Skip to content

Commit e865c24

Browse files
committed
Added missing length checks in zgfx_decompress_segment
(cherry picked from commit 64716b3)
1 parent ff82ae8 commit e865c24

File tree

1 file changed

+7
-4
lines changed

1 file changed

+7
-4
lines changed

Diff for: libfreerdp/codec/zgfx.c

+7-4
Original file line numberDiff line numberDiff line change
@@ -230,19 +230,19 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t
230230
BYTE* pbSegment;
231231
size_t cbSegment;
232232

233-
if (!zgfx || !stream)
233+
if (!zgfx || !stream || (segmentSize < 2))
234234
return FALSE;
235235

236236
cbSegment = segmentSize - 1;
237237

238-
if ((Stream_GetRemainingLength(stream) < segmentSize) || (segmentSize < 1) ||
239-
(segmentSize > UINT32_MAX))
238+
if ((Stream_GetRemainingLength(stream) < segmentSize) || (segmentSize > UINT32_MAX))
240239
return FALSE;
241240

242241
Stream_Read_UINT8(stream, flags); /* header (1 byte) */
243242
zgfx->OutputCount = 0;
244243
pbSegment = Stream_Pointer(stream);
245-
Stream_Seek(stream, cbSegment);
244+
if (!Stream_SafeSeek(stream, cbSegment))
245+
return FALSE;
246246

247247
if (!(flags & PACKET_COMPRESSED))
248248
{
@@ -346,6 +346,9 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t
346346
if (count > sizeof(zgfx->OutputBuffer) - zgfx->OutputCount)
347347
return FALSE;
348348

349+
if (count > zgfx->cBitsRemaining / 8)
350+
return FALSE;
351+
349352
CopyMemory(&(zgfx->OutputBuffer[zgfx->OutputCount]), zgfx->pbInputCurrent,
350353
count);
351354
zgfx_history_buffer_ring_write(zgfx, zgfx->pbInputCurrent, count);

0 commit comments

Comments
 (0)