[codec,ncrush] fix missing input length check

FreeRDP · Apr 16, 2024 · dbe5d52 · dbe5d52
1 parent 52d75f6
commit dbe5d52
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/libfreerdp/codec/ncrush.c b/libfreerdp/codec/ncrush.c
@@ -2068,6 +2068,12 @@ int ncrush_decompress(NCRUSH_CONTEXT* ncrush, const BYTE* pSrcData, UINT32 SrcSi
 		return 1;
 	}
 
+	if (SrcSize < 4)
+	{
+		WLog_ERR(TAG, "Input size short: SrcSize %" PRIu32 " < 4", SrcSize);
+		return -1;
+	}
+
 	const BYTE* SrcEnd = &pSrcData[SrcSize];
 	const BYTE* SrcPtr = pSrcData + 4;