From b824c93b8638871d64836b58b2dcbb1c34d29751 Mon Sep 17 00:00:00 2001 From: Denis Skvortsov Date: Wed, 15 Jul 2026 17:24:30 +0300 Subject: [PATCH] Fix for DYNVC Multi-Chunk Reassembly Logic Defects --- libxrdp/xrdp_channel.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/libxrdp/xrdp_channel.c b/libxrdp/xrdp_channel.c index 909949eb..20125dc5 100644 --- a/libxrdp/xrdp_channel.c +++ b/libxrdp/xrdp_channel.c @@ -18,6 +18,7 @@ * channel layer */ +#include "parse.h" #if defined(HAVE_CONFIG_H) #include #endif @@ -610,6 +611,8 @@ xrdp_channel_process_drdynvc(struct xrdp_channel *self, } out_uint8a(self->s, s->p, length); /* append data to chunk buffer */ in_uint8s(s, length); /* virtualChannelData */ + s_mark_end(self->s); + self->s->p = self->s->data; ls = self->s; break; case 3: /* CHANNEL_FLAG_FIRST and CHANNEL_FLAG_LAST */ @@ -635,19 +638,19 @@ xrdp_channel_process_drdynvc(struct xrdp_channel *self, switch (cmd & 0xf0) { case CMD_DVC_CAPABILITY: - rv = drdynvc_process_capability_response(self, cmd, s); + rv = drdynvc_process_capability_response(self, cmd, ls); break; case CMD_DVC_OPEN_CHANNEL: - rv = drdynvc_process_open_channel_response(self, cmd, s); + rv = drdynvc_process_open_channel_response(self, cmd, ls); break; case CMD_DVC_CLOSE_CHANNEL: - rv = drdynvc_process_close_channel_response(self, cmd, s); + rv = drdynvc_process_close_channel_response(self, cmd, ls); break; case CMD_DVC_DATA_FIRST: - rv = drdynvc_process_data_first(self, cmd, s); + rv = drdynvc_process_data_first(self, cmd, ls); break; case CMD_DVC_DATA: - rv = drdynvc_process_data(self, cmd, s); + rv = drdynvc_process_data(self, cmd, ls); break; default: LOG(LOG_LEVEL_ERROR, "Received header [MS-RDPEDYC] with "