github/xrdp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

CVE-2026-32624: buffer overflow if domain sep used

Browse Source 
Check the username buffer is not overflowed if the domain separator
feature is used.
This commit is contained in:
matt335672
2026-03-06 11:03:48 +00:00
parent 2dfe8bbce2
commit f1a2bec415
1 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libxrdp/xrdp_sec.c
+17 -4
View File
@@ -621,10 +621,23 @@ xrdp_sec_process_logon_info(struct xrdp_sec *self, struct stream *s)
if (self->rdp_layer->client_info.domain_user_separator[0] != '\0'
&& self->rdp_layer->client_info.domain[0] != '\0')
{
LOG(LOG_LEVEL_DEBUG, "Client supplied domain with user name. Overwriting user name with user name parsed from domain.");
int size = sizeof(self->rdp_layer->client_info.username);
g_strncat(self->rdp_layer->client_info.username, self->rdp_layer->client_info.domain_user_separator, size - 1 - g_strlen(self->rdp_layer->client_info.domain_user_separator));
g_strncat(self->rdp_layer->client_info.username, self->rdp_layer->client_info.domain, size - 1 - g_strlen(self->rdp_layer->client_info.domain));
// Check the composite string is not too long
unsigned int size =
g_strlen(self->rdp_layer->client_info.username) +
g_strlen(self->rdp_layer->client_info.domain_user_separator) +
g_strlen(self->rdp_layer->client_info.domain);
if (size >= sizeof(self->rdp_layer->client_info.username))
{
LOG(LOG_LEVEL_ERROR, "Username/domain is too long");
return 1;
}
LOG(LOG_LEVEL_DEBUG, "Client supplied domain with user name."
" Overwriting user name with user name parsed from domain.");
g_strcat(self->rdp_layer->client_info.username,
self->rdp_layer->client_info.domain_user_separator);
g_strcat(self->rdp_layer->client_info.username,
self->rdp_layer->client_info.domain);
}
if (ts_info_utf16_in(s, len_program, self->rdp_layer->client_info.program, sizeof(self->rdp_layer->client_info.program)) != 0)