morgan/FreeRDP
1
0
Fork 0
mirror of https://github.com/morgan9e/FreeRDP synced 2026-04-15 00:44:19 +09:00
Code Issues Packages Projects Releases Wiki Activity

Fix a regression introduced with PR #4013

Browse Source 
If numWindowRects/numVisibilityRects is zero a realloc might either
return NULL or a free able memory. In the first case the introduced
regression caused a double free.
As 0 is a possible value that can be received in both cases rail was
broken.

Fixes #4022
This commit is contained in:
Bernhard Miklautz
2017-06-29 11:24:36 +02:00
parent 9904c32e80
commit e7cd3250c3
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libfreerdp/core/window.c
View File

@@ -295,6 +295,10 @@ BOOL update_read_window_state_order(wStream* s, WINDOW_ORDER_INFO* orderInfo, WI
Stream_Read_UINT16(s, windowState->numWindowRects); /* numWindowRects (2 bytes) */
if (windowState->numWindowRects == 0) {
return TRUE;
}
size = sizeof(RECTANGLE_16) * windowState->numWindowRects;
newRect = (RECTANGLE_16*)realloc(windowState->windowRects, size);
if (!newRect)
@@ -334,6 +338,9 @@ BOOL update_read_window_state_order(wStream* s, WINDOW_ORDER_INFO* orderInfo, WI
Stream_Read_UINT16(s, windowState->numVisibilityRects); /* numVisibilityRects (2 bytes) */
if (windowState->numVisibilityRects == 0) {
return TRUE;
}
size = sizeof(RECTANGLE_16) * windowState->numVisibilityRects;
newRect = (RECTANGLE_16*)realloc(windowState->visibilityRects, size);
if (!newRect)