From f4d74c33fd58e9e9e4e52d75b0d1255af8fa4b53 Mon Sep 17 00:00:00 2001
From: Armin Novak <armin.novak@thincast.com>
Date: Sun, 15 Feb 2026 19:32:38 +0100
Subject: [PATCH] [codec,nsc] bounds checks and doxygen

* Improve doxygen for nsc_process_message
* Improve bounds checks for nsc_process_message
---
 include/freerdp/codec/nsc.h | 22 ++++++++++++++++++++++
 libfreerdp/codec/nsc.c      | 12 +++++++++---
 2 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/include/freerdp/codec/nsc.h b/include/freerdp/codec/nsc.h
index fdf79c17a..b100ae305 100644
--- a/include/freerdp/codec/nsc.h
+++ b/include/freerdp/codec/nsc.h
@@ -53,11 +53,33 @@ extern "C"
 	FREERDP_API BOOL nsc_context_set_parameters(NSC_CONTEXT* WINPR_RESTRICT context,
 	                                            NSC_PARAMETER what, UINT32 value);
 
+	/** @brief decode a NSC message
+	 *
+	 *  @param context The context to work on
+	 *  @param bpp The bit depth of the data
+	 *  @param width The width in pixels of the NSC surface
+	 *  @param height The height in pixels of the NSC surface
+	 *  @param data The data to decode
+	 *  @param length The length of \ref data in bytes
+	 *  @param pDstData The destination buffer. Must be at least \n nDstStride * nHeight in size.
+	 *  @param DstFormat The color format of the destination
+	 *  @param nDstStride The number of bytes per destination buffer line. Must be larger than
+	 * bytes(DstFormat) * nWidth or \0 (in which case it is set to former minimum bound)
+	 *  @param nXDst The X offset in the destination buffer in pixels
+	 *  @param nYDst The Y offset in the destination buffer in pixels
+	 *  @param nWidth The width of the destination buffer in pixels
+	 *  @param nHeight The height of the destination buffer in pixels
+	 *  @param flip Image flipping flags FREERDP_FLIP_NONE et al passed on to \ref
+	 * freerdp_image_copy
+	 *
+	 *  @return \b TRUE in case of success, \b FALSE for any error. Check WLog for details.
+	 */
 	FREERDP_API BOOL nsc_process_message(NSC_CONTEXT* WINPR_RESTRICT context, UINT16 bpp,
 	                                     UINT32 width, UINT32 height, const BYTE* data,
 	                                     UINT32 length, BYTE* WINPR_RESTRICT pDstData,
 	                                     UINT32 DstFormat, UINT32 nDstStride, UINT32 nXDst,
 	                                     UINT32 nYDst, UINT32 nWidth, UINT32 nHeight, UINT32 flip);
+
 	FREERDP_API BOOL nsc_compose_message(NSC_CONTEXT* WINPR_RESTRICT context,
 	                                     wStream* WINPR_RESTRICT s,
 	                                     const BYTE* WINPR_RESTRICT bmpdata, UINT32 width,
diff --git a/libfreerdp/codec/nsc.c b/libfreerdp/codec/nsc.c
index 73febae07..4d677b5b6 100644
--- a/libfreerdp/codec/nsc.c
+++ b/libfreerdp/codec/nsc.c
@@ -436,19 +436,25 @@ BOOL nsc_process_message(NSC_CONTEXT* WINPR_RESTRICT context, UINT16 bpp, UINT32
                          UINT32 nXDst, UINT32 nYDst, UINT32 nWidth,
                          WINPR_ATTR_UNUSED UINT32 nHeight, UINT32 flip)
 {
-	wStream* s = NULL;
 	wStream sbuffer = { 0 };
 	BOOL ret = 0;
 	if (!context || !data || !pDstData)
 		return FALSE;
 
-	s = Stream_StaticConstInit(&sbuffer, data, length);
+	if (nXDst > nWidth)
+		return FALSE;
+	if (nYDst > nHeight)
+		return FALSE;
 
+	wStream* s = Stream_StaticConstInit(&sbuffer, data, length);
 	if (!s)
 		return FALSE;
 
+	const UINT32 minStride = nWidth * FreeRDPGetBytesPerPixel(DstFormat);
 	if (nDstStride == 0)
-		nDstStride = nWidth * FreeRDPGetBytesPerPixel(DstFormat);
+		nDstStride = minStride;
+	if (nDstStride < minStride)
+		return FALSE;
 
 	switch (bpp)
 	{