From fa6ed3c7024e5574d1ce7b3d86ac79ef7a096949 Mon Sep 17 00:00:00 2001
From: matt335672 <30179339+matt335672@users.noreply.github.com>
Date: Fri, 5 Sep 2025 12:19:56 +0100
Subject: [PATCH] Fix more inconsistencies with [MS-RDPBCGR]

---
 libxrdp/xrdp_rdp.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/libxrdp/xrdp_rdp.c b/libxrdp/xrdp_rdp.c
index f2397cf7..4b4e8b81 100644
--- a/libxrdp/xrdp_rdp.c
+++ b/libxrdp/xrdp_rdp.c
@@ -1109,7 +1109,8 @@ xrdp_rdp_send_synchronise(struct xrdp_rdp *self)
 /*****************************************************************************/
 /* Send a [MS-RDPBCGR] TS_CONTROL_PDU message */
 static int
-xrdp_rdp_send_control(struct xrdp_rdp *self, int action)
+xrdp_rdp_send_control(struct xrdp_rdp *self, int action,
+                      int grant_id, int control_id)
 {
     struct stream *s;
 
@@ -1124,8 +1125,8 @@ xrdp_rdp_send_control(struct xrdp_rdp *self, int action)
     }
 
     out_uint16_le(s, action);
-    out_uint16_le(s, 0); /* userid */
-    out_uint32_le(s, 1002); /* control id */
+    out_uint16_le(s, grant_id);
+    out_uint32_le(s, control_id);
     s_mark_end(s);
     LOG_DEVEL(LOG_LEVEL_TRACE, "Sending [MS-RDPBCGR] TS_CONTROL_PDU "
               "action %d, grantId 0, controlId 1002", action);
@@ -1162,8 +1163,9 @@ xrdp_rdp_process_data_control(struct xrdp_rdp *self, struct stream *s)
                   "TS_SYNCHRONIZE_PDU, TS_CONTROL_PDU with CTRLACTION_COOPERATE, "
                   " and TS_CONTROL_PDU with CTRLACTION_GRANTED_CONTROL");
         xrdp_rdp_send_synchronise(self);
-        xrdp_rdp_send_control(self, RDP_CTL_COOPERATE);
-        xrdp_rdp_send_control(self, RDP_CTL_GRANT_CONTROL);
+        xrdp_rdp_send_control(self, RDP_CTL_COOPERATE, 0, 0);
+        xrdp_rdp_send_control(self, RDP_CTL_GRANT_CONTROL,
+                              self->mcs_channel, 0x03ea);
     }
     else
     {