Skip to content

Commit c367f65

Browse files
authored
Merge pull request #6019 from akallabeth/bound_access_fixes
Fix issues with boundary access.
2 parents e3b3b52 + 6f00add commit c367f65

File tree

10 files changed

+419
-379
lines changed

10 files changed

+419
-379
lines changed

Diff for: libfreerdp/cache/bitmap.c

+3-2
Original file line numberDiff line numberDiff line change
@@ -281,11 +281,12 @@ rdpBitmapCache* bitmap_cache_new(rdpSettings* settings)
281281
bitmapCache->settings = settings;
282282
bitmapCache->update = ((freerdp*)settings->instance)->update;
283283
bitmapCache->context = bitmapCache->update->context;
284-
bitmapCache->maxCells = settings->BitmapCacheV2NumCells;
285-
bitmapCache->cells = (BITMAP_V2_CELL*)calloc(bitmapCache->maxCells, sizeof(BITMAP_V2_CELL));
284+
bitmapCache->cells =
285+
(BITMAP_V2_CELL*)calloc(settings->BitmapCacheV2NumCells, sizeof(BITMAP_V2_CELL));
286286

287287
if (!bitmapCache->cells)
288288
goto fail;
289+
bitmapCache->maxCells = settings->BitmapCacheV2NumCells;
289290

290291
for (i = 0; i < (int)bitmapCache->maxCells; i++)
291292
{

Diff for: libfreerdp/core/autodetect.c

+2
Original file line numberDiff line numberDiff line change
@@ -465,6 +465,8 @@ static BOOL autodetect_recv_bandwidth_measure_results(rdpRdp* rdp, wStream* s,
465465
return FALSE;
466466

467467
WLog_VRB(AUTODETECT_TAG, "received Bandwidth Measure Results PDU");
468+
if (Stream_GetRemainingLength(s) < 8)
469+
return -1;
468470
Stream_Read_UINT32(s, rdp->autodetect->bandwidthMeasureTimeDelta); /* timeDelta (4 bytes) */
469471
Stream_Read_UINT32(s, rdp->autodetect->bandwidthMeasureByteCount); /* byteCount (4 bytes) */
470472

0 commit comments

Comments
 (0)