From f2267a22775c854ae9d0d9159eb189d96a9df1f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Moreau?= <marcandre.moreau@gmail.com>
Date: Thu, 4 Dec 2014 13:19:10 -0500
Subject: [PATCH] libwinpr-clipboard: fix memory corruption and leaks

---
 client/X11/xf_cliprdr.c              | 8 +++++++-
 winpr/libwinpr/clipboard/clipboard.c | 4 ++++
 winpr/libwinpr/clipboard/synthetic.c | 2 +-
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/client/X11/xf_cliprdr.c b/client/X11/xf_cliprdr.c
index e819c29be..6956d342a 100644
--- a/client/X11/xf_cliprdr.c
+++ b/client/X11/xf_cliprdr.c
@@ -296,6 +296,7 @@ static void xf_cliprdr_process_requested_data(xfClipboard* clipboard, BOOL hasDa
 	{
 		case CF_TEXT:
 		case CF_UNICODETEXT:
+			size = strlen((char*) data) + 1;
 			formatId = ClipboardGetFormatId(clipboard->system, "UTF8_STRING");
 			break;
 
@@ -304,6 +305,7 @@ static void xf_cliprdr_process_requested_data(xfClipboard* clipboard, BOOL hasDa
 			break;
 
 		case CB_FORMAT_HTML:
+			size = strlen((char*) data) + 1;
 			formatId = ClipboardGetFormatId(clipboard->system, "text/html");
 			break;
 	}
@@ -317,8 +319,9 @@ static void xf_cliprdr_process_requested_data(xfClipboard* clipboard, BOOL hasDa
 	CopyMemory(pSrcData, data, SrcSize);
 
 	bSuccess = ClipboardSetData(clipboard->system, formatId, (void*) pSrcData, SrcSize);
+
 	if (!bSuccess)
-		free (pSrcData);
+		free(pSrcData);
 
 	pFormatIds = NULL;
 	count = ClipboardGetFormatIds(clipboard->system, &pFormatIds);
@@ -367,6 +370,7 @@ static void xf_cliprdr_process_requested_data(xfClipboard* clipboard, BOOL hasDa
 	}
 
 	xf_cliprdr_send_data_response(clipboard, pDstData, (int) DstSize);
+	free(pDstData);
 }
 
 static BOOL xf_cliprdr_get_requested_data(xfClipboard* clipboard, Atom target)
@@ -398,6 +402,7 @@ static BOOL xf_cliprdr_get_requested_data(xfClipboard* clipboard, Atom target)
 		XFree(data);
 		data = NULL;
 	}
+
 	if (bytes_left <= 0 && !clipboard->incr_starts)
 	{
 
@@ -994,6 +999,7 @@ static int xf_cliprdr_server_format_data_response(CliprdrClientContext* context,
 	CopyMemory(pSrcData, data, SrcSize);
 
 	bSuccess = ClipboardSetData(clipboard->system, formatId, (void*) pSrcData, SrcSize);
+
 	if (!bSuccess)
 		free (pSrcData);
 
diff --git a/winpr/libwinpr/clipboard/clipboard.c b/winpr/libwinpr/clipboard/clipboard.c
index fbba8f7d5..d3de692c9 100644
--- a/winpr/libwinpr/clipboard/clipboard.c
+++ b/winpr/libwinpr/clipboard/clipboard.c
@@ -540,6 +540,10 @@ void ClipboardDestroy(wClipboard* clipboard)
 		}
 	}
 
+	free((void*) clipboard->data);
+	clipboard->data = NULL;
+	clipboard->size = 0;
+
 	clipboard->numFormats = 0;
 	free(clipboard->formats);
 
diff --git a/winpr/libwinpr/clipboard/synthetic.c b/winpr/libwinpr/clipboard/synthetic.c
index bffa2315e..36bec7b8a 100644
--- a/winpr/libwinpr/clipboard/synthetic.c
+++ b/winpr/libwinpr/clipboard/synthetic.c
@@ -137,7 +137,7 @@ static void* clipboard_synthesize_cf_unicodetext(wClipboard* clipboard, UINT32 f
 		if (status <= 0)
 			return NULL;
 
-		*pSize = ((status + 1) * 2);
+		*pSize = status * 2;
 	}
 
 	return (void*) pDstData;