From a2d130bc5bc48831777a9712627cf6b67d76c901 Mon Sep 17 00:00:00 2001 From: Denis Skvortsov Date: Wed, 22 Jul 2026 12:03:58 +0300 Subject: [PATCH 1/4] Fix for trans_force_read_s Bounds Check Uses Wrong Pointer --- common/trans.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/common/trans.c b/common/trans.c index 312495c7..98422406 100644 --- a/common/trans.c +++ b/common/trans.c @@ -471,7 +471,8 @@ trans_force_read_s(struct trans *self, struct stream *in_s, int size) int rcvd; if (self->status != TRANS_STATUS_UP || - size < 0 || !s_check_rem_out(in_s, size)) + size < 0 || + in_s->end + size > in_s->data + in_s->size) { return 1; } From 5ae11e2a3738a910d8e695b985892df745a6df34 Mon Sep 17 00:00:00 2001 From: Denis Skvortsov Date: Sat, 25 Jul 2026 17:46:28 +0300 Subject: [PATCH 2/4] Harden stream bounds checks against pointer-arithmetic overflow --- common/parse.h | 4 ++-- common/trans.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/common/parse.h b/common/parse.h index dccdb441..3f9950ce 100644 --- a/common/parse.h +++ b/common/parse.h @@ -186,7 +186,7 @@ unsigned int in_utf16_le_terminated_as_utf8_length(struct stream *s); /******************************************************************************/ -#define s_check_rem(s, n) ((s)->p + (n) <= (s)->end) +#define s_check_rem(s, n) ((n) >= 0 && (n) <= (s)->end - (s)->p) /******************************************************************************/ /** @@ -202,7 +202,7 @@ in_utf16_le_terminated_as_utf8_length(struct stream *s); && 0 ) /******************************************************************************/ -#define s_check_rem_out(s, n) ((s)->p + (n) <= (s)->data + (s)->size) +#define s_check_rem_out(s, n) ((n) >= 0 && (n) <= (s)->size - ((s)->p - (s)->data)) /******************************************************************************/ /** diff --git a/common/trans.c b/common/trans.c index 98422406..be9a7ae3 100644 --- a/common/trans.c +++ b/common/trans.c @@ -471,8 +471,8 @@ trans_force_read_s(struct trans *self, struct stream *in_s, int size) int rcvd; if (self->status != TRANS_STATUS_UP || - size < 0 || - in_s->end + size > in_s->data + in_s->size) + size < 0 || + size > in_s->size - (in_s->end - in_s->data)) { return 1; } From e4f4364c9b2e569053325353254c8e2c2c53a033 Mon Sep 17 00:00:00 2001 From: Denis Skvortsov Date: Sat, 25 Jul 2026 18:47:19 +0300 Subject: [PATCH 3/4] Remove check to avoid -Wtype-limits --- common/parse.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/common/parse.h b/common/parse.h index 3f9950ce..bef6bf31 100644 --- a/common/parse.h +++ b/common/parse.h @@ -186,7 +186,7 @@ unsigned int in_utf16_le_terminated_as_utf8_length(struct stream *s); /******************************************************************************/ -#define s_check_rem(s, n) ((n) >= 0 && (n) <= (s)->end - (s)->p) +#define s_check_rem(s, n) ((n) <= (s)->end - (s)->p) /******************************************************************************/ /** @@ -202,7 +202,7 @@ in_utf16_le_terminated_as_utf8_length(struct stream *s); && 0 ) /******************************************************************************/ -#define s_check_rem_out(s, n) ((n) >= 0 && (n) <= (s)->size - ((s)->p - (s)->data)) +#define s_check_rem_out(s, n) ((n) <= (s)->size - ((s)->p - (s)->data)) /******************************************************************************/ /** From b36ad7b2d0b3a5d12a6ad72bd8cf0e502f819ac2 Mon Sep 17 00:00:00 2001 From: Denis Skvortsov Date: Mon, 27 Jul 2026 15:35:26 +0300 Subject: [PATCH 4/4] Cast to size_t in bounds macros; drop resulting dead check --- common/parse.h | 4 ++-- libxrdp/xrdp_mcs.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/common/parse.h b/common/parse.h index bef6bf31..297c9a18 100644 --- a/common/parse.h +++ b/common/parse.h @@ -186,7 +186,7 @@ unsigned int in_utf16_le_terminated_as_utf8_length(struct stream *s); /******************************************************************************/ -#define s_check_rem(s, n) ((n) <= (s)->end - (s)->p) +#define s_check_rem(s, n) ((size_t)(n) <= (size_t)((s)->end - (s)->p)) /******************************************************************************/ /** @@ -202,7 +202,7 @@ in_utf16_le_terminated_as_utf8_length(struct stream *s); && 0 ) /******************************************************************************/ -#define s_check_rem_out(s, n) ((n) <= (s)->size - ((s)->p - (s)->data)) +#define s_check_rem_out(s, n) ((size_t)(n) <= (size_t)((s)->size - ((s)->p - (s)->data))) /******************************************************************************/ /** diff --git a/libxrdp/xrdp_mcs.c b/libxrdp/xrdp_mcs.c index 84dd274d..962a5948 100644 --- a/libxrdp/xrdp_mcs.c +++ b/libxrdp/xrdp_mcs.c @@ -352,7 +352,7 @@ xrdp_mcs_parse_domain_params(struct xrdp_mcs *self, struct stream *s) in_uint8s(s, len); /* skip all fields */ - return !s_check_rem_and_log(s, 0, "Parsing [ITU-T T.125] DomainParameters"); + return 0; } /*****************************************************************************/