL + NumInterfaces * 2ULL)
if (!Stream_CheckAndLogRequiredCapacityOfSize(TAG, (s), 3ULL + NumInterfaces, 2ULL))
return NULL;
MsConfig = msusb_msconfig_new();

14
libfreerdp/core/activation.c
View File

@@ -34,7 +34,7 @@ static BOOL rdp_write_synchronize_pdu(wStream* s, const rdpSettings* settings)
{
const UINT32 PduSource = freerdp_settings_get_uint32(settings, FreeRDP_PduSource);
if (Stream_GetRemainingCapacity(s) < 4)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 4))
return FALSE;
Stream_Write_UINT16(s, SYNCMSGTYPE_SYNC); /* messageType (2 bytes) */
Stream_Write_UINT16(s, PduSource); /* targetUser (2 bytes) */
@@ -129,7 +129,7 @@ static BOOL rdp_write_client_control_pdu(wStream* s, UINT16 action, UINT16 grant
UINT32 controlId)
{
WINPR_ASSERT(s);
if (Stream_GetRemainingCapacity(s) < 8)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 8))
return FALSE;
Stream_Write_UINT16(s, action); /* action (2 bytes) */
Stream_Write_UINT16(s, grantId); /* grantId (2 bytes) */
@@ -172,7 +172,7 @@ BOOL rdp_send_server_control_cooperate_pdu(rdpRdp* rdp)
wStream* s = rdp_data_pdu_init(rdp);
if (!s)
return FALSE;
if (Stream_GetRemainingCapacity(s) < 8)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 8))
{
Stream_Free(s, TRUE);
return FALSE;
@@ -190,7 +190,7 @@ static BOOL rdp_send_server_control_granted_pdu(rdpRdp* rdp)
wStream* s = rdp_data_pdu_init(rdp);
if (!s)
return FALSE;
if (Stream_GetRemainingCapacity(s) < 8)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 8))
{
Stream_Free(s, TRUE);
return FALSE;
@@ -487,7 +487,7 @@ static BOOL rdp_write_client_font_list_pdu(wStream* s, UINT16 flags)
{
WINPR_ASSERT(s);
if (Stream_GetRemainingCapacity(s) < 8)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 8))
return FALSE;
Stream_Write_UINT16(s, 0); /* numberFonts (2 bytes) */
Stream_Write_UINT16(s, 0); /* totalNumFonts (2 bytes) */
@@ -565,7 +565,7 @@ BOOL rdp_send_server_font_map_pdu(rdpRdp* rdp)
wStream* s = rdp_data_pdu_init(rdp);
if (!s)
return FALSE;
if (Stream_GetRemainingCapacity(s) < 8)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 8))
{
Stream_Free(s, TRUE);
return FALSE;
@@ -638,7 +638,7 @@ BOOL rdp_send_deactivate_all(rdpRdp* rdp)
if (!s)
return FALSE;
if (Stream_GetRemainingCapacity(s) < 7)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 7))
goto fail;
WINPR_ASSERT(rdp->settings);

4
libfreerdp/core/capabilities.c
View File

@@ -131,7 +131,7 @@ static void rdp_write_capability_set_header(wStream* s, UINT16 length, UINT16 ty
static size_t rdp_capability_set_start(wStream* s)
{
size_t header = Stream_GetPosition(s);
if (Stream_GetRemainingCapacity(s) < CAPSET_HEADER_LENGTH)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), CAPSET_HEADER_LENGTH))
return SIZE_MAX;
Stream_Zero(s, CAPSET_HEADER_LENGTH);
return header;
@@ -3674,7 +3674,7 @@ BOOL rdp_print_capability_sets(wStream* s, size_t start, BOOL receiving)
}
else
{
if (Stream_GetRemainingCapacity(s) < 4)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 4))
goto fail;
}

14
libfreerdp/core/fastpath.c
View File

@@ -117,19 +117,19 @@ static BOOL fastpath_write_update_header(wStream* s, FASTPATH_UPDATE_HEADER* fpU
fpUpdateHeader->updateHeader |= (fpUpdateHeader->fragmentation & 0x03) << 4;
fpUpdateHeader->updateHeader |= (fpUpdateHeader->compression & 0x03) << 6;
if (Stream_GetRemainingCapacity(s) < 1)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 1))
return FALSE;
Stream_Write_UINT8(s, fpUpdateHeader->updateHeader);
if (fpUpdateHeader->compression)
{
if (Stream_GetRemainingCapacity(s) < 1)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 1))
return FALSE;
Stream_Write_UINT8(s, fpUpdateHeader->compressionFlags);
}
if (Stream_GetRemainingCapacity(s) < 2)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 2))
return FALSE;
Stream_Write_UINT16(s, fpUpdateHeader->size);
@@ -149,7 +149,7 @@ static BOOL fastpath_write_update_pdu_header(wStream* s,
if (!s || !fpUpdatePduHeader || !rdp)
return FALSE;
if (Stream_GetRemainingCapacity(s) < 3)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 3))
return FALSE;
fpUpdatePduHeader->fpOutputHeader = 0;
@@ -164,13 +164,13 @@ static BOOL fastpath_write_update_pdu_header(wStream* s,
WINPR_ASSERT(rdp->settings);
if (rdp->settings->EncryptionMethods == ENCRYPTION_METHOD_FIPS)
{
if (Stream_GetRemainingCapacity(s) < 4)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 4))
return FALSE;
Stream_Write(s, fpUpdatePduHeader->fipsInformation, 4);
}
if (Stream_GetRemainingCapacity(s) < 8)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 8))
return FALSE;
Stream_Write(s, fpUpdatePduHeader->dataSignature, 8);
@@ -1198,7 +1198,7 @@ BOOL fastpath_send_update_pdu(rdpFastPath* fastpath, BYTE updateCode, wStream* s
fastpath_write_update_pdu_header(fs, &fpUpdatePduHeader, rdp);
fastpath_write_update_header(fs, &fpUpdateHeader);
if (Stream_GetRemainingCapacity(fs) < (size_t)DstSize + pad)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (fs), (size_t)DstSize + pad))
return FALSE;
Stream_Write(fs, pDstData, DstSize);

2
libfreerdp/core/gateway/rts.c
View File

@@ -1319,7 +1319,7 @@ static BOOL rts_version_command_write(wStream* buffer)
{
WINPR_ASSERT(buffer);
if (Stream_GetRemainingCapacity(buffer) < 8)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (buffer), 8))
return FALSE;
Stream_Write_UINT32(buffer, RTS_CMD_VERSION); /* CommandType (4 bytes) */

8
libfreerdp/core/license.c
View File

@@ -463,12 +463,10 @@ static BOOL license_check_stream_capacity(wStream* s, size_t expect, const char*
{
WINPR_ASSERT(where);
if (Stream_GetRemainingCapacity(s) < expect)
{
WLog_WARN(TAG, "short capacity %s, expected %" PRIuz " bytes, got %" PRIuz, where, expect,
Stream_GetRemainingCapacity(s));
if (!Stream_CheckAndLogRequiredCapacityEx(TAG, WLOG_WARN, s, expect, 1, "%s(%s:%" PRIuz ") %s",
__FUNCTION__, __FILE__, __LINE__, where))
return FALSE;
}
return TRUE;
}

6
libfreerdp/core/rdp.c
View File

@@ -165,7 +165,7 @@ BOOL rdp_write_security_header(wStream* s, UINT16 flags)
{
WINPR_ASSERT(s);
if (Stream_GetRemainingCapacity(s) < 4)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 4))
return FALSE;
/* Basic Security Header */
@@ -239,7 +239,7 @@ BOOL rdp_write_share_control_header(wStream* s, UINT16 length, UINT16 type, UINT
if (length < RDP_PACKET_HEADER_MAX_LENGTH)
return FALSE;
if (Stream_GetRemainingCapacity(s) < 6)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 6))
return FALSE;
length -= RDP_PACKET_HEADER_MAX_LENGTH;
/* Share Control Header */
@@ -278,7 +278,7 @@ BOOL rdp_write_share_data_header(wStream* s, UINT16 length, BYTE type, UINT32 sh
if (length < headerLen)
return FALSE;
length -= headerLen;
if (Stream_GetRemainingCapacity(s) < 12)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 12))
return FALSE;
/* Share Data Header */

4
libfreerdp/core/tpdu.c
View File

@@ -116,7 +116,7 @@ BOOL tpdu_read_header(wStream* s, BYTE* code, BYTE* li, UINT16 tpktlength)
BOOL tpdu_write_header(wStream* s, UINT16 length, BYTE code)
{
if (Stream_GetRemainingCapacity(s) < 3)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 3))
return FALSE;
Stream_Write_UINT8(s, length); /* LI */
@@ -128,7 +128,7 @@ BOOL tpdu_write_header(wStream* s, UINT16 length, BYTE code)
}
else
{
if (Stream_GetRemainingCapacity(s) < 5)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 5))
return FALSE;
Stream_Write_UINT16(s, 0); /* DST-REF */
Stream_Write_UINT16(s, 0); /* SRC-REF */

2
libfreerdp/core/tpkt.c
View File

@@ -156,7 +156,7 @@ BOOL tpkt_ensure_stream_consumed_(wStream* s, UINT16 length, const char* fkt)
BOOL tpkt_write_header(wStream* s, UINT16 length)
{
if (Stream_GetRemainingCapacity(s) < 4)
if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 4))
return FALSE;
Stream_Write_UINT8(s, 3); /* version */
Stream_Write_UINT8(s, 0); /* reserved */

26
winpr/libwinpr/sspi/NTLM/ntlm_compute.c
View File

@@ -36,6 +36,10 @@
#include "../../log.h"
#define TAG WINPR_TAG("sspi.NTLM")
#define NTLM_CheckAndLogRequiredCapacity(tag, s, nmemb, what) \
Stream_CheckAndLogRequiredCapacityEx(tag, WLOG_WARN, s, nmemb, 1, "%s(%s:%" PRIuz ") " what, \
__FUNCTION__, __FILE__, __LINE__)
static char NTLM_CLIENT_SIGN_MAGIC[] = "session key to client-to-server signing key magic constant";
static char NTLM_SERVER_SIGN_MAGIC[] = "session key to server-to-client signing key magic constant";
static char NTLM_CLIENT_SEAL_MAGIC[] = "session key to client-to-server sealing key magic constant";
@@ -105,12 +109,10 @@ BOOL ntlm_write_version_info(wStream* s, const NTLM_VERSION_INFO* versionInfo)
WINPR_ASSERT(s);
WINPR_ASSERT(versionInfo);
if (Stream_GetRemainingCapacity(s) < 5 + sizeof(versionInfo->Reserved))
{
WLog_ERR(TAG, "NTLM_VERSION_INFO short header %" PRIuz ", expected %" PRIuz,
Stream_GetRemainingCapacity(s), 5 + sizeof(versionInfo->Reserved));
if (!Stream_CheckAndLogRequiredCapacityEx(
TAG, WLOG_WARN, s, 5ull + sizeof(versionInfo->Reserved), 1ull,
"%s(%s:%" PRIuz ") NTLM_VERSION_INFO", __FUNCTION__, __FILE__, __LINE__))
return FALSE;
}
Stream_Write_UINT8(s, versionInfo->ProductMajorVersion); /* ProductMajorVersion (1 byte) */
Stream_Write_UINT8(s, versionInfo->ProductMinorVersion); /* ProductMinorVersion (1 byte) */
@@ -185,12 +187,9 @@ static BOOL ntlm_write_ntlm_v2_client_challenge(wStream* s,
WINPR_ASSERT(s);
WINPR_ASSERT(challenge);
if (Stream_GetRemainingCapacity(s) < 28)
{
WLog_ERR(TAG, "NTLMv2_CLIENT_CHALLENGE expected 28bytes, have %" PRIuz "bytes",
Stream_GetRemainingCapacity(s));
if (!NTLM_CheckAndLogRequiredCapacity(TAG, s, 28, "NTLMv2_CLIENT_CHALLENGE"))
return FALSE;
}
Stream_Write_UINT8(s, challenge->RespType);
Stream_Write_UINT8(s, challenge->HiRespType);
Stream_Write_UINT16(s, challenge->Reserved1);
@@ -224,12 +223,9 @@ BOOL ntlm_write_ntlm_v2_response(wStream* s, const NTLMv2_RESPONSE* response)
WINPR_ASSERT(s);
WINPR_ASSERT(response);
if (Stream_GetRemainingCapacity(s) < 16)
{
WLog_ERR(TAG, "NTLMv2_RESPONSE expected 16bytes, have %" PRIuz "bytes",
Stream_GetRemainingCapacity(s));
if (!NTLM_CheckAndLogRequiredCapacity(TAG, s, 16ull, "NTLMv2_RESPONSE"))
return FALSE;
}
Stream_Write(s, response->Response, 16);
return ntlm_write_ntlm_v2_client_challenge(s, &(response->Challenge));
}

55
winpr/libwinpr/sspi/NTLM/ntlm_message.c
View File

@@ -35,6 +35,10 @@
#include "../../log.h"
#define TAG WINPR_TAG("sspi.NTLM")
#define NTLM_CheckAndLogRequiredCapacity(tag, s, nmemb, what) \
Stream_CheckAndLogRequiredCapacityEx(tag, WLOG_WARN, s, nmemb, 1, "%s(%s:%" PRIuz ") " what, \
__FUNCTION__, __FILE__, __LINE__)
static const char NTLM_SIGNATURE[8] = { 'N', 'T', 'L', 'M', 'S', 'S', 'P', '\0' };
static void ntlm_free_message_fields_buffer(NTLM_MESSAGE_FIELDS* fields);
@@ -272,12 +276,9 @@ static BOOL ntlm_write_message_header(wStream* s, const NTLM_MESSAGE_HEADER* hea
WINPR_ASSERT(s);
WINPR_ASSERT(header);
if (Stream_GetRemainingCapacity(s) < sizeof(NTLM_SIGNATURE) + 4)
{
WLog_ERR(TAG, "Short NTLM_MESSAGE_HEADER::header %" PRIuz ", expected 12",
Stream_GetRemainingCapacity(s));
if (!NTLM_CheckAndLogRequiredCapacity(TAG, s, sizeof(NTLM_SIGNATURE) + 4ull,
"NTLM_MESSAGE_HEADER::header"))
return FALSE;
}
Stream_Write(s, header->Signature, sizeof(NTLM_SIGNATURE));
Stream_Write_UINT32(s, header->MessageType);
@@ -320,12 +321,9 @@ static BOOL ntlm_write_message_fields(wStream* s, const NTLM_MESSAGE_FIELDS* fie
if (fields->MaxLen < 1)
MaxLen = fields->Len;
if (Stream_GetRemainingCapacity(s) < 8)
{
WLog_ERR(TAG, "Short NTLM_MESSAGE_FIELDS::header %" PRIuz ", expected %" PRIuz,
Stream_GetRemainingCapacity(s), 8);
if (!NTLM_CheckAndLogRequiredCapacity(TAG, (s), 8, "NTLM_MESSAGE_FIELDS::header"))
return FALSE;
}
Stream_Write_UINT16(s, fields->Len); /* Len (2 bytes) */
Stream_Write_UINT16(s, MaxLen); /* MaxLen (2 bytes) */
Stream_Write_UINT32(s, fields->BufferOffset); /* BufferOffset (4 bytes) */
@@ -382,12 +380,9 @@ static BOOL ntlm_write_message_fields_buffer(wStream* s, const NTLM_MESSAGE_FIEL
if (fields->Len > 0)
{
Stream_SetPosition(s, fields->BufferOffset);
if (Stream_GetRemainingCapacity(s) < fields->Len)
{
WLog_ERR(TAG, "Short NTLM_MESSAGE_FIELDS::Len %" PRIuz ", expected %" PRIu16,
Stream_GetRemainingCapacity(s), fields->Len);
if (!NTLM_CheckAndLogRequiredCapacity(TAG, (s), fields->Len, "NTLM_MESSAGE_FIELDS::Len"))
return FALSE;
}
Stream_Write(s, fields->Buffer, fields->Len);
}
return TRUE;
@@ -440,12 +435,10 @@ static BOOL ntlm_write_negotiate_flags(wStream* s, UINT32 flags, const char* nam
WINPR_ASSERT(s);
WINPR_ASSERT(name);
if (Stream_GetRemainingCapacity(s) < 4)
{
WLog_ERR(TAG, "%s::NegotiateFlags expected 4bytes, have %" PRIuz "bytes", name,
Stream_GetRemainingCapacity(s));
if (!Stream_CheckAndLogRequiredCapacityEx(TAG, WLOG_WARN, s, 4ull, 1ull,
"%s(%s:%" PRIuz ") %s::NegotiateFlags", __FUNCTION__,
__FILE__, __LINE__, name))
return FALSE;
}
WLog_DBG(TAG, "Write flags %s", ntlm_negotiate_flags_string(buffer, ARRAYSIZE(buffer), flags));
Stream_Write_UINT32(s, flags); /* NegotiateFlags (4 bytes) */
@@ -482,21 +475,12 @@ static BOOL ntlm_write_message_integrity_check(wStream* s, size_t offset, const
pos = Stream_GetPosition(s);
if (offset + size > Stream_Capacity(s))
{
WLog_ERR(TAG,
"%s::MessageIntegrityCheck invalid offset[length] %" PRIuz "[%" PRIuz
"], got %" PRIuz,
name, offset, size, Stream_GetRemainingCapacity(s));
if (!NTLM_CheckAndLogRequiredCapacity(TAG, s, offset, "MessageIntegrityCheck::offset"))
return FALSE;
}
Stream_SetPosition(s, offset);
if (Stream_GetRemainingCapacity(s) < size)
{
WLog_ERR(TAG, "%s::MessageIntegrityCheck expected %" PRIuz "bytes, got %" PRIuz "bytes",
name, size, Stream_GetRemainingCapacity(s));
if (!NTLM_CheckAndLogRequiredCapacity(TAG, s, size, "MessageIntegrityCheck::size"))
return FALSE;
}
Stream_Write(s, data, size);
Stream_SetPosition(s, pos);
@@ -882,13 +866,8 @@ SECURITY_STATUS ntlm_write_ChallengeMessage(NTLM_CONTEXT* context, PSecBuffer bu
if (!ntlm_write_negotiate_flags(s, message->NegotiateFlags, "NTLM_CHALLENGE_MESSAGE"))
return SEC_E_INTERNAL_ERROR;
if (Stream_GetRemainingCapacity(s) < 16)
{
WLog_ERR(TAG,
"NTLM_CHALLENGE_MESSAGE::ServerChallenge expected 16bytes, got %" PRIuz "bytes",
Stream_GetRemainingCapacity(s));
if (!NTLM_CheckAndLogRequiredCapacity(TAG, s, 16, "NTLM_CHALLENGE_MESSAGE::ServerChallenge"))
return SEC_E_INTERNAL_ERROR;
}
Stream_Write(s, message->ServerChallenge, 8); /* ServerChallenge (8 bytes) */
Stream_Write(s, message->Reserved, 8); /* Reserved (8 bytes), should be ignored */

2
winpr/libwinpr/utils/image.c
View File

@@ -385,7 +385,7 @@ static int winpr_image_bitmap_read_buffer(wImage* image, const BYTE* buffer, siz
goto fail;
if (!Stream_SafeSeek(s, bf.bfOffBits - Stream_GetPosition(s)))
goto fail;
if (Stream_GetRemainingCapacity(s) < bi.biSizeImage)
if (!Stream_CheckAndLogRequiredCapacity(TAG, s, bi.biSizeImage))
goto fail;
if (bi.biWidth < 0)

2
winpr/libwinpr/utils/stream.c
View File

@@ -290,7 +290,7 @@ BOOL Stream_Write_UTF16_String(wStream* s, const WCHAR* src, size_t length)
if (!s || !src)
return FALSE;
if (!Stream_CheckAndLogRequiredCapacity(STREAM_TAG, (s), sizeof(WCHAR) * length))
if (!Stream_CheckAndLogRequiredCapacityOfSize(STREAM_TAG, (s), length, sizeof(WCHAR)))
return FALSE;
for (x = 0; x < length; x++)