pxcloud/freerdp2
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revisit CVE-2023-39350 after updates/clarifactions from upstream.

Browse Source
This commit is contained in:
Tobias Frost 2023-10-07 10:51:01 +02:00
parent 500b4499a7
commit 43cbb16760
2 changed files with 28 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
debian/patches/0036-CVE-2023-39350.patch vendored
View File

@ -1,48 +1,40 @@
Description: Upstream fix for CVE-2023-39350 - Incorrect offset calculation leading to DOS
Origin: https://github.com/FreeRDP/FreeRDP/commit/e204fc8be5a372626b13f66daf2abafe71dbc2dc
Description: Upstream fix for CVE-2023-39350 - Global-Buffer-Overflow in ncrush_decompress
Origin: https://github.com/FreeRDP/FreeRDP/commit/7ece410ce5b5660b9191e1ccb6835158afa11822
Bug: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrrv-3w42-pffh
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051638
From e204fc8be5a372626b13f66daf2abafe71dbc2dc Mon Sep 17 00:00:00 2001
From: Armin Novak <anovak@thincast.com>
Date: Sat, 5 Aug 2023 08:57:28 +0200
Subject: [PATCH] [coded,rfx] check indices are within range
From 7ece410ce5b5660b9191e1ccb6835158afa11822 Mon Sep 17 00:00:00 2001
From: akallabeth <akallabeth@posteo.net>
Date: Fri, 4 Aug 2023 13:55:40 +0200
Subject: [PATCH] [codec,rfx] fix possible out of bound read
Allows malicious servers to crash FreeRDP based clients
reported by @pwn2carr
(cherry picked from commit a51952882f2eb3bbce6b69a7a4f9a54bf1dbb672)
---
libfreerdp/codec/rfx.c | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
libfreerdp/codec/rfx.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/libfreerdp/codec/rfx.c
+++ b/libfreerdp/codec/rfx.c
@@ -936,6 +936,31 @@
Stream_Read_UINT8(&sub, tile->quantIdxY); /* quantIdxY (1 byte) */
Stream_Read_UINT8(&sub, tile->quantIdxCb); /* quantIdxCb (1 byte) */
Stream_Read_UINT8(&sub, tile->quantIdxCr); /* quantIdxCr (1 byte) */
+ if (tile->quantIdxY >= context->numQuant)
@@ -1106,8 +1106,18 @@
}
}
- Stream_StaticInit(&subStream, Stream_Pointer(s), blockLen - (6 + extraBlockLen));
- Stream_Seek(s, blockLen - (6 + extraBlockLen));
+ const size_t blockLenNoHeader = blockLen - 6;
+ if (blockLenNoHeader < extraBlockLen)
+ {
+ WLog_Print(context->priv->log, WLOG_ERROR,
+ "quantIdxY %" PRIu8 " >= numQuant %" PRIu8, tile->quantIdxY,
+ context->numQuant);
+ rc = FALSE;
+ break;
+ }
+ if (tile->quantIdxCb >= context->numQuant)
+ {
+ WLog_Print(context->priv->log, WLOG_ERROR,
+ "quantIdxCb %" PRIu8 " >= numQuant %" PRIu8, tile->quantIdxCb,
+ context->numQuant);
+ rc = FALSE;
+ break;
+ }
+ if (tile->quantIdxCr >= context->numQuant)
+ {
+ WLog_Print(context->priv->log, WLOG_ERROR,
+ "quantIdxCr %" PRIu8 " >= numQuant %" PRIu8, tile->quantIdxCr,
+ context->numQuant);
+ rc = FALSE;
+ break;
+ "blockLen too small(%" PRIu32 "), must be >= 6 + %" PRIu16, blockLen,
+ extraBlockLen);
+ return FALSE;
+ }
+
Stream_Read_UINT16(&sub, tile->xIdx); /* xIdx (2 bytes) */
Stream_Read_UINT16(&sub, tile->yIdx); /* yIdx (2 bytes) */
Stream_Read_UINT16(&sub, tile->YLen); /* YLen (2 bytes) */
+ const size_t subStreamLen = blockLenNoHeader - extraBlockLen;
+ Stream_StaticInit(&subStream, Stream_Pointer(s), subStreamLen);
+ Stream_Seek(s, subStreamLen);
switch (blockType)
{

3
debian/patches/series vendored
View File

@ -24,6 +24,3 @@
0035-Fixed-6989-Use-X509_STORE_set_default_paths.patch
1001_keep-symbol-DumpThreadHandles-if-debugging-is-disabled.patch
0036-CVE-2023-39350.patch
0037-CVE-2023-39354.patch
0038-CVE-2023-39355.patch
0040-CVE-2023-40589.patch