From 2e3b77e28ac6a398897d28ba464dcc5dfab9c9e2 Mon Sep 17 00:00:00 2001 From: Armin Novak Date: Mon, 9 Feb 2026 13:18:51 +0100 Subject: [PATCH] [channels,rdpgfx] check available stream length --- channels/rdpgfx/client/rdpgfx_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/channels/rdpgfx/client/rdpgfx_main.c b/channels/rdpgfx/client/rdpgfx_main.c index f2483ad01e43..74690e822b57 100644 --- a/channels/rdpgfx/client/rdpgfx_main.c +++ b/channels/rdpgfx/client/rdpgfx_main.c @@ -1306,7 +1306,8 @@ static UINT rdpgfx_recv_wire_to_surface_2_pdu(GENERIC_CHANNEL_CALLBACK* callback Stream_Read_UINT8(s, pdu.pixelFormat); /* pixelFormat (1 byte) */ Stream_Read_UINT32(s, pdu.bitmapDataLength); /* bitmapDataLength (4 bytes) */ pdu.bitmapData = Stream_Pointer(s); - Stream_Seek(s, pdu.bitmapDataLength); + if (!Stream_SafeSeek(s, pdu.bitmapDataLength)) + return ERROR_INVALID_DATA; DEBUG_RDPGFX(gfx->log, "RecvWireToSurface2Pdu: surfaceId: %" PRIu16 " codecId: %s (0x%04" PRIX16 ") "