Skip to content

Commit 09b9d4f

Browse files
committed
Thanks to Eyal Itkin from Check Point Software Technologies.
1 parent 445a5a4 commit 09b9d4f

File tree

1 file changed

+9
-1
lines changed

1 file changed

+9
-1
lines changed

Diff for: libfreerdp/gdi/graphics.c

+9-1
Original file line numberDiff line numberDiff line change
@@ -141,9 +141,17 @@ static BOOL gdi_Bitmap_Decompress(rdpContext* context, rdpBitmap* bitmap,
141141
{
142142
UINT32 SrcSize = length;
143143
rdpGdi* gdi = context->gdi;
144+
UINT32 size = DstWidth * DstHeight;
144145
bitmap->compressed = FALSE;
145146
bitmap->format = gdi->dstFormat;
146-
bitmap->length = DstWidth * DstHeight * GetBytesPerPixel(bitmap->format);
147+
148+
if ((GetBytesPerPixel(bitmap->format) == 0) ||
149+
(DstWidth == 0) || (DstHeight == 0) || (DstWidth > UINT32_MAX / DstHeight) ||
150+
(size > (UINT32_MAX / GetBytesPerPixel(bitmap->format))))
151+
return FALSE;
152+
153+
size *= GetBytesPerPixel(bitmap->format);
154+
bitmap->length = size;
147155
bitmap->data = (BYTE*) _aligned_malloc(bitmap->length, 16);
148156

149157
if (!bitmap->data)

0 commit comments

Comments
 (0)