pxcloud/freerdp2
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Backport patch for CVE-2023-39352.

Browse Source
This commit is contained in:
Tobias Frost 2023-10-07 11:10:12 +02:00
parent a4c483bc30
commit 792f6a14d1
3 changed files with 126 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
debian/changelog vendored
View File

@ -13,8 +13,8 @@ freerdp2 (2.3.0+dfsg1-2~deb10u3) UNRELEASED; urgency=medium
CVE-2020-11097 CVE-2020-11098 CVE-2020-11099 CVE-2020-13396
CVE-2020-13397 CVE-2020-13398 and
CVE-2020-15103 (Closes: #965979)
* Backporting remaining issues: (Closes: #1051638)
CVE-2023-39350 CVE-2023-39351
* Backporting/Importing upstream patches for (Closes: #1051638):
CVE-2023-39350 CVE-2023-39351 CVE-2023-39352
-- Tobias Frost <tobi@debian.org> Mon, 02 Oct 2023 17:10:48 +0200

123
debian/patches/0038-CVE-2023-39352.patch vendored Normal file
View File

@ -0,0 +1,123 @@
Description: Upstream fix for CVE-2023-39352 - Invalid offset validation leading to Out Of Bound Write
Backport of upstream patch, redigining WINPR_ASSERT as this was introduced
in upstream codebase only.
Origin: https://github.com/FreeRDP/FreeRDP/commit/856ecaa463e963ecfebc9734423d69139e7b3916
Bug: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvj
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051638
From 856ecaa463e963ecfebc9734423d69139e7b3916 Mon Sep 17 00:00:00 2001
From: houchengqiu <houchengqiu@uniontech.com>
Date: Mon, 22 May 2023 16:03:54 +0800
Subject: [PATCH] [libfreerdp] add bound check in gdi_SolidFill
In Windows remote run vulnerabillities exe program, to create
Micorosoft::Windows::RDS::Graphics channel, case Remmina crash.
So, add bound check, limit the size of the requested rect, no larger than the surface data buffer.
(cherry picked from commit 6a63441e4ee8e2bf333361f5d24156a183b14ecd)
---
libfreerdp/gdi/gfx.c | 68 ++++++++++++++++++++++++++++----------------
1 file changed, 43 insertions(+), 25 deletions(-)
--- a/libfreerdp/gdi/gfx.c
+++ b/libfreerdp/gdi/gfx.c
@@ -29,6 +29,10 @@
#include <freerdp/gdi/gfx.h>
#include <freerdp/gdi/region.h>
+#include <assert.h>
+
+#define WINPR_ASSERT assert
+
#define TAG FREERDP_TAG("gdi")
static BOOL is_rect_valid(const RECTANGLE_16* rect, size_t width, size_t height)
@@ -1079,6 +1083,28 @@
return rc;
}
+static BOOL intersect_rect(const RECTANGLE_16* rect, const gdiGfxSurface* surface,
+ RECTANGLE_16* prect)
+{
+ WINPR_ASSERT(rect);
+ WINPR_ASSERT(surface);
+ WINPR_ASSERT(prect);
+
+ if (rect->left > rect->right)
+ return FALSE;
+ if (rect->left > surface->width)
+ return FALSE;
+ if (rect->top > rect->bottom)
+ return FALSE;
+ if (rect->top > surface->height)
+ return FALSE;
+ prect->left = rect->left;
+ prect->top = rect->top;
+ prect->right = MIN(rect->right, surface->width);
+ prect->bottom = MIN(rect->bottom, surface->height);
+ return TRUE;
+}
+
/**
* Function description
*
@@ -1087,40 +1113,36 @@
static UINT gdi_SolidFill(RdpgfxClientContext* context, const RDPGFX_SOLID_FILL_PDU* solidFill)
{
UINT status = ERROR_INTERNAL_ERROR;
- UINT16 index;
- UINT32 color;
- BYTE a, r, g, b;
- UINT32 nWidth, nHeight;
- RECTANGLE_16* rect;
- gdiGfxSurface* surface;
- RECTANGLE_16 invalidRect;
+ BYTE a = 0;
+ RECTANGLE_16 invalidRect = { 0 };
rdpGdi* gdi = (rdpGdi*)context->custom;
+
EnterCriticalSection(&context->mux);
- surface = (gdiGfxSurface*)context->GetSurfaceData(context, solidFill->surfaceId);
+
+ WINPR_ASSERT(context->GetSurfaceData);
+ gdiGfxSurface* surface = (gdiGfxSurface*)context->GetSurfaceData(context, solidFill->surfaceId);
if (!surface)
goto fail;
- b = solidFill->fillPixel.B;
- g = solidFill->fillPixel.G;
- r = solidFill->fillPixel.R;
- /* a = solidFill->fillPixel.XA;
- * Ignore alpha channel, this is a solid fill. */
+ const BYTE b = solidFill->fillPixel.B;
+ const BYTE g = solidFill->fillPixel.G;
+ const BYTE r = solidFill->fillPixel.R;
a = 0xFF;
- color = FreeRDPGetColor(surface->format, r, g, b, a);
+ const UINT32 color = FreeRDPGetColor(surface->format, r, g, b, a);
- for (index = 0; index < solidFill->fillRectCount; index++)
+ for (UINT16 index = 0; index < solidFill->fillRectCount; index++)
{
- rect = &(solidFill->fillRects[index]);
- nWidth = rect->right - rect->left;
- nHeight = rect->bottom - rect->top;
- invalidRect.left = rect->left;
- invalidRect.top = rect->top;
- invalidRect.right = rect->right;
- invalidRect.bottom = rect->bottom;
+ const RECTANGLE_16* rect = &(solidFill->fillRects[index]);
+
+ if (!intersect_rect(rect, surface, &invalidRect))
+ goto fail;
+
+ const UINT32 nWidth = invalidRect.right - invalidRect.left;
+ const UINT32 nHeight = invalidRect.bottom - invalidRect.top;
- if (!freerdp_image_fill(surface->data, surface->format, surface->scanline, rect->left,
- rect->top, nWidth, nHeight, color))
+ if (!freerdp_image_fill(surface->data, surface->format, surface->scanline, invalidRect.left,
+ invalidRect.top, nWidth, nHeight, color))
goto fail;
region16_union_rect(&(surface->invalidRegion), &(surface->invalidRegion), &invalidRect);

1
debian/patches/series vendored
View File

@ -25,3 +25,4 @@
1001_keep-symbol-DumpThreadHandles-if-debugging-is-disabled.patch
0036-CVE-2023-39350.patch
0037-CVE-2023-39351.patch
0038-CVE-2023-39352.patch