From a31234539a6a12f5c646c82ac0c2c78020e6f65b Mon Sep 17 00:00:00 2001
From: Jay Sorg <jay.sorg@gmail.com>
Date: Wed, 9 Oct 2013 23:04:03 -0700
Subject: [PATCH] libxrdp: ISO_PDU_CR len fix

---
 libxrdp/xrdp_iso.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libxrdp/xrdp_iso.c b/libxrdp/xrdp_iso.c
index bee00f27..69c242d3 100644
--- a/libxrdp/xrdp_iso.c
+++ b/libxrdp/xrdp_iso.c
@@ -316,7 +316,7 @@ xrdp_iso_incoming(struct xrdp_iso *self)
         return 1;
     }
 
-    if (code != ISO_PDU_CR)
+    if ((code != ISO_PDU_CR) || (len < 6))
     {
         free_stream(s);
         return 1;
@@ -325,7 +325,7 @@ xrdp_iso_incoming(struct xrdp_iso *self)
     self->selectedProtocol = -1;
     self->requestedProtocol = PROTOCOL_RDP;
 
-    pend = s->p + len;
+    pend = s->p + (len - 6);
     cookie_index = 0;
     while (s->p < pend)
     {