From 67c2aa52b2ae0341d469071d1bc8aab91f8d2ed8 Mon Sep 17 00:00:00 2001 From: akallabeth Date: Tue, 31 Mar 2020 14:36:40 +0200 Subject: [PATCH] Fixed #6013: Check new length is > 0 --- libfreerdp/core/orders.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libfreerdp/core/orders.c b/libfreerdp/core/orders.c index 3d338eb29..fb8c3776e 100644 --- a/libfreerdp/core/orders.c +++ b/libfreerdp/core/orders.c @@ -2161,7 +2161,7 @@ static CACHE_BITMAP_V3_ORDER* update_read_cache_bitmap_v3_order(rdpUpdate* updat Stream_Read_UINT16(s, bitmapData->height); /* height (2 bytes) */ Stream_Read_UINT32(s, new_len); /* length (4 bytes) */ - if (Stream_GetRemainingLength(s) < new_len) + if ((new_len == 0) || (Stream_GetRemainingLength(s) < new_len)) goto fail; new_data = (BYTE*)realloc(bitmapData->data, new_len);