Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP2:Update
xrdp.27289
xrdp-CVE-2022-23483.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File xrdp-CVE-2022-23483.patch of Package xrdp.27289
From 54d49147679e8f5e75527ac701d51793f0746c52 Mon Sep 17 00:00:00 2001 From: matt335672 <30179339+matt335672@users.noreply.github.com> Date: Wed, 7 Dec 2022 10:21:41 +0000 Subject: [PATCH 7/8] CVE-2022-23483 Sanitise channel data being passed from application Avoids OOB read if the size field is incorrect. --- xrdp/xrdp_mm.c | 33 +++++++++++++++++---------------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/xrdp/xrdp_mm.c b/xrdp/xrdp_mm.c index 4c716d46..2c6999c6 100644 --- a/xrdp/xrdp_mm.c +++ b/xrdp/xrdp_mm.c @@ -718,31 +718,32 @@ static int xrdp_mm_trans_process_channel_data(struct xrdp_mm *self, struct trans *trans) { struct stream *s; - int size; - int total_size; + unsigned int size; + unsigned int total_size; int chan_id; int chan_flags; - int rv; + int rv = 0; s = trans_get_in_s(trans); - if (s == 0) + if (!s_check_rem_and_log(s, 10, "Reading channel data header")) { - return 1; + rv = 1; } - - in_uint16_le(s, chan_id); - in_uint16_le(s, chan_flags); - in_uint16_le(s, size); - in_uint32_le(s, total_size); - rv = xrdp_mm_trans_send_channel_data_response(self, trans); - - if (rv == 0) + else { - if (is_channel_allowed(self->wm, chan_id)) + in_uint16_le(s, chan_id); + in_uint16_le(s, chan_flags); + in_uint16_le(s, size); + in_uint32_le(s, total_size); + if (!s_check_rem_and_log(s, size, "Reading channel data data")) + { + rv = 1; + } + else { - rv = libxrdp_send_to_channel(self->wm->session, chan_id, s->p, size, total_size, - chan_flags); + rv = libxrdp_send_to_channel(self->wm->session, chan_id, + s->p, size, total_size, chan_flags); } } -- 2.39.0
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor