We don't know when the caller might be done with a stream, so we
can end up with code overwriting things in a stream that is in use
elsewhere.
Solve the issue by returning a new stream each time and leave it
up to the callers to free it.
Make them more match in_uint8a and in_uint8p in that one copies and
the other just gives you a pointer and it is up to the caller how
to fill it in. This can be useful when other APIs are used to
generate the data as it avoids a temporary buffer.
Avoids mistakes by making sure everyone allocates these the same
way.
The smart card code still has manual allocation because it has it's
own magical memory management.
This macro checks if a pointer is valid _after_ we've already used
that pointer. So it will only trigger if we're already performed some
for of buffer overflow. As such, it provides little to no value and
can only server to encourage broken behaviour.
Let's remove it and replace it with proper bounds checking before
access instead.
This commit includes fixes for a set of 21 vulnerabilities in
rdesktop when a malicious RDP server is used.
All vulnerabilities was identified and reported by Eyal Itkin.
* Add rdp_protocol_error function that is used in several fixes
* Refactor of process_bitmap_updates
* Fix possible integer overflow in s_check_rem() on 32bit arch
* Fix memory corruption in process_bitmap_data - CVE-2018-8794
* Fix remote code execution in process_bitmap_data - CVE-2018-8795
* Fix remote code execution in process_plane - CVE-2018-8797
* Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175
* Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175
* Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176
* Fix Denial of Service in sec_recv - CVE-2018-20176
* Fix minor information leak in rdpdr_process - CVE-2018-8791
* Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792
* Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793
* Fix Denial of Service in process_bitmap_data - CVE-2018-8796
* Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798
* Fix Denial of Service in process_secondary_order - CVE-2018-8799
* Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800
* Fix major information leak in ui_clip_handle_data - CVE-2018-20174
* Fix memory corruption in rdp_in_unistr - CVE-2018-20177
* Fix Denial of Service in process_demand_active - CVE-2018-20178
* Fix remote code execution in lspci_process - CVE-2018-20179
* Fix remote code execution in rdpsnddbg_process - CVE-2018-20180
* Fix remote code execution in seamless_process - CVE-2018-20181
* Fix remote code execution in seamless_process_line - CVE-2018-20182
A correct user initated disconnect sequence should send
a MCS Disconnect Provider Ultimatum PDU defined in T.128
upon a disconnect. This commit adds the implementation
the mentioned PDU and the actual write of the packet.
Signed-off-by: Henrik Andersson <hean01@cendio.com>
This commit will add a logging system to solve the problem that
one actually need to recompile rdesktop from source to enable
different debug logging.
- Same logging api for all kind of logging and messages to
end user.
- Adding -v for verbose output when running rdesktop.
- All messages are logged into a subject and with a type, eg:
logger(Keyboard, Notice, "Autos-electing %s based on locale.", locale);
- Debug logging is enabled trough a environment variable RDEKSTOP_DEBUG,
which specifies subjects of interest, comma separated. There is a special
subject named All which includes all subject for debug loggin. There is also
a simple logic opeartor '!' = NOT which can be used in combination like:
RDESKTOP_DEBUG=All,!Graphics,!Sound
Which would give debug log output for All subject except Graphics and Sound.
disabled by default and is enabled using argument --enable-credssp
to configure script.
git-svn-id: svn://svn.code.sf.net/p/rdesktop/code/rdesktop/trunk@1676 423420c4-83ab-492f-b58f-81f9feb106b5
adding Enhanced RDP Security support to rdesktop and brings
support for TLSv1 tunnel functionality.
git-svn-id: svn://svn.code.sf.net/p/rdesktop/code/rdesktop/trunk@1659 423420c4-83ab-492f-b58f-81f9feb106b5
change year in files
add missing docu for updated commandline-flags
update changelog
git-svn-id: svn://svn.code.sf.net/p/rdesktop/code/trunk/rdesktop@827 423420c4-83ab-492f-b58f-81f9feb106b5
RDPSND), in particular:
* channel layer takes care of virtual channel header
* split X dependent parts out of CLIPRDR, simplified IPC implementation
* initial RDPDR implementation
git-svn-id: svn://svn.code.sf.net/p/rdesktop/code/trunk/rdesktop@431 423420c4-83ab-492f-b58f-81f9feb106b5
Send CJRQs for the channels we want when initializing MCS.
git-svn-id: svn://svn.code.sf.net/p/rdesktop/code/trunk/rdesktop@408 423420c4-83ab-492f-b58f-81f9feb106b5
number of channels being the most important.
Don't assume the length of the data coming back from the server is
of the same length that the data we sent was.
Record the channel id of incoming MCS packets.
Send username to iso_connect, in order for it to be able to send the
mstshash.
Open the clipboard channel if we are speaking RDP5.
git-svn-id: svn://svn.code.sf.net/p/rdesktop/code/trunk/rdesktop@347 423420c4-83ab-492f-b58f-81f9feb106b5
Implemented encryption layer and some basic licensing negotiation.
Reorganised code somewhat. While this is not quite as clean, it is
a lot faster - our parser speed was becoming a bottle-neck.
git-svn-id: svn://svn.code.sf.net/p/rdesktop/code/trunk/rdesktop@9 423420c4-83ab-492f-b58f-81f9feb106b5
really embodies a huge number of changes. We are now able to talk quite
fluently to a French NT Terminal Server - in normal usage only minor
font issues remain (handling of TEXT2 order is not perfect).
The next major hurdle is encryption, and it will be quite a big hurdle
- there seems to be some quite nasty session key stuff.
git-svn-id: svn://svn.code.sf.net/p/rdesktop/code/trunk/rdesktop@8 423420c4-83ab-492f-b58f-81f9feb106b5
colour maps. Started on a new bitmap decompression engine which is not
completely working yet - however I am going back on the road so I am
committing now.
git-svn-id: svn://svn.code.sf.net/p/rdesktop/code/trunk/rdesktop@6 423420c4-83ab-492f-b58f-81f9feb106b5
which included commits to RCS files with non-trunk default branches.
git-svn-id: svn://svn.code.sf.net/p/rdesktop/code/trunk/rdesktop@3 423420c4-83ab-492f-b58f-81f9feb106b5
