github/xrdp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
CVE-2026-32624: buffer overflow if domain sep used
This commit is contained in:
metalefty
2026-04-14 09:30:27 +09:00
committed by GitHub
parent 832edcab20 f1a2bec415
commit 220a50b1d2
1 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libxrdp/xrdp_sec.c
+17 -4
View File
@@ -621,10 +621,23 @@ xrdp_sec_process_logon_info(struct xrdp_sec *self, struct stream *s)
if (self->rdp_layer->client_info.domain_user_separator[0] != '\0'
&& self->rdp_layer->client_info.domain[0] != '\0')
{
LOG(LOG_LEVEL_DEBUG, "Client supplied domain with user name. Overwriting user name with user name parsed from domain.");
int size = sizeof(self->rdp_layer->client_info.username);
g_strncat(self->rdp_layer->client_info.username, self->rdp_layer->client_info.domain_user_separator, size - 1 - g_strlen(self->rdp_layer->client_info.domain_user_separator));
g_strncat(self->rdp_layer->client_info.username, self->rdp_layer->client_info.domain, size - 1 - g_strlen(self->rdp_layer->client_info.domain));
// Check the composite string is not too long
unsigned int size =
g_strlen(self->rdp_layer->client_info.username) +
g_strlen(self->rdp_layer->client_info.domain_user_separator) +
g_strlen(self->rdp_layer->client_info.domain);
if (size >= sizeof(self->rdp_layer->client_info.username))
{
LOG(LOG_LEVEL_ERROR, "Username/domain is too long");
return 1;
}
LOG(LOG_LEVEL_DEBUG, "Client supplied domain with user name."
" Overwriting user name with user name parsed from domain.");
g_strcat(self->rdp_layer->client_info.username,
self->rdp_layer->client_info.domain_user_separator);
g_strcat(self->rdp_layer->client_info.username,
self->rdp_layer->client_info.domain);
}
if (ts_info_utf16_in(s, len_program, self->rdp_layer->client_info.program, sizeof(self->rdp_layer->client_info.program)) != 0)