check for RDP PDU size too small and remove 0x8000 length check

15 years ago · bb4a15b5dc
parent 6cf7c913f8
commit bb4a15b5dc
1 changed files with 5 additions and 3 deletions
--- a/libxrdp/xrdp_rdp.c
+++ b/libxrdp/xrdp_rdp.c
@ -226,14 +226,16 @@ xrdp_rdp_recv(struct xrdp_rdp* self, struct stream* s, int* code)
  {
    s->p = s->next_packet;
  }
-  in_uint16_le(s, len);
-  if (len == 0x8000)
+  if (!s_check_rem(s, 6))
  {
-    s->next_packet += 8;
+    s->next_packet = 0;
    *code = 0;
    DEBUG(("out xrdp_rdp_recv"));
+    len = (int)(s->end - s->p);
+    g_writeln("xrdp_rdp_recv: bad RDP packet, length [%d]", len);
    return 0;
  }
+  in_uint16_le(s, len);
  in_uint16_le(s, pdu_code);
  *code = pdu_code & 0xf;
  in_uint8s(s, 2); /* mcs user id */