Fixed #6005: Bounds checks in update_read_bitmap_data

FreeRDP · Apr 2, 2020 · f8890a6 · f8890a6
1 parent ed53cd1
commit f8890a6
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/libfreerdp/core/update.c b/libfreerdp/core/update.c
@@ -103,6 +103,9 @@ static BOOL update_read_bitmap_data(rdpUpdate* update, wStream* s, BITMAP_DATA*
 	{
 		if (!(bitmapData->flags & NO_BITMAP_COMPRESSION_HDR))
 		{
+			if (Stream_GetRemainingLength(s) < 8)
+				return FALSE;
+
 			Stream_Read_UINT16(s,
 			                   bitmapData->cbCompFirstRowSize); /* cbCompFirstRowSize (2 bytes) */
 			Stream_Read_UINT16(s,