francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
120 lines
4.2 KiB
Diff
120 lines
4.2 KiB
Diff
From 3033c4d69afbb23f577cf6962314613ef96782fd Mon Sep 17 00:00:00 2001
|
|
From: akallabeth <akallabeth@posteo.net>
|
|
Date: Tue, 16 Apr 2024 08:42:52 +0200
|
|
Subject: [PATCH] fix missing input length checks
|
|
|
|
CVE: CVE-2024-32458
|
|
Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/9da3f236985207378abe64bc401cecd8566e4542]
|
|
|
|
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
|
|
---
|
|
libfreerdp/codec/planar.c | 54 +++++++++++++++++++++++++++++----------
|
|
1 file changed, 40 insertions(+), 14 deletions(-)
|
|
|
|
diff --git a/libfreerdp/codec/planar.c b/libfreerdp/codec/planar.c
|
|
index 0ec086269..4b51a023e 100644
|
|
--- a/libfreerdp/codec/planar.c
|
|
+++ b/libfreerdp/codec/planar.c
|
|
@@ -788,18 +788,26 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
|
|
rawHeights[3] = nSrcHeight;
|
|
}
|
|
|
|
+ const size_t diff = srcp - pSrcData;
|
|
+ if (SrcSize < diff)
|
|
+ {
|
|
+ WLog_ERR(TAG, "Size mismatch %" PRIu32 " < %" PRIuz, SrcSize, diff);
|
|
+ return FALSE;
|
|
+ }
|
|
+
|
|
if (!rle) /* RAW */
|
|
{
|
|
+
|
|
UINT32 base = planeSize * 3;
|
|
if (cs)
|
|
base = planeSize + planeSize / 2;
|
|
|
|
if (alpha)
|
|
{
|
|
- if ((SrcSize - (srcp - pSrcData)) < (planeSize + base))
|
|
+ if ((SrcSize - diff) < (planeSize + base))
|
|
{
|
|
- WLog_ERR(TAG, "Alpha plane size mismatch %" PRIu32 " < %" PRIu32,
|
|
- SrcSize - (srcp - pSrcData), (planeSize + base));
|
|
+ WLog_ERR(TAG, "Alpha plane size mismatch %" PRIuz " < %" PRIu32, SrcSize - diff,
|
|
+ (planeSize + base));
|
|
return FALSE;
|
|
}
|
|
|
|
@@ -817,10 +825,9 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
|
|
}
|
|
else
|
|
{
|
|
- if ((SrcSize - (srcp - pSrcData)) < base)
|
|
+ if ((SrcSize - diff) < base)
|
|
{
|
|
- WLog_ERR(TAG, "plane size mismatch %" PRIu32 " < %" PRIu32,
|
|
- SrcSize - (srcp - pSrcData), base);
|
|
+ WLog_ERR(TAG, "plane size mismatch %" PRIu32 " < %" PRIu32, SrcSize - diff, base);
|
|
return FALSE;
|
|
}
|
|
|
|
@@ -841,8 +848,8 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
|
|
if (alpha)
|
|
{
|
|
planes[3] = srcp;
|
|
- rleSizes[3] = planar_skip_plane_rle(planes[3], SrcSize - (planes[3] - pSrcData),
|
|
- rawWidths[3], rawHeights[3]); /* AlphaPlane */
|
|
+ rleSizes[3] = planar_skip_plane_rle(planes[3], SrcSize - diff, rawWidths[3],
|
|
+ rawHeights[3]); /* AlphaPlane */
|
|
|
|
if (rleSizes[3] < 0)
|
|
return FALSE;
|
|
@@ -852,22 +859,41 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
|
|
else
|
|
planes[0] = srcp;
|
|
|
|
- rleSizes[0] = planar_skip_plane_rle(planes[0], SrcSize - (planes[0] - pSrcData),
|
|
- rawWidths[0], rawHeights[0]); /* RedPlane */
|
|
+ const size_t diff0 = (planes[0] - pSrcData);
|
|
+ if (SrcSize < diff0)
|
|
+ {
|
|
+ WLog_ERR(TAG, "Size mismatch %" PRIu32 " < %" PRIuz, SrcSize, diff0);
|
|
+ return FALSE;
|
|
+ }
|
|
+ rleSizes[0] = planar_skip_plane_rle(planes[0], SrcSize - diff0, rawWidths[0],
|
|
+ rawHeights[0]); /* RedPlane */
|
|
|
|
if (rleSizes[0] < 0)
|
|
return FALSE;
|
|
|
|
planes[1] = planes[0] + rleSizes[0];
|
|
- rleSizes[1] = planar_skip_plane_rle(planes[1], SrcSize - (planes[1] - pSrcData),
|
|
- rawWidths[1], rawHeights[1]); /* GreenPlane */
|
|
+
|
|
+ const size_t diff1 = (planes[1] - pSrcData);
|
|
+ if (SrcSize < diff1)
|
|
+ {
|
|
+ WLog_ERR(TAG, "Size mismatch %" PRIu32 " < %" PRIuz, SrcSize, diff1);
|
|
+ return FALSE;
|
|
+ }
|
|
+ rleSizes[1] = planar_skip_plane_rle(planes[1], SrcSize - diff1, rawWidths[1],
|
|
+ rawHeights[1]); /* GreenPlane */
|
|
|
|
if (rleSizes[1] < 1)
|
|
return FALSE;
|
|
|
|
planes[2] = planes[1] + rleSizes[1];
|
|
- rleSizes[2] = planar_skip_plane_rle(planes[2], SrcSize - (planes[2] - pSrcData),
|
|
- rawWidths[2], rawHeights[2]); /* BluePlane */
|
|
+ const size_t diff2 = (planes[2] - pSrcData);
|
|
+ if (SrcSize < diff2)
|
|
+ {
|
|
+ WLog_ERR(TAG, "Size mismatch %" PRIu32 " < %" PRIuz, SrcSize, diff);
|
|
+ return FALSE;
|
|
+ }
|
|
+ rleSizes[2] = planar_skip_plane_rle(planes[2], SrcSize - diff2, rawWidths[2],
|
|
+ rawHeights[2]); /* BluePlane */
|
|
|
|
if (rleSizes[2] < 1)
|
|
return FALSE;
|