From 6249a5fec33c4d66113416d882c69cf6d7cff37b Mon Sep 17 00:00:00 2001 From: XiaopengZHOU Date: Mon, 28 Jan 2019 12:11:03 +0100 Subject: [PATCH] Fix checking the length of remaining data in stream for very compact orders. --- orders.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/orders.c b/orders.c index 5e34770..34be543 100644 --- a/orders.c +++ b/orders.c @@ -1265,7 +1265,7 @@ process_secondary_order(STREAM s) in_uint16_le(s, flags); /* used by bmpcache2 */ in_uint8(s, type); - if (!s_check_rem(s, length + 7)) + if (!s_check_rem(s, (sint16) length + 7)) { rdp_protocol_error("process_secondary_order(), next order pointer would overrun stream", &packet); }