pxcloud/freerdp2
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CVE-2022-39319 - Missing length validation in urbdrc channel

Browse Source
This commit is contained in:
Tobias Frost 2023-10-29 10:45:28 +01:00
parent 9abf5f033b
commit ae332a9e65
3 changed files with 70 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
debian/changelog vendored
View File

@ -12,6 +12,7 @@ freerdp2 (2.3.0+dfsg1-2+deb10u4) UNRELEASED; urgency=medium
* Import fix for (see #1024511)
- CVE-2022-39316 - Out of bound read in zgfx decoder and
- CVE-2022-39318 - Division by zero in urbdrc channel
- CVE-2022-39319 - Missing length validation in urbdrc channel
-- Tobias Frost <tobi@debian.org> Sat, 28 Oct 2023 18:12:57 +0200

68
debian/patches/0055-CVE-2022-39319.patch vendored Normal file
View File

@ -0,0 +1,68 @@
Description: CVE-2022-39319 - Missing length validation in urbdrc channel
Origin: https://github.com/FreeRDP/FreeRDP/commit/11555828d2cf289b350baba5ad1f462f10b80b76
Bug: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mvxm-wfj2-5fvh
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1024511
From 11555828d2cf289b350baba5ad1f462f10b80b76 Mon Sep 17 00:00:00 2001
From: akallabeth <akallabeth@posteo.net>
Date: Thu, 13 Oct 2022 08:47:51 +0200
Subject: [PATCH] Fixed missing input buffer length check in urbdrc
(cherry picked from commit 497df00f741dd4fc89292aaef2db7368aee45d0d)
---
channels/urbdrc/client/data_transfer.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
--- a/channels/urbdrc/client/data_transfer.c
+++ b/channels/urbdrc/client/data_transfer.c
@@ -29,6 +29,10 @@
#include "urbdrc_types.h"
#include "data_transfer.h"
+#define Stream_CheckAndLogRequiredLength(tag, s, len) \
+ Stream_CheckAndLogRequiredLengthWLogEx(WLog_Get(tag), WLOG_WARN, s, len, "%s(%s:%" PRIuz ")", __FUNCTION__, \
+ __FILE__, __LINE__)
+
static void usb_process_get_port_status(IUDEVICE* pdev, wStream* out)
{
int bcdUSB = pdev->query_device_descriptor(pdev, BCD_USB);
@@ -241,6 +245,10 @@
Stream_Read_UINT32(s, OutputBufferSize);
Stream_Read_UINT32(s, RequestId);
+
+ if (OutputBufferSize > UINT32_MAX - 4)
+ return ERROR_INVALID_DATA;
+
InterfaceId = ((STREAM_ID_PROXY << 30) | pdev->get_ReqCompletion(pdev));
out = urb_create_iocompletion(InterfaceId, MessageId, RequestId, OutputBufferSize + 4);
@@ -720,6 +728,15 @@
Stream_Read_UINT32(s, TransferFlags); /** TransferFlags */
Stream_Read_UINT32(s, OutputBufferSize);
EndpointAddress = (PipeHandle & 0x000000ff);
+
+ if (transferDir == USBD_TRANSFER_DIRECTION_OUT)
+ {
+ if (!Stream_CheckAndLogRequiredLength(TAG, s, OutputBufferSize))
+ {
+ return ERROR_INVALID_DATA;
+ }
+ }
+
/** process TS_URB_BULK_OR_INTERRUPT_TRANSFER */
return pdev->bulk_or_interrupt_transfer(pdev, callback, MessageId, RequestId, EndpointAddress,
TransferFlags, noAck, OutputBufferSize,
@@ -803,6 +820,13 @@
packetDescriptorData = Stream_Pointer(s);
Stream_Seek(s, NumberOfPackets * 12);
Stream_Read_UINT32(s, OutputBufferSize);
+
+ if (transferDir == USBD_TRANSFER_DIRECTION_OUT)
+ {
+ if (!Stream_CheckAndLogRequiredLength(TAG, s, OutputBufferSize))
+ return ERROR_INVALID_DATA;
+ }
+
return pdev->isoch_transfer(
pdev, callback, MessageId, RequestId, EndpointAddress, TransferFlags, StartFrame,
ErrorCount, noAck, packetDescriptorData, NumberOfPackets, OutputBufferSize,

1
debian/patches/series vendored
View File

@ -44,3 +44,4 @@
0052-CVE-2022-24883.patch
0053-CVE-2022-39316.patch
0054-CVE-2022-39318.patch
0055-CVE-2022-39319.patch