Skip to content

OutOfBound Read in ncrush_decompress

Low
akallabeth published GHSA-cp4q-p737-rmw9 Apr 22, 2024

Package

FreeRDP (C)

Affected versions

<= 3.4.0, <= 2.11.5

Patched versions

3.5.0, 2.11.6

Description

Impact

  • FreeRDP based Clients and Servers
int ncrush_decompress(NCRUSH_CONTEXT* ncrush, const BYTE* pSrcData, UINT32 SrcSize,
                      const BYTE** ppDstData, UINT32* pDstSize, UINT32 flags)
{
        UINT32 index = 0;
        ...
       if (!(flags & PACKET_COMPRESSED))
        {
                *ppDstData = pSrcData;
                *pDstSize = SrcSize;
                return 1;
        }

        const BYTE* SrcEnd = &pSrcData[SrcSize];
        const BYTE* SrcPtr = pSrcData + 4;

        INT32 nbits = 32;
[1]        UINT32 bits = get_dword(pSrcData);
         ...

1 - out-of-bounds read in case SrcSize less than 4

Patches

Workarounds

none

References

  • Reported by Evgeny Legerov of Kaspersky Lab.
  • #10077

Severity

Low

CVE ID

CVE-2024-32459

Weaknesses

No CWEs