diff options
Diffstat (limited to 'libxrdp')
| -rw-r--r-- | libxrdp/xrdp_fastpath.c | 52 | ||||
| -rw-r--r-- | libxrdp/xrdp_sec.c | 43 |
2 files changed, 71 insertions, 24 deletions
diff --git a/libxrdp/xrdp_fastpath.c b/libxrdp/xrdp_fastpath.c index 5f7ccc97..d031f003 100644 --- a/libxrdp/xrdp_fastpath.c +++ b/libxrdp/xrdp_fastpath.c @@ -57,27 +57,31 @@ int APP_CC xrdp_fastpath_recv(struct xrdp_fastpath *self, struct stream *s) { int fp_hdr; - int len = 0; + int len = 0; /* unused */ int byte; - int hdr_len = 2; /* fastpath header length - can be 2 or 3 bytes long, depends on length */ DEBUG((" in xrdp_fastpath_recv")); + if (!s_check_rem(s, 2)) + { + return 1; + } in_uint8(s, fp_hdr); /* fpInputHeader (1 byte) */ - //g_writeln("xrdp_fastpath_recv: header= 0x%8.8x", fp_hdr); + in_uint8(s, byte); /* length 1 (1 byte) */ self->numEvents = (fp_hdr & 0x3C) >> 2; self->secFlags = (fp_hdr & 0xC0) >> 6; - // receive fastpath first length packet - in_uint8(s, byte); /* length 1 */ - if (byte & 0x80) { byte &= ~(0x80); len = (byte << 8); - // receive fastpath second length packet - in_uint8(s, byte); /* length 2 */ - hdr_len++; + + if (!s_check_rem(s, 1)) + { + return 1; + } + in_uint8(s, byte); /* length 2 (1 byte) */ + len += byte; } else @@ -85,8 +89,6 @@ xrdp_fastpath_recv(struct xrdp_fastpath *self, struct stream *s) len = byte; } -// g_writeln("len= %d , numEvents= %d, secFlags= %d, bytesleft: %d", len, self->numEvents, self->secFlags, (s->p - s->data)); - DEBUG((" out xrdp_fastpath_recv")); return 0; @@ -254,8 +256,11 @@ xrdp_fastpath_process_EVENT_SCANCODE(struct xrdp_fastpath *self, int eventFlags, int code; flags = 0; + if (!s_check_rem(s, 1)) + { + return 1; + } in_uint8(s, code); /* keyCode (1 byte) */ - //g_writeln("scan code detected: %d", code); if ((eventFlags & FASTPATH_INPUT_KBDFLAGS_RELEASE)) flags |= KBD_FLAG_UP; @@ -287,6 +292,10 @@ xrdp_fastpath_process_EVENT_MOUSE(struct xrdp_fastpath *self, int eventFlags, st int xPos; int yPos; + if (!s_check_rem(s, 2 + 2 + 2)) + { + return 1; + } in_uint16_le(s, pointerFlags); /* pointerFlags (2 bytes) */ in_uint16_le(s, xPos); /* xPos (2 bytes) */ in_uint16_le(s, yPos); /* yPos (2 bytes) */ @@ -313,6 +322,10 @@ xrdp_fastpath_process_EVENT_MOUSEX(struct xrdp_fastpath *self, int eventFlags, s int xPos; int yPos; + if (!s_check_rem(s, 2 + 2 + 2)) + { + return 1; + } in_uint16_le(s, pointerFlags); /* pointerFlags (2 bytes) */ in_uint16_le(s, xPos); /* xPos (2 bytes) */ in_uint16_le(s, yPos); /* yPos (2 bytes) */ @@ -358,6 +371,10 @@ xrdp_fastpath_process_EVENT_SYNC(struct xrdp_fastpath *self, int eventCode, int int APP_CC xrdp_fastpath_process_EVENT_UNICODE(struct xrdp_fastpath *self, int eventFlags, struct stream *s) { + if (!s_check_rem(s, 2)) + { + return 1; + } in_uint8s(s, 2); return 0; } @@ -373,13 +390,17 @@ xrdp_fastpath_process_input_event(struct xrdp_fastpath *self, struct stream *s) // process fastpath input events for (i = 0 ; i < self->numEvents ; i++) { + if (!s_check_rem(s, 1)) + { + return 1; + } in_uint8(s, eventHeader); eventFlags = (eventHeader & 0x1F); eventCode = (eventHeader >> 5); -// g_writeln("eventCode= %d, eventFlags= %d, numEvents= %d", -// eventCode, eventFlags, self->sec_layer->fastpath_layer->numEvents); + //DEBUG(("xrdp_fastpath_process_input_event: eventCode= %d, eventFlags= %d, numEvents= %d", + // eventCode, eventFlags, self->sec_layer->fastpath_layer->numEvents)); switch (eventCode) { @@ -413,10 +434,9 @@ xrdp_fastpath_process_input_event(struct xrdp_fastpath *self, struct stream *s) { return 1; } - break; default: - g_writeln("xrdp_rdp_process_fastpath_data_input: unknown eventCode %d", eventCode); + g_writeln("xrdp_fastpath_process_input_event: unknown eventCode %d", eventCode); break; } diff --git a/libxrdp/xrdp_sec.c b/libxrdp/xrdp_sec.c index c99f9188..6c04a2e5 100644 --- a/libxrdp/xrdp_sec.c +++ b/libxrdp/xrdp_sec.c @@ -955,20 +955,43 @@ xrdp_sec_establish_keys(struct xrdp_sec *self) int APP_CC xrdp_sec_recv_fastpath(struct xrdp_sec *self, struct stream *s) { + int ver; + int len; + int pad; + if (xrdp_fastpath_recv(self->fastpath_layer, s) != 0) { return 1; } if (self->crypt_level == CRYPT_LEVEL_FIPS) { - in_uint8s(s, 4); /* fipsInformation (4 bytes) */ - } - - in_uint8s(s, 8); /* dataSignature (8 bytes), skip for now */ - - if (self->fastpath_layer->secFlags & FASTPATH_INPUT_ENCRYPTED) - { - xrdp_sec_decrypt(self, s->p, (int)(s->end - s->p)); + if (!s_check_rem(s, 4)) + { + return 1; + } + in_uint16_le(s, len); + in_uint8(s, ver); /* length (2 bytes) */ + if (len != 0x10) /* length MUST set to 0x10 */ + { + return 1; + } + in_uint8(s, pad); + LLOGLN(10, ("xrdp_sec_recv_fastpath: len %d ver %d pad %d", len, ver, pad)); + in_uint8s(s, 8); /* dataSignature (8 bytes), skip for now */ + LLOGLN(10, ("xrdp_sec_recv_fastpath: data len %d", (int)(s->end - s->p))); + xrdp_sec_fips_decrypt(self, s->p, (int)(s->end - s->p)); + s->end -= pad; + } else { + if (!s_check_rem(s, 8)) + { + return 1; + } + in_uint8s(s, 8); /* dataSignature (8 bytes), skip for now */ + + if (self->fastpath_layer->secFlags & FASTPATH_INPUT_ENCRYPTED) + { + xrdp_sec_decrypt(self, s->p, (int)(s->end - s->p)); + } } if (self->fastpath_layer->numEvents == 0) { @@ -976,6 +999,10 @@ xrdp_sec_recv_fastpath(struct xrdp_sec *self, struct stream *s) * If numberEvents is not provided in fpInputHeader, it will be provided * as one additional byte here. */ + if (!s_check_rem(s, 8)) + { + return 1; + } in_uint8(s, self->fastpath_layer->numEvents); /* numEvents (1 byte) (optional) */ } |