From 2802efd52a44b269813ab94051e9e04dbebf42b5 Mon Sep 17 00:00:00 2001 From: Bernhard Miklautz Date: Mon, 2 Sep 2013 18:07:55 +0200 Subject: [PATCH] fastpath: fixed sending of multiple input messages --- libfreerdp/core/fastpath.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/libfreerdp/core/fastpath.c b/libfreerdp/core/fastpath.c index 67106c7b7..5b05b995b 100644 --- a/libfreerdp/core/fastpath.c +++ b/libfreerdp/core/fastpath.c @@ -711,6 +711,14 @@ BOOL fastpath_send_multiple_input_pdu(rdpFastPath* fastpath, wStream* s, int iNu BYTE eventHeader; int sec_bytes; + /* + * A maximum of 15 events are allowed per request + * if the optional numEvents field isn't used + * see MS-RDPBCGR 2.2.8.1.2 for details + */ + if (iNumEvents > 15) + return FALSE; + rdp = fastpath->rdp; length = Stream_GetPosition(s); @@ -722,7 +730,7 @@ BOOL fastpath_send_multiple_input_pdu(rdpFastPath* fastpath, wStream* s, int iNu } eventHeader = FASTPATH_INPUT_ACTION_FASTPATH; - eventHeader |= (1 << 2); /* numberEvents */ + eventHeader |= (iNumEvents << 2); /* numberEvents */ if (rdp->sec_flags & SEC_ENCRYPT) eventHeader |= (FASTPATH_INPUT_ENCRYPTED << 6);