Skip to content

Commit 17c363a

Browse files
committed
Thanks to Eyal Itkin from Check Point Software Technologies.
1 parent d1112c2 commit 17c363a

File tree

1 file changed

+23
-2
lines changed

1 file changed

+23
-2
lines changed

Diff for: libfreerdp/codec/zgfx.c

+23-2
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,7 @@ static INLINE BOOL zgfx_GetBits(ZGFX_CONTEXT* _zgfx, UINT32 _nbits)
137137
_zgfx->cBitsCurrent -= _nbits;
138138
_zgfx->bits = _zgfx->BitsCurrent >> _zgfx->cBitsCurrent;
139139
_zgfx->BitsCurrent &= ((1 << _zgfx->cBitsCurrent) - 1);
140+
return TRUE;
140141
}
141142

142143
static void zgfx_history_buffer_ring_write(ZGFX_CONTEXT* zgfx, const BYTE* src, size_t count)
@@ -229,9 +230,15 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t
229230
UINT32 count;
230231
UINT32 distance;
231232
BYTE* pbSegment;
232-
size_t cbSegment = segmentSize - 1;
233+
size_t cbSegment;
233234

234-
if ((Stream_GetRemainingLength(stream) < segmentSize) || (segmentSize < 1))
235+
if (!zgfx || !stream)
236+
return FALSE;
237+
238+
cbSegment = segmentSize - 1;
239+
240+
if ((Stream_GetRemainingLength(stream) < segmentSize) || (segmentSize < 1) ||
241+
(segmentSize > UINT32_MAX))
235242
return FALSE;
236243

237244
Stream_Read_UINT8(stream, flags); /* header (1 byte) */
@@ -242,6 +249,10 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t
242249
if (!(flags & PACKET_COMPRESSED))
243250
{
244251
zgfx_history_buffer_ring_write(zgfx, pbSegment, cbSegment);
252+
253+
if (cbSegment > sizeof(zgfx->OutputBuffer))
254+
return FALSE;
255+
245256
CopyMemory(zgfx->OutputBuffer, pbSegment, cbSegment);
246257
zgfx->OutputCount = cbSegment;
247258
return TRUE;
@@ -280,6 +291,9 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t
280291
if (++zgfx->HistoryIndex == zgfx->HistoryBufferSize)
281292
zgfx->HistoryIndex = 0;
282293

294+
if (zgfx->OutputCount >= sizeof(zgfx->OutputBuffer))
295+
return FALSE;
296+
283297
zgfx->OutputBuffer[zgfx->OutputCount++] = c;
284298
}
285299
else
@@ -313,6 +327,9 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t
313327
count += zgfx->bits;
314328
}
315329

330+
if (count > sizeof(zgfx->OutputBuffer) - zgfx->OutputCount)
331+
return FALSE;
332+
316333
zgfx_history_buffer_ring_read(zgfx, distance, &(zgfx->OutputBuffer[zgfx->OutputCount]), count);
317334
zgfx_history_buffer_ring_write(zgfx, &(zgfx->OutputBuffer[zgfx->OutputCount]), count);
318335
zgfx->OutputCount += count;
@@ -325,6 +342,10 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t
325342
zgfx->cBitsRemaining -= zgfx->cBitsCurrent;
326343
zgfx->cBitsCurrent = 0;
327344
zgfx->BitsCurrent = 0;
345+
346+
if (count > sizeof(zgfx->OutputBuffer) - zgfx->OutputCount)
347+
return FALSE;
348+
328349
CopyMemory(&(zgfx->OutputBuffer[zgfx->OutputCount]), zgfx->pbInputCurrent, count);
329350
zgfx_history_buffer_ring_write(zgfx, zgfx->pbInputCurrent, count);
330351
zgfx->pbInputCurrent += count;

0 commit comments

Comments
 (0)