libxrdp: ISO_PDU_CR len fix

This commit is contained in:
Jay Sorg 2013-10-09 23:04:03 -07:00
parent f8e876a8f7
commit a31234539a

View File

@ -316,7 +316,7 @@ xrdp_iso_incoming(struct xrdp_iso *self)
return 1;
}
if (code != ISO_PDU_CR)
if ((code != ISO_PDU_CR) || (len < 6))
{
free_stream(s);
return 1;
@ -325,7 +325,7 @@ xrdp_iso_incoming(struct xrdp_iso *self)
self->selectedProtocol = -1;
self->requestedProtocol = PROTOCOL_RDP;
pend = s->p + len;
pend = s->p + (len - 6);
cookie_index = 0;
while (s->p < pend)
{