Fixed #6013: Check new length is > 0

FreeRDP · Apr 2, 2020 · 67c2aa5 · 67c2aa5
1 parent 3627aaf
commit 67c2aa5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/libfreerdp/core/orders.c b/libfreerdp/core/orders.c
@@ -2161,7 +2161,7 @@ static CACHE_BITMAP_V3_ORDER* update_read_cache_bitmap_v3_order(rdpUpdate* updat
 	Stream_Read_UINT16(s, bitmapData->height); /* height (2 bytes) */
 	Stream_Read_UINT32(s, new_len);            /* length (4 bytes) */
 
-	if (Stream_GetRemainingLength(s) < new_len)
+	if ((new_len == 0) || (Stream_GetRemainingLength(s) < new_len))
 		goto fail;
 
 	new_data = (BYTE*)realloc(bitmapData->data, new_len);