VUL: make sure cache entries are in range

3 files changed, 17 insertions, 5 deletions

diff --git a/xrdp/xrdp.h b/xrdp/xrdp.h
index 081adf3c..6adf17f0 100644
--- a/xrdp/xrdp.h
+++ b/xrdp/xrdp.h
@@ -27,8 +27,8 @@
 #include "trans.h"
 #include "list.h"
 #include "libxrdpinc.h"
-#include "xrdp_types.h"
 #include "xrdp_constants.h"
+#include "xrdp_types.h"
 #include "defines.h"
 #include "os_calls.h"
 #include "ssl_calls.h"
diff --git a/xrdp/xrdp_cache.c b/xrdp/xrdp_cache.c
index f421371d..b5787763 100644
--- a/xrdp/xrdp_cache.c
+++ b/xrdp/xrdp_cache.c
@@ -33,16 +33,27 @@ xrdp_cache_create(struct xrdp_wm *owner,
     self->wm = owner;
     self->session = session;
     self->use_bitmap_comp = client_info->use_bitmap_comp;
-    self->cache1_entries = client_info->cache1_entries;
+
+    self->cache1_entries = MIN(XRDP_MAX_BITMAP_CACHE_IDX,
+                               client_info->cache1_entries);
+    self->cache1_entries = MAX(self->cache1_entries, 0);
     self->cache1_size = client_info->cache1_size;
-    self->cache2_entries = client_info->cache2_entries;
+
+    self->cache2_entries = MIN(XRDP_MAX_BITMAP_CACHE_IDX,
+                               client_info->cache2_entries);
+    self->cache2_entries = MAX(self->cache2_entries, 0);
     self->cache2_size = client_info->cache2_size;
-    self->cache3_entries = client_info->cache3_entries;
+
+    self->cache3_entries = MIN(XRDP_MAX_BITMAP_CACHE_IDX,
+                               client_info->cache3_entries);
+    self->cache3_entries = MAX(self->cache3_entries, 0);
     self->cache3_size = client_info->cache3_size;
+
     self->bitmap_cache_persist_enable = client_info->bitmap_cache_persist_enable;
     self->bitmap_cache_version = client_info->bitmap_cache_version;
     self->pointer_cache_entries = client_info->pointer_cache_entries;
     self->xrdp_os_del_list = list_create();
+
     return self;
 }
 
diff --git a/xrdp/xrdp_types.h b/xrdp/xrdp_types.h
index e7bb7baf..5a43d9a9 100644
--- a/xrdp/xrdp_types.h
+++ b/xrdp/xrdp_types.h
@@ -195,7 +195,8 @@ struct xrdp_cache
   struct xrdp_palette_item palette_items[6];
   /* bitmap */
   int bitmap_stamp;
-  struct xrdp_bitmap_item bitmap_items[3][2000];
+  struct xrdp_bitmap_item bitmap_items[XRDP_MAX_BITMAP_CACHE_ID]
+                                      [XRDP_MAX_BITMAP_CACHE_IDX];
   int use_bitmap_comp;
   int cache1_entries;
   int cache1_size;