From f1a2bec41560ccc420931d94f07a18c31141c069 Mon Sep 17 00:00:00 2001 From: matt335672 <30179339+matt335672@users.noreply.github.com> Date: Fri, 6 Mar 2026 11:03:48 +0000 Subject: [PATCH] CVE-2026-32624: buffer overflow if domain sep used Check the username buffer is not overflowed if the domain separator feature is used. --- libxrdp/xrdp_sec.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/libxrdp/xrdp_sec.c b/libxrdp/xrdp_sec.c index 32ce7d74..b84ce71a 100644 --- a/libxrdp/xrdp_sec.c +++ b/libxrdp/xrdp_sec.c @@ -621,10 +621,23 @@ xrdp_sec_process_logon_info(struct xrdp_sec *self, struct stream *s) if (self->rdp_layer->client_info.domain_user_separator[0] != '\0' && self->rdp_layer->client_info.domain[0] != '\0') { - LOG(LOG_LEVEL_DEBUG, "Client supplied domain with user name. Overwriting user name with user name parsed from domain."); - int size = sizeof(self->rdp_layer->client_info.username); - g_strncat(self->rdp_layer->client_info.username, self->rdp_layer->client_info.domain_user_separator, size - 1 - g_strlen(self->rdp_layer->client_info.domain_user_separator)); - g_strncat(self->rdp_layer->client_info.username, self->rdp_layer->client_info.domain, size - 1 - g_strlen(self->rdp_layer->client_info.domain)); + // Check the composite string is not too long + unsigned int size = + g_strlen(self->rdp_layer->client_info.username) + + g_strlen(self->rdp_layer->client_info.domain_user_separator) + + g_strlen(self->rdp_layer->client_info.domain); + + if (size >= sizeof(self->rdp_layer->client_info.username)) + { + LOG(LOG_LEVEL_ERROR, "Username/domain is too long"); + return 1; + } + LOG(LOG_LEVEL_DEBUG, "Client supplied domain with user name." + " Overwriting user name with user name parsed from domain."); + g_strcat(self->rdp_layer->client_info.username, + self->rdp_layer->client_info.domain_user_separator); + g_strcat(self->rdp_layer->client_info.username, + self->rdp_layer->client_info.domain); } if (ts_info_utf16_in(s, len_program, self->rdp_layer->client_info.program, sizeof(self->rdp_layer->client_info.program)) != 0)