github/xrdp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #3829 from the-deniss/fix/dynvc-multi-chunk-reassembly-logic-defects

Browse Source 
Fix for DYNVC Multi-Chunk Reassembly Logic Defects
This commit is contained in:
matt335672
2026-07-16 10:47:51 +01:00
committed by GitHub
parent 3af31df3fc c73c827e5a
commit 8812646d0f
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libxrdp/xrdp_channel.c
+8 -5
View File
@@ -23,6 +23,7 @@
#endif #endif
#include "libxrdp.h" #include "libxrdp.h"
#include "parse.h"
#include "string_calls.h" #include "string_calls.h"
#include "xrdp_channel.h" #include "xrdp_channel.h"
@@ -610,6 +611,8 @@ xrdp_channel_process_drdynvc(struct xrdp_channel *self,
} }
out_uint8a(self->s, s->p, length); /* append data to chunk buffer */ out_uint8a(self->s, s->p, length); /* append data to chunk buffer */
in_uint8s(s, length); /* virtualChannelData */ in_uint8s(s, length); /* virtualChannelData */
s_mark_end(self->s);
self->s->p = self->s->data;
ls = self->s; ls = self->s;
break; break;
case 3: /* CHANNEL_FLAG_FIRST and CHANNEL_FLAG_LAST */ case 3: /* CHANNEL_FLAG_FIRST and CHANNEL_FLAG_LAST */
@@ -635,19 +638,19 @@ xrdp_channel_process_drdynvc(struct xrdp_channel *self,
switch (cmd & 0xf0) switch (cmd & 0xf0)
{ {
case CMD_DVC_CAPABILITY: case CMD_DVC_CAPABILITY:
rv = drdynvc_process_capability_response(self, cmd, s); rv = drdynvc_process_capability_response(self, cmd, ls);
break; break;
case CMD_DVC_OPEN_CHANNEL: case CMD_DVC_OPEN_CHANNEL:
rv = drdynvc_process_open_channel_response(self, cmd, s); rv = drdynvc_process_open_channel_response(self, cmd, ls);
break; break;
case CMD_DVC_CLOSE_CHANNEL: case CMD_DVC_CLOSE_CHANNEL:
rv = drdynvc_process_close_channel_response(self, cmd, s); rv = drdynvc_process_close_channel_response(self, cmd, ls);
break; break;
case CMD_DVC_DATA_FIRST: case CMD_DVC_DATA_FIRST:
rv = drdynvc_process_data_first(self, cmd, s); rv = drdynvc_process_data_first(self, cmd, ls);
break; break;
case CMD_DVC_DATA: case CMD_DVC_DATA:
rv = drdynvc_process_data(self, cmd, s); rv = drdynvc_process_data(self, cmd, ls);
break; break;
default: default:
LOG(LOG_LEVEL_ERROR, "Received header [MS-RDPEDYC] with " LOG(LOG_LEVEL_ERROR, "Received header [MS-RDPEDYC] with "