github/xrdp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

VUL: fix some possible buffer overruns

Browse Source
This commit is contained in:
Jay Sorg
2013-09-10 16:00:30 -07:00
parent 4e58a5a3c0
commit 39ed446e15
5 changed files with 156 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libxrdp/xrdp_mcs.c
+88 -1
View File
@@ -132,6 +132,11 @@ xrdp_mcs_recv(struct xrdp_mcs *self, struct stream *s, int *chan)
return 1;
}
if (!s_check_rem(s, 1))
{
return 1;
}
in_uint8(s, opcode);
appid = opcode >> 2;
@@ -145,6 +150,11 @@ xrdp_mcs_recv(struct xrdp_mcs *self, struct stream *s, int *chan)
/* this is channels getting added from the client */
if (appid == MCS_CJRQ)
{
if (!s_check_rem(s, 4))
{
return 1;
}
in_uint16_be(s, userid);
in_uint16_be(s, chanid);
log_message(LOG_LEVEL_DEBUG,"MCS_CJRQ - channel join request received");
@@ -176,6 +186,11 @@ xrdp_mcs_recv(struct xrdp_mcs *self, struct stream *s, int *chan)
return 1;
}
if (!s_check_rem(s, 6))
{
return 1;
}
in_uint8s(s, 2);
in_uint16_be(s, *chan);
in_uint8s(s, 1);
@@ -183,6 +198,10 @@ xrdp_mcs_recv(struct xrdp_mcs *self, struct stream *s, int *chan)
if (len & 0x80)
{
if (!s_check_rem(s, 1))
{
return 1;
}
in_uint8s(s, 1);
}
@@ -202,10 +221,18 @@ xrdp_mcs_ber_parse_header(struct xrdp_mcs *self, struct stream *s,
if (tag_val > 0xff)
{
if (!s_check_rem(s, 2))
{
return 1;
}
in_uint16_be(s, tag);
}
else
{
if (!s_check_rem(s, 1))
{
return 1;
}
in_uint8(s, tag);
}
@@ -214,6 +241,11 @@ xrdp_mcs_ber_parse_header(struct xrdp_mcs *self, struct stream *s,
return 1;
}
if (!s_check_rem(s, 1))
{
return 1;
}
in_uint8(s, l);
if (l & 0x80)
@@ -223,6 +255,10 @@ xrdp_mcs_ber_parse_header(struct xrdp_mcs *self, struct stream *s,
while (l > 0)
{
if (!s_check_rem(s, 1))
{
return 1;
}
in_uint8(s, i);
*len = (*len << 8) | i;
l--;
@@ -255,6 +291,11 @@ xrdp_mcs_parse_domain_params(struct xrdp_mcs *self, struct stream *s)
return 1;
}
if (!s_check_rem(s, len))
{
return 1;
}
in_uint8s(s, len);
if (s_check(s))
@@ -276,7 +317,7 @@ xrdp_mcs_recv_connect_initial(struct xrdp_mcs *self)
struct stream *s;
make_stream(s);
init_stream(s, 8192);
init_stream(s, 16 * 1024);
if (xrdp_iso_recv(self->iso_layer, s) != 0)
{
@@ -338,6 +379,12 @@ xrdp_mcs_recv_connect_initial(struct xrdp_mcs *self)
return 1;
}
if ((len <= 0) || (len > 16 * 1024))
{
free_stream(s);
return 1;
}
/* make a copy of client mcs data */
init_stream(self->client_mcs_data, len);
out_uint8a(self->client_mcs_data, s->p, len);
@@ -372,6 +419,12 @@ xrdp_mcs_recv_edrq(struct xrdp_mcs *self)
free_stream(s);
return 1;
}
if (!s_check_rem(s, 1))
{
free_stream(s);
return 1;
}
in_uint8(s, opcode);
@@ -381,11 +434,22 @@ xrdp_mcs_recv_edrq(struct xrdp_mcs *self)
return 1;
}
if (!s_check_rem(s, 4))
{
free_stream(s);
return 1;
}
in_uint8s(s, 2);
in_uint8s(s, 2);
if (opcode & 2)
{
if (!s_check_rem(s, 2))
{
free_stream(s);
return 1;
}
in_uint16_be(s, self->userid);
}
@@ -416,6 +480,12 @@ xrdp_mcs_recv_aurq(struct xrdp_mcs *self)
return 1;
}
if (!s_check_rem(s, 1))
{
free_stream(s);
return 1;
}
in_uint8(s, opcode);
if ((opcode >> 2) != MCS_AURQ)
@@ -426,6 +496,11 @@ xrdp_mcs_recv_aurq(struct xrdp_mcs *self)
if (opcode & 2)
{
if (!s_check_rem(s, 2))
{
free_stream(s);
return 1;
}
in_uint16_be(s, self->userid);
}
@@ -491,6 +566,12 @@ xrdp_mcs_recv_cjrq(struct xrdp_mcs *self)
return 1;
}
if (!s_check_rem(s, 1))
{
free_stream(s);
return 1;
}
in_uint8(s, opcode);
if ((opcode >> 2) != MCS_CJRQ)
@@ -499,6 +580,12 @@ xrdp_mcs_recv_cjrq(struct xrdp_mcs *self)
return 1;
}
if (!s_check_rem(s, 4))
{
free_stream(s);
return 1;
}
in_uint8s(s, 4);
if (opcode & 2)