From 4e64b3356b155835d991bcb70a9aa914252fece7 Mon Sep 17 00:00:00 2001 From: akallabeth Date: Tue, 16 Apr 2024 08:47:31 +0200 Subject: [PATCH] fix off by one length check CVE: CVE-2024-32460 Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/ecfafe4ad054435d84cb7b111ea73ebd46832fb6] Signed-off-by: Gyorgy Sarvari --- libfreerdp/codec/interleaved.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libfreerdp/codec/interleaved.c b/libfreerdp/codec/interleaved.c index 75b2e2775..df148b667 100644 --- a/libfreerdp/codec/interleaved.c +++ b/libfreerdp/codec/interleaved.c @@ -237,7 +237,7 @@ static UINT ExtractRunLengthLiteFgBg(const BYTE* pbOrderHdr, const BYTE* pbEnd, runLength = *pbOrderHdr & g_MaskLiteRunLength; if (runLength == 0) { - if (!buffer_within_range(pbOrderHdr, 1, pbEnd)) + if (!buffer_within_range(pbOrderHdr, 2, pbEnd)) { *advance = 0; return 0;