morgan/FreeRDP
1
0
Fork 0
mirror of https://github.com/morgan9e/FreeRDP synced 2026-04-14 00:14:11 +09:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #12312 from akallabeth/planar-dst-fix

Browse Source 
[codec,planar] fix missing destination bounds checks
This commit is contained in:
akallabeth
2026-02-16 10:54:54 +01:00
committed by GitHub
parent a25b90adc2 a0be5cb87d
commit 341b52ad96
1 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
libfreerdp/codec/planar.c
View File

@@ -732,8 +732,9 @@ BOOL freerdp_bitmap_decompress_planar(BITMAP_PLANAR_CONTEXT* WINPR_RESTRICT plan
if (planar->maxHeight < nSrcHeight)
return FALSE;
const UINT32 bpp = FreeRDPGetBytesPerPixel(DstFormat);
if (nDstStep <= 0)
nDstStep = nDstWidth * FreeRDPGetBytesPerPixel(DstFormat);
nDstStep = nDstWidth * bpp;
const BYTE* srcp = pSrcData;
@@ -955,6 +956,24 @@ BOOL freerdp_bitmap_decompress_planar(BITMAP_PLANAR_CONTEXT* WINPR_RESTRICT plan
}
else /* RLE */
{
if (nYDst + nSrcHeight > nTotalHeight)
{
WLog_ERR(TAG,
"planar plane destination Y %" PRIu32 " + height %" PRIu32
" exceeds totalHeight %" PRIu32,
nYDst, nSrcHeight, nTotalHeight);
return FALSE;
}
if ((nXDst + nSrcWidth) * bpp > nDstStep)
{
WLog_ERR(TAG,
"planar plane destination (X %" PRIu32 " + width %" PRIu32
") * bpp %" PRIu32 " exceeds stride %" PRIu32,
nXDst, nSrcWidth, bpp, nDstStep);
return FALSE;
}
status = planar_decompress_plane_rle(
planes[0], WINPR_ASSERTING_INT_CAST(uint32_t, rleSizes[0]), pTempData, nTempStep,
nXDst, nYDst, nSrcWidth, nSrcHeight, 2, vFlip); /* RedPlane */