early bail from update_read_window_state_order when handling WINDOW_ORDER_FIELD_WND_RECTS breaks subsequent protocol parsing
@@ -359,11 +359,8 @@ static BOOL update_read_window_state_order(wStream* s, WINDOW_ORDER_INFO* orderI
Stream_Read_UINT16(s, windowState->numWindowRects); /* numWindowRects (2 bytes) */
- if (windowState->numWindowRects == 0)
+ if (windowState->numWindowRects > 0)
{
- return TRUE;
- }
-
size = sizeof(RECTANGLE_16) * windowState->numWindowRects;
newRect = (RECTANGLE_16*)realloc(windowState->windowRects, size);
@@ -388,6 +385,7 @@ static BOOL update_read_window_state_order(wStream* s, WINDOW_ORDER_INFO* orderI
Stream_Read_UINT16(s, windowState->windowRects[i].bottom); /* bottom (2 bytes) */
}
}
+ }
if (orderInfo->fieldFlags & WINDOW_ORDER_FIELD_VIS_OFFSET)
{
