static BOOL clear_decompress_residual_data(CLEAR_CONTEXT* clear, wStream* s,
UINT32 residualByteCount, UINT32 nWidth, UINT32 nHeight,
BYTE* pDstData, UINT32 DstFormat, UINT32 nDstStep,
UINT32 nXDst, UINT32 nYDst, UINT32 nDstWidth,
UINT32 nDstHeight, const gdiPalette* palette)
{
UINT32 nSrcStep = 0;
UINT32 suboffset = 0;
BYTE* dstBuffer = NULL;
UINT32 pixelIndex = 0;
UINT32 pixelCount = 0;
...
Stream_Read_UINT8(s, b);
Stream_Read_UINT8(s, g);
Stream_Read_UINT8(s, r);
Stream_Read_UINT8(s, runLengthFactor);
suboffset += 4;
color = FreeRDPGetColor(clear->format, r, g, b, 0xFF);
if (runLengthFactor >= 0xFF)
{
if (!Stream_CheckAndLogRequiredLength(TAG, s, 2))
return FALSE;
Stream_Read_UINT16(s, runLengthFactor);
suboffset += 2;
if (runLengthFactor >= 0xFFFF)
{
if (!Stream_CheckAndLogRequiredLength(TAG, s, 4))
return FALSE;
[1] Stream_Read_UINT32(s, runLengthFactor);
suboffset += 4;
}
}
[2] if ((pixelIndex + runLengthFactor) > pixelCount)
{
WLog_ERR(TAG,
"pixelIndex %" PRIu32 " + runLengthFactor %" PRIu32 " > pixelCount %" PRIu32
"",
pixelIndex, runLengthFactor, pixelCount);
return FALSE;
}
[3] for (UINT32 i = 0; i < runLengthFactor; i++)
{
FreeRDPWriteColor(dstBuffer, clear->format, color);
dstBuffer += FreeRDPGetBytesPerPixel(clear->format);
}
pixelIndex += runLengthFactor;
}
Impact
FreeRDP
based clientsPatches
3.5.0 - 1208f23 (#10077 3a2a241)
2.11.6 - d88ad1a
Workarounds
/gfx
options (e.g. deactivate with/bpp:32
or/rfx
as it is on by default)References