pxcloud/freerdp2
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply upstream patch for CVE-2023-40567.

Browse Source
This commit is contained in:
Tobias Frost 2023-10-07 12:34:32 +02:00
parent 09055cabae
commit d1217c6dad
3 changed files with 169 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
debian/changelog vendored
View File

@ -15,7 +15,7 @@ freerdp2 (2.3.0+dfsg1-2~deb10u3) UNRELEASED; urgency=medium
CVE-2020-15103 (Closes: #965979)
* Backporting/Importing upstream patches for (Closes: #1051638):
CVE-2023-39350 CVE-2023-39351 CVE-2023-39352 CVE-2023-39353
CVE-2023-39354 CVE-2023-39355 CVE-2023-39356
CVE-2023-39354 CVE-2023-39355 CVE-2023-39356 CVE-2023-39357
-- Tobias Frost <tobi@debian.org> Mon, 02 Oct 2023 17:10:48 +0200

167
debian/patches/0044-CVE-2023-40567.patch vendored Normal file
View File

@ -0,0 +1,167 @@
Description: Upstream fix for CVE-2023-40567 - Out-Of-Bounds Write in clear_decompress_bands_data
Origin: https://github.com/FreeRDP/FreeRDP/commit/bacb8c016ef72aa767760b6b01d15500aee9d59a
Bug: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2w9f-8wg4-8jfp
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051638
From bacb8c016ef72aa767760b6b01d15500aee9d59a Mon Sep 17 00:00:00 2001
From: akallabeth <akallabeth@posteo.net>
Date: Tue, 22 Aug 2023 14:44:57 +0200
Subject: [PATCH] [codec,clear] fix missing bounds checks
(cherry picked from commit 680619fc48f40d458c9614b47bfde61226a324aa)
---
libfreerdp/codec/clear.c | 59 +++++++++++++++++++---------------------
1 file changed, 28 insertions(+), 31 deletions(-)
diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
index ecf7f1ca161b..101260770ba7 100644
--- a/libfreerdp/codec/clear.c
+++ b/libfreerdp/codec/clear.c
@@ -591,13 +591,9 @@ static BOOL resize_vbar_entry(CLEAR_CONTEXT* clear, CLEAR_VBAR_ENTRY* vBarEntry)
static BOOL clear_decompress_bands_data(CLEAR_CONTEXT* clear, wStream* s, UINT32 bandsByteCount,
UINT32 nWidth, UINT32 nHeight, BYTE* pDstData,
UINT32 DstFormat, UINT32 nDstStep, UINT32 nXDst,
- UINT32 nYDst)
+ UINT32 nYDst, UINT32 nDstWidth, UINT32 nDstHeight)
{
- UINT32 i, y;
- UINT32 count;
- UINT32 suboffset;
- UINT32 nXDstRel;
- UINT32 nYDstRel;
+ UINT32 suboffset = 0;
if (Stream_GetRemainingLength(s) < bandsByteCount)
{
@@ -605,22 +601,20 @@ static BOOL clear_decompress_bands_data(CLEAR_CONTEXT* clear, wStream* s, UINT32
return FALSE;
}
- suboffset = 0;
-
while (suboffset < bandsByteCount)
{
- BYTE r, g, b;
+ BYTE cr, cg, cb;
UINT16 xStart;
UINT16 xEnd;
UINT16 yStart;
UINT16 yEnd;
UINT32 colorBkg;
UINT16 vBarHeader;
- UINT16 vBarYOn;
+ UINT16 vBarYOn = 0;
UINT16 vBarYOff;
UINT32 vBarCount;
UINT32 vBarPixelCount;
- UINT32 vBarShortPixelCount;
+ UINT32 vBarShortPixelCount = 0;
if (Stream_GetRemainingLength(s) < 11)
{
@@ -632,11 +626,11 @@ static BOOL clear_decompress_bands_data(CLEAR_CONTEXT* clear, wStream* s, UINT32
Stream_Read_UINT16(s, xEnd);
Stream_Read_UINT16(s, yStart);
Stream_Read_UINT16(s, yEnd);
- Stream_Read_UINT8(s, b);
- Stream_Read_UINT8(s, g);
- Stream_Read_UINT8(s, r);
+ Stream_Read_UINT8(s, cb);
+ Stream_Read_UINT8(s, cg);
+ Stream_Read_UINT8(s, cr);
suboffset += 11;
- colorBkg = FreeRDPGetColor(clear->format, r, g, b, 0xFF);
+ colorBkg = FreeRDPGetColor(clear->format, cr, cg, cb, 0xFF);
if (xEnd < xStart)
{
@@ -652,13 +646,13 @@ static BOOL clear_decompress_bands_data(CLEAR_CONTEXT* clear, wStream* s, UINT32
vBarCount = (xEnd - xStart) + 1;
- for (i = 0; i < vBarCount; i++)
+ for (UINT32 i = 0; i < vBarCount; i++)
{
UINT32 vBarHeight;
CLEAR_VBAR_ENTRY* vBarEntry = NULL;
- CLEAR_VBAR_ENTRY* vBarShortEntry;
+ CLEAR_VBAR_ENTRY* vBarShortEntry = NULL;
BOOL vBarUpdate = FALSE;
- const BYTE* pSrcPixel;
+ const BYTE* cpSrcPixel;
if (Stream_GetRemainingLength(s) < 2)
{
@@ -740,11 +734,11 @@ static BOOL clear_decompress_bands_data(CLEAR_CONTEXT* clear, wStream* s, UINT32
if (!resize_vbar_entry(clear, vBarShortEntry))
return FALSE;
- for (y = 0; y < vBarShortPixelCount; y++)
+ for (UINT32 y = 0; y < vBarShortPixelCount; y++)
{
- BYTE r, g, b;
+ BYTE r = 0, g = 0, b = 0;
BYTE* dstBuffer = &vBarShortEntry->pixels[y * GetBytesPerPixel(clear->format)];
- UINT32 color;
+ UINT32 color = 0;
Stream_Read_UINT8(s, b);
Stream_Read_UINT8(s, g);
Stream_Read_UINT8(s, r);
@@ -804,8 +798,8 @@ static BOOL clear_decompress_bands_data(CLEAR_CONTEXT* clear, wStream* s, UINT32
dstBuffer = vBarEntry->pixels;
/* if (y < vBarYOn), use colorBkg */
- y = 0;
- count = vBarYOn;
+ UINT32 y = 0;
+ UINT32 count = vBarYOn;
if ((y + count) > vBarPixelCount)
count = (vBarPixelCount > y) ? (vBarPixelCount - y) : 0;
@@ -868,28 +862,31 @@ static BOOL clear_decompress_bands_data(CLEAR_CONTEXT* clear, wStream* s, UINT32
return FALSE;
}
- nXDstRel = nXDst + xStart;
- nYDstRel = nYDst + yStart;
- pSrcPixel = vBarEntry->pixels;
+ const UINT32 nXDstRel = nXDst + xStart;
+ const UINT32 nYDstRel = nYDst + yStart;
+ cpSrcPixel = vBarEntry->pixels;
if (i < nWidth)
{
- count = vBarEntry->count;
+ UINT32 count = vBarEntry->count;
if (count > nHeight)
count = nHeight;
- for (y = 0; y < count; y++)
+ if (nXDstRel + i > nDstWidth)
+ return FALSE;
+
+ for (UINT32 y = 0; y < count; y++)
{
BYTE* pDstPixel8 = &pDstData[((nYDstRel + y) * nDstStep) +
((nXDstRel + i) * GetBytesPerPixel(DstFormat))];
- UINT32 color = ReadColor(pSrcPixel, clear->format);
+ UINT32 color = ReadColor(cpSrcPixel, clear->format);
color = FreeRDPConvertColor(color, clear->format, DstFormat, NULL);
if (!WriteColor(pDstPixel8, DstFormat, color))
return FALSE;
- pSrcPixel += GetBytesPerPixel(clear->format);
+ cpSrcPixel += GetBytesPerPixel(clear->format);
}
}
}
@@ -1117,7 +1114,7 @@ INT32 clear_decompress(CLEAR_CONTEXT* clear, const BYTE* pSrcData, UINT32 SrcSiz
if (bandsByteCount > 0)
{
if (!clear_decompress_bands_data(clear, s, bandsByteCount, nWidth, nHeight, pDstData,
- DstFormat, nDstStep, nXDst, nYDst))
+ DstFormat, nDstStep, nXDst, nYDst, nDstWidth, nDstHeight))
{
WLog_ERR(TAG, "clear_decompress_bands_data failed!");
goto fail;

1
debian/patches/series vendored
View File

@ -33,3 +33,4 @@
0041-CVE-2023-39355.patch
0042-CVE-2023-39356-part1.patch
0043-CVE-2023-39356-part2.patch
0044-CVE-2023-40567.patch