Fixed length sanity check.
@@ -140,7 +140,6 @@ static BOOL gdi_Bitmap_Decompress(rdpContext* context, rdpBitmap* bitmap,
UINT32 codecId)
{
UINT32 SrcSize = length;
- UINT32 SrcFormat;
rdpGdi* gdi = context->gdi;
bitmap->compressed = FALSE;
bitmap->format = gdi->dstFormat;
@@ -174,9 +173,12 @@ static BOOL gdi_Bitmap_Decompress(rdpContext* context, rdpBitmap* bitmap,
}
else
{
- SrcFormat = gdi_get_pixel_format(bpp);
+ const UINT32 SrcFormat = gdi_get_pixel_format(bpp);
+ const size_t sbpp = GetBytesPerPixel(SrcFormat);
+ const size_t dbpp = GetBytesPerPixel(bitmap->format);
+ const size_t dstSize = SrcSize * dbpp / sbpp;
- if (SrcSize < bitmap->length)
+ if (dstSize < bitmap->length)
return FALSE;
if (!freerdp_image_copy(bitmap->data, bitmap->format, 0, 0, 0,
