github/xrdp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
CVE-2026-54538: Pre-auth infinite loop in TS_SHARECONTROLHEADER
This commit is contained in:
metalefty
2026-07-02 17:30:17 +09:00
committed by GitHub
parent 5642decb5f 2394084bf4
commit bb0c5984c2
1 changed files with 17 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libxrdp/xrdp_rdp.c
+10 -7
View File
@@ -541,23 +541,26 @@ xrdp_rdp_recv(struct xrdp_rdp *self, struct stream *s, int *code)
{ {
s->next_packet = 0; s->next_packet = 0;
*code = 0; *code = 0;
LOG(LOG_LEVEL_ERROR, "xrdp_rdp_recv: out code 0 (skip data) " LOG(LOG_LEVEL_ERROR, "xrdp_rdp_recv: out code 0 bad RDP packet");
"bad RDP packet"); return 1;
return 0;
} }
else
{
in_uint16_le(s, len); /* totalLength */ in_uint16_le(s, len); /* totalLength */
in_uint16_le(s, pdu_code); /* pduType */ in_uint16_le(s, pdu_code); /* pduType */
*code = pdu_code & 0xf;
in_uint8s(s, 2); /* pduSource */ in_uint8s(s, 2); /* pduSource */
// Length must be at least the size of TS_SHARECONTROLHEADER, and
// cannot fall beyond the end of the PDU
if (len < 6 || !s_check_rem(s, len - 6))
{
LOG(LOG_LEVEL_ERROR, "bad TS_SHARECONTROLHEADER length 0x%04X", len);
return 1;
}
*code = pdu_code & 0xf;
s->next_packet += len; s->next_packet += len;
LOG_DEVEL(LOG_LEVEL_TRACE, "Received header [MS-RDPBCGR] TS_SHARECONTROLHEADER " LOG_DEVEL(LOG_LEVEL_TRACE, "Received header [MS-RDPBCGR] TS_SHARECONTROLHEADER "
"totalLength %d, pduType.type %s (%d), pduType.PDUVersion %d, " "totalLength %d, pduType.type %s (%d), pduType.PDUVersion %d, "
"pduSource (ignored)", len, PDUTYPE_TO_STR(*code), *code, "pduSource (ignored)", len, PDUTYPE_TO_STR(*code), *code,
((pdu_code & 0xfff0) >> 4)); ((pdu_code & 0xfff0) >> 4));
return 0; return 0;
}
} }
/*****************************************************************************/ /*****************************************************************************/