diff options
| author | Jay Sorg <jay.sorg@gmail.com> | 2013-09-10 16:02:35 -0700 |
|---|---|---|
| committer | Jay Sorg <jay.sorg@gmail.com> | 2013-09-10 16:02:35 -0700 |
| commit | 369b090e38c1000ffd9a931615c3442692b0da18 (patch) | |
| tree | 87346efb39422681207a2337a1b46d05d4d05ba6 /libxrdp | |
| parent | 39ed446e1513c52f795d090fc9b1f173c0912d6a (diff) | |
| download | xrdp-proprietary-369b090e38c1000ffd9a931615c3442692b0da18.tar.gz xrdp-proprietary-369b090e38c1000ffd9a931615c3442692b0da18.zip | |
VUL: fix some possible buffer overruns
Diffstat (limited to 'libxrdp')
| -rw-r--r-- | libxrdp/xrdp_mcs.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libxrdp/xrdp_mcs.c b/libxrdp/xrdp_mcs.c index cdcfeee6..8c8b7ad6 100644 --- a/libxrdp/xrdp_mcs.c +++ b/libxrdp/xrdp_mcs.c @@ -385,6 +385,12 @@ xrdp_mcs_recv_connect_initial(struct xrdp_mcs *self) return 1; } + if (!s_check_rem(s, len)) + { + free_stream(s); + return 1; + } + /* make a copy of client mcs data */ init_stream(self->client_mcs_data, len); out_uint8a(self->client_mcs_data, s->p, len); |