From 2e3b77e28ac6a398897d28ba464dcc5dfab9c9e2 Mon Sep 17 00:00:00 2001 From: Armin Novak Date: Mon, 9 Feb 2026 13:18:51 +0100 Subject: [PATCH] [channels,rdpgfx] check available stream length --- channels/rdpgfx/client/rdpgfx_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) Index: freerdp-2.11.7/channels/rdpgfx/client/rdpgfx_main.c =================================================================== --- freerdp-2.11.7.orig/channels/rdpgfx/client/rdpgfx_main.c +++ freerdp-2.11.7/channels/rdpgfx/client/rdpgfx_main.c @@ -1065,7 +1065,8 @@ static UINT rdpgfx_recv_wire_to_surface_ Stream_Read_UINT8(s, pdu.pixelFormat); /* pixelFormat (1 byte) */ Stream_Read_UINT32(s, pdu.bitmapDataLength); /* bitmapDataLength (4 bytes) */ pdu.bitmapData = Stream_Pointer(s); - Stream_Seek(s, pdu.bitmapDataLength); + if (!Stream_SafeSeek(s, pdu.bitmapDataLength)) + return ERROR_INVALID_DATA; DEBUG_RDPGFX(gfx->log, "RecvWireToSurface2Pdu: surfaceId: %" PRIu16 " codecId: %s (0x%04" PRIX16 ") " "codecContextId: %" PRIu32 " pixelFormat: 0x%02" PRIX8