Skip to content

Commit 6b2bc41

Browse files
committed
Fix #6010: Check length in read_icon_info
1 parent 67c2aa5 commit 6b2bc41

File tree

1 file changed

+8
-3
lines changed

1 file changed

+8
-3
lines changed

Diff for: libfreerdp/core/window.c

+8-3
Original file line numberDiff line numberDiff line change
@@ -136,9 +136,6 @@ static BOOL update_read_icon_info(wStream* s, ICON_INFO* iconInfo)
136136
Stream_Read_UINT16(s, iconInfo->cbBitsMask); /* cbBitsMask (2 bytes) */
137137
Stream_Read_UINT16(s, iconInfo->cbBitsColor); /* cbBitsColor (2 bytes) */
138138

139-
if (Stream_GetRemainingLength(s) < iconInfo->cbBitsMask + iconInfo->cbBitsColor)
140-
return FALSE;
141-
142139
/* bitsMask */
143140
newBitMask = (BYTE*)realloc(iconInfo->bitsMask, iconInfo->cbBitsMask);
144141

@@ -150,6 +147,8 @@ static BOOL update_read_icon_info(wStream* s, ICON_INFO* iconInfo)
150147
}
151148

152149
iconInfo->bitsMask = newBitMask;
150+
if (Stream_GetRemainingLength(s) < iconInfo->cbBitsMask)
151+
return FALSE;
153152
Stream_Read(s, iconInfo->bitsMask, iconInfo->cbBitsMask);
154153

155154
/* colorTable */
@@ -184,7 +183,11 @@ static BOOL update_read_icon_info(wStream* s, ICON_INFO* iconInfo)
184183
}
185184

186185
if (iconInfo->colorTable)
186+
{
187+
if (Stream_GetRemainingLength(s) < iconInfo->cbColorTable)
188+
return FALSE;
187189
Stream_Read(s, iconInfo->colorTable, iconInfo->cbColorTable);
190+
}
188191

189192
/* bitsColor */
190193
newBitMask = (BYTE*)realloc(iconInfo->bitsColor, iconInfo->cbBitsColor);
@@ -197,6 +200,8 @@ static BOOL update_read_icon_info(wStream* s, ICON_INFO* iconInfo)
197200
}
198201

199202
iconInfo->bitsColor = newBitMask;
203+
if (Stream_GetRemainingLength(s) < iconInfo->cbBitsColor)
204+
return FALSE;
200205
Stream_Read(s, iconInfo->bitsColor, iconInfo->cbBitsColor);
201206
return TRUE;
202207
}

0 commit comments

Comments
 (0)