mirror of
https://github.com/FreeRDP/FreeRDP.git
synced 2025-06-03 00:00:20 +00:00
[out-of-bounds] fix oob reads
This commit is contained in:
parent
7e0e62c5ce
commit
3d9dcaece7
@ -1116,7 +1116,7 @@ BOOL rpc_client_write_call(rdpRpc* rpc, wStream* s, UINT16 opnum)
|
||||
CopyMemory(&buffer[offset], &request_pdu.auth_verifier.auth_type, 8);
|
||||
offset += 8;
|
||||
|
||||
if (offset > UINT32_MAX)
|
||||
if (offset > request_pdu.header.frag_length)
|
||||
goto fail;
|
||||
|
||||
plaintext.pvBuffer = buffer;
|
||||
|
@ -256,7 +256,7 @@ void* UwacClipboardDataGet(UwacSeat* seat, const char* mime, size_t* size)
|
||||
|
||||
data = tmp;
|
||||
|
||||
if (pos > alloc)
|
||||
if (pos >= alloc)
|
||||
goto fail;
|
||||
|
||||
r = read(pipefd[0], &data[pos], alloc - pos);
|
||||
|
@ -181,6 +181,7 @@ static BOOL IniFile_Load_File(wIniFile* ini, const char* filename)
|
||||
goto out_file;
|
||||
|
||||
ini->buffer[fileSize] = '\n';
|
||||
ini->buffer[fileSize + 1] = '\0';
|
||||
IniFile_Load_NextLine(ini, ini->buffer);
|
||||
rc = TRUE;
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user