VUL: fix some possible buffer overruns

2013-09-10 16:00:30 -07:00
parent 4e58a5a3c0
commit 39ed446e15
5 changed files with 156 additions and 6 deletions
@@ -72,20 +72,38 @@ xrdp_iso_recv_msg(struct xrdp_iso *self, struct stream *s, int *code)
    in_uint8s(s, 1);
    in_uint16_be(s, len);

+    if (len < 4)
+    {
+        return 1;
+    }
+
    if (xrdp_tcp_recv(self->tcp_layer, s, len - 4) != 0)
    {
        return 1;
    }

+    if (!s_check_rem(s, 2))
+    {
+        return 1;
+    }
+
    in_uint8s(s, 1);
    in_uint8(s, *code);

    if (*code == ISO_PDU_DT)
    {
+        if (!s_check_rem(s, 1))
+        {
+            return 1;
+        }
        in_uint8s(s, 1);
    }
    else
    {
+        if (!s_check_rem(s, 5))
+        {
+            return 1;
+        }
        in_uint8s(s, 5);
    }