Fixed bug found by fuzzing

Devolutions · Aug 14, 2023 · 7e563ab · 7e563ab
1 parent 7172367
commit 7e563ab
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 8 deletions.
diff --git a/crates/ironrdp-pdu/src/clipboard/file_contents.rs b/crates/ironrdp-pdu/src/clipboard/file_contents.rs
@@ -120,9 +120,16 @@ impl<'de> PduDecode<'de> for FileContentsResponse<'de> {
 
         let is_error = header.message_flags.contains(ClipboardPduFlags::RESPONSE_FAIL);
 
-        ensure_size!(in: src, size: header.inner_data_length());
+        ensure_size!(in: src, size: header.data_length());
 
-        let data_size = header.inner_data_length() - Self::FIXED_PART_SIZE;
+        if header.data_length() < Self::FIXED_PART_SIZE {
+            return Err(invalid_message_err!(
+                "requestedFileContentsData",
+                "Invalid data size"
+            ));
+        };
+
+        let data_size = header.data_length() - Self::FIXED_PART_SIZE;
 
         let stream_id = src.read_u32();
         let data = src.read_slice(data_size);
@@ -196,7 +203,7 @@ impl<'de> PduDecode<'de> for FileContentsRequest {
     fn decode(src: &mut ReadCursor<'de>) -> PduResult<Self> {
         let header = PartialHeader::decode(src)?;
 
-        let read_data_id = header.inner_data_length() > Self::FIXED_PART_SIZE;
+        let read_data_id = header.data_length() > Self::FIXED_PART_SIZE;
 
         let mut expected_size = Self::FIXED_PART_SIZE;
         if read_data_id {

diff --git a/crates/ironrdp-pdu/src/clipboard/format_data/mod.rs b/crates/ironrdp-pdu/src/clipboard/format_data/mod.rs
@@ -177,8 +177,8 @@ impl<'de> PduDecode<'de> for FormatDataResponse<'de> {
 
         let is_error = header.message_flags.contains(ClipboardPduFlags::RESPONSE_FAIL);
 
-        ensure_size!(in: src, size: header.inner_data_length());
-        let data = src.read_slice(header.inner_data_length());
+        ensure_size!(in: src, size: header.data_length());
+        let data = src.read_slice(header.data_length());
 
         Ok(Self {
             is_error,

diff --git a/crates/ironrdp-pdu/src/clipboard/format_list.rs b/crates/ironrdp-pdu/src/clipboard/format_list.rs
@@ -143,9 +143,9 @@ impl<'de> PduDecode<'de> for FormatList<'de> {
         let header = PartialHeader::decode(src)?;
 
         let use_ascii = header.message_flags.contains(ClipboardPduFlags::ASCII_NAMES);
-        ensure_size!(in: src, size: header.inner_data_length());
+        ensure_size!(in: src, size: header.data_length());
 
-        let encoded_formats = src.read_slice(header.inner_data_length());
+        let encoded_formats = src.read_slice(header.data_length());
 
         Ok(Self {
             use_ascii,

diff --git a/crates/ironrdp-pdu/src/clipboard/mod.rs b/crates/ironrdp-pdu/src/clipboard/mod.rs
@@ -57,7 +57,7 @@ impl PartialHeader {
         }
     }
 
-    pub fn inner_data_length(&self) -> usize {
+    pub fn data_length(&self) -> usize {
         self.data_length as usize
     }
 }