From 8e385887fb3ffe0ec50f8c2cbdcbc66b5ff1569e Mon Sep 17 00:00:00 2001 From: akallabeth Date: Tue, 16 Apr 2024 08:45:03 +0200 Subject: [PATCH] fix missing input length check CVE: CVE-2024-32459 Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/91a1535f88a00bbb2b212b6a808a021aa4f486f8] Signed-off-by: Gyorgy Sarvari --- libfreerdp/codec/ncrush.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libfreerdp/codec/ncrush.c b/libfreerdp/codec/ncrush.c index 4a7162c89..69921853b 100644 --- a/libfreerdp/codec/ncrush.c +++ b/libfreerdp/codec/ncrush.c @@ -2068,6 +2068,12 @@ int ncrush_decompress(NCRUSH_CONTEXT* ncrush, const BYTE* pSrcData, UINT32 SrcSi return 1; } + if (SrcSize < 4) + { + WLog_ERR(TAG, "Input size short: SrcSize %" PRIu32 " < 4", SrcSize); + return -1; + } + const BYTE* SrcEnd = &pSrcData[SrcSize]; const BYTE* SrcPtr = pSrcData + 4;