From 954b68314d37f9515e7f799de8a1c1a0a75476ab Mon Sep 17 00:00:00 2001 From: speidy Date: Thu, 16 Mar 2017 00:39:26 +0200 Subject: [PATCH] xrdp_orders_rail: fix g_mbstowcs error handling --- libxrdp/xrdp_orders_rail.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/libxrdp/xrdp_orders_rail.c b/libxrdp/xrdp_orders_rail.c index be35789b..1556470d 100644 --- a/libxrdp/xrdp_orders_rail.c +++ b/libxrdp/xrdp_orders_rail.c @@ -267,7 +267,11 @@ xrdp_orders_send_window_new_update(struct xrdp_orders *self, int window_id, /* titleInfo */ num_chars = g_mbstowcs(0, window_state->title_info, 0); num_chars = MIN(num_chars, sizeof(twchar) * (g_strlen(window_state->title_info) + 1)); - num_chars = MAX(num_chars, 0); + if (num_chars < 0) + { + /* g_mbstowcs failed, ignore text */ + num_chars = 0; + } order_size += 2 * num_chars + 2; } @@ -545,7 +549,11 @@ xrdp_orders_send_notify_new_update(struct xrdp_orders *self, /* ToolTip (variable) UNICODE_STRING */ num_chars = g_mbstowcs(0, notify_state->tool_tip, 0); num_chars = MIN(num_chars, sizeof(twchar) * (g_strlen(notify_state->tool_tip) + 1)); - num_chars = MAX(num_chars, 0); + if (num_chars < 0) + { + /* g_mbstowcs failed, ignore text */ + num_chars = 0; + } order_size += 2 * num_chars + 2; } @@ -555,12 +563,20 @@ xrdp_orders_send_notify_new_update(struct xrdp_orders *self, /* UNICODE_STRING */ num_chars = g_mbstowcs(0, notify_state->infotip.title, 0); num_chars = MIN(num_chars, sizeof(twchar) * (g_strlen(notify_state->infotip.title) + 1)); - num_chars = MAX(num_chars, 0); + if (num_chars < 0) + { + /* g_mbstowcs failed, ignore text */ + num_chars = 0; + } order_size += 2 * num_chars + 2; /* UNICODE_STRING */ num_chars = g_mbstowcs(0, notify_state->infotip.text, 0); num_chars = MIN(num_chars, sizeof(twchar) * (g_strlen(notify_state->infotip.text) + 1)); - num_chars = MAX(num_chars, 0); + if (num_chars < 0) + { + /* g_mbstowcs failed, ignore text */ + num_chars = 0; + } order_size += 2 * num_chars + 2; /* Timeout (4 bytes) */ /* InfoFlags (4 bytes) */