pxcloud/freerdp2
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Backport of CVE-2023-39355

Browse Source 
upstream is using in later version aligned memory allocation, so using memaling to simulate that.
That of course required to memset it afterwards, as upstream used calloc for the allocation before.
This commit is contained in:
Tobias Frost 2023-10-03 10:57:01 +02:00
parent 21305b53c4
commit 6ae95183f4
3 changed files with 84 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
debian/changelog vendored
View File

@ -14,7 +14,7 @@ freerdp2 (2.3.0+dfsg1-2~deb10u3) UNRELEASED; urgency=medium
CVE-2020-13397 CVE-2020-13398 and
CVE-2020-15103 (Closes: #965979)
* Backporting remaining issues: (Closes: #1051638)
CVE-2023-39350 CVE-2023-39354
CVE-2023-39350 CVE-2023-39354 CVE-2023-39355
-- Tobias Frost <tobi@debian.org> Mon, 02 Oct 2023 17:10:48 +0200

82
debian/patches/0038-CVE-2023-39355.patch vendored Normal file
View File

@ -0,0 +1,82 @@
Description: Upstream fix for CVE-2023-39355 - Use-After-Free in RDPGFX_CMDID_RESETGRAPHICS
Origin: https://github.com/FreeRDP/FreeRDP/commit/d6f9d33a7db0b346195b6a15b5b99944ba41beee
Bug: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hvwj-vmg6-2f5h
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051638
From d6f9d33a7db0b346195b6a15b5b99944ba41beee Mon Sep 17 00:00:00 2001
From: Armin Novak <anovak@thincast.com>
Date: Sat, 5 Aug 2023 10:15:41 +0200
Subject: [PATCH] [codec,planar] fix reset
---
libfreerdp/codec/planar.c | 62 ++++++++++++++++++++++-----------------
1 file changed, 35 insertions(+), 27 deletions(-)
--- a/libfreerdp/codec/planar.c
+++ b/libfreerdp/codec/planar.c
@@ -847,6 +847,9 @@
{
BYTE* rleBuffer[4] = { 0 };
+ if (!planar->rlePlanesBuffer)
+ return FALSE;
+
rleBuffer[3] = planar->rlePlanesBuffer; /* AlphaPlane */
rleBuffer[0] = rleBuffer[3] + planeSize; /* LumaOrRedPlane */
rleBuffer[1] = rleBuffer[0] + planeSize; /* OrangeChromaOrGreenPlane */
@@ -1486,27 +1489,41 @@
context->maxHeight = height;
context->maxPlaneSize = context->maxWidth * context->maxHeight;
context->nTempStep = context->maxWidth * 4;
+
+ memset(context->planes, 0, sizeof(context->planes));
+ memset(context->rlePlanes, 0, sizeof(context->rlePlanes));
+ memset(context->deltaPlanes, 0, sizeof(context->deltaPlanes));
+
free(context->planesBuffer);
free(context->pTempData);
free(context->deltaPlanesBuffer);
free(context->rlePlanesBuffer);
- context->planesBuffer = calloc(context->maxPlaneSize, 4);
- context->pTempData = calloc(context->maxPlaneSize, 6);
- context->deltaPlanesBuffer = calloc(context->maxPlaneSize, 4);
- context->rlePlanesBuffer = calloc(context->maxPlaneSize, 4);
- if (!context->planesBuffer || !context->pTempData || !context->deltaPlanesBuffer ||
- !context->rlePlanesBuffer)
- return FALSE;
+ if (context->maxPlaneSize > 0)
+ {
+ context->planesBuffer = memalign(32, context->maxPlaneSize * 4);
+ context->pTempData = memalign(32,context->maxPlaneSize * 6);
+ context->deltaPlanesBuffer = memalign(32, context->maxPlaneSize * 4);
+ context->rlePlanesBuffer = memalign(32, context->maxPlaneSize * 4);
+
+ if (!context->planesBuffer || !context->pTempData || !context->deltaPlanesBuffer ||
+ !context->rlePlanesBuffer)
+ return FALSE;
- context->planes[0] = &context->planesBuffer[context->maxPlaneSize * 0];
- context->planes[1] = &context->planesBuffer[context->maxPlaneSize * 1];
- context->planes[2] = &context->planesBuffer[context->maxPlaneSize * 2];
- context->planes[3] = &context->planesBuffer[context->maxPlaneSize * 3];
- context->deltaPlanes[0] = &context->deltaPlanesBuffer[context->maxPlaneSize * 0];
- context->deltaPlanes[1] = &context->deltaPlanesBuffer[context->maxPlaneSize * 1];
- context->deltaPlanes[2] = &context->deltaPlanesBuffer[context->maxPlaneSize * 2];
- context->deltaPlanes[3] = &context->deltaPlanesBuffer[context->maxPlaneSize * 3];
+ memset(context->planesBuffer , 0, context->maxPlaneSize * 4);
+ memset(context->pTempData , 0, context->maxPlaneSize * 4);
+ memset(context->deltaPlanesBuffer , 0, context->maxPlaneSize * 4);
+ memset(context->rlePlanesBuffer , 0, context->maxPlaneSize * 4);
+
+ context->planes[0] = &context->planesBuffer[context->maxPlaneSize * 0];
+ context->planes[1] = &context->planesBuffer[context->maxPlaneSize * 1];
+ context->planes[2] = &context->planesBuffer[context->maxPlaneSize * 2];
+ context->planes[3] = &context->planesBuffer[context->maxPlaneSize * 3];
+ context->deltaPlanes[0] = &context->deltaPlanesBuffer[context->maxPlaneSize * 0];
+ context->deltaPlanes[1] = &context->deltaPlanesBuffer[context->maxPlaneSize * 1];
+ context->deltaPlanes[2] = &context->deltaPlanesBuffer[context->maxPlaneSize * 2];
+ context->deltaPlanes[3] = &context->deltaPlanesBuffer[context->maxPlaneSize * 3];
+ }
return TRUE;
}

1
debian/patches/series vendored
View File

@ -25,3 +25,4 @@
1001_keep-symbol-DumpThreadHandles-if-debugging-is-disabled.patch
0036-CVE-2023-39350.patch
0037-CVE-2023-39354.patch
0038-CVE-2023-39355.patch