Fixed [MS-RDPBCGR] 2.2.9.1.1.4.4 Color Pointer Update
The pointer size is limited to 32 pixel in width and height
unless LARGE_POINTER_FLAG_96x96 is set which increases the size
to 96 pixel.
@@ -355,10 +355,15 @@ fail:
return NULL;
}
-static BOOL _update_read_pointer_color(wStream* s, POINTER_COLOR_UPDATE* pointer_color, BYTE xorBpp)
+static BOOL _update_read_pointer_color(wStream* s, POINTER_COLOR_UPDATE* pointer_color, BYTE xorBpp,
+ UINT32 flags)
{
BYTE* newMask;
UINT32 scanlineSize;
+ UINT32 max = 32;
+
+ if (flags & LARGE_POINTER_FLAG_96x96)
+ max = 96;
if (!pointer_color)
goto fail;
@@ -376,12 +381,12 @@ static BOOL _update_read_pointer_color(wStream* s, POINTER_COLOR_UPDATE* pointer
* Pointer Capability Set (section 2.2.7.2.7). If the LARGE_POINTER_FLAG was not
* set, the maximum allowed pointer width/height is 32 pixels.
*
- * So we check for a maximum of 96 for CVE-2014-0250.
+ * So we check for a maximum for CVE-2014-0250.
*/
Stream_Read_UINT16(s, pointer_color->width); /* width (2 bytes) */
Stream_Read_UINT16(s, pointer_color->height); /* height (2 bytes) */
- if ((pointer_color->width > 96) || (pointer_color->height > 96))
+ if ((pointer_color->width > max) || (pointer_color->height > max))
goto fail;
Stream_Read_UINT16(s, pointer_color->lengthAndMask); /* lengthAndMask (2 bytes) */
@@ -483,7 +488,8 @@ POINTER_COLOR_UPDATE* update_read_pointer_color(rdpUpdate* update, wStream* s, B
if (!pointer_color)
goto fail;
- if (!_update_read_pointer_color(s, pointer_color, xorBpp))
+ if (!_update_read_pointer_color(s, pointer_color, xorBpp,
+ update->context->settings->LargePointerFlag))
goto fail;
return pointer_color;
@@ -634,8 +640,8 @@ POINTER_NEW_UPDATE* update_read_pointer_new(rdpUpdate* update, wStream* s)
goto fail;
}
- if (!_update_read_pointer_color(s, &pointer_new->colorPtrAttr,
- pointer_new->xorBpp)) /* colorPtrAttr */
+ if (!_update_read_pointer_color(s, &pointer_new->colorPtrAttr, pointer_new->xorBpp,
+ update->context->settings->LargePointerFlag)) /* colorPtrAttr */
goto fail;
return pointer_new;
