libxrdp: ISO_PDU_CR len fix

11 years ago · a31234539a
parent f8e876a8f7
commit a31234539a
1 changed files with 2 additions and 2 deletions
--- a/libxrdp/xrdp_iso.c
+++ b/libxrdp/xrdp_iso.c
@ -316,7 +316,7 @@ xrdp_iso_incoming(struct xrdp_iso *self)
        return 1;
    }
-    if (code != ISO_PDU_CR)
+    if ((code != ISO_PDU_CR) || (len < 6))
    {
        free_stream(s);
        return 1;
@ -325,7 +325,7 @@ xrdp_iso_incoming(struct xrdp_iso *self)
    self->selectedProtocol = -1;
    self->requestedProtocol = PROTOCOL_RDP;
-    pend = s->p + len;
+    pend = s->p + (len - 6);
    cookie_index = 0;
    while (s->p < pend)
    {