In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read.
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
BB5FC56A-970D-4AE5-A27E-EFD567E17449
2.0.0
1.0.0
OR
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*
B3293E55-5506-4587-A318-D1734F781C09
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
A31C8344-3E02-4EB8-8BD8-4C84B7959624
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
902B8056-9E37-443B-8905-8AA93E2447FB
OR
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
OR
version
```
https://github.com/FreeRDP/FreeRDP/blob/9ef1e81c559bb19d613b4da2d68908ea5d7f9259/libfreerdp/core/update.c#L293
```

vuln code
```
static void update_read_synchronize(rdpUpdate* update, wStream* s)
{
	WINPR_UNUSED(update);
	Stream_Seek_UINT16(s); /* pad2Octets (2 bytes) */
	                       /**
	                        * The Synchronize Update is an artifact from the
	                        * T.128 protocol and should be ignored.
	                        */
}

```
the code just seek the stream pointer without check stream's length, it could lead `_s->pointer - _s->buffer > _s->length`
 Then the check in other functions could fail, and could lead out of bounds read later.




stream out of bounds seek in update_read_synchronize could lead  out of bounds read later
This is a GitHub Issue
repo:FreeRDP
owner:FreeRDP
Title : stream out of bounds seek in update_read_synchronize could lead  out of bounds read later
Issue date:

--- start body ---
version
```
https://github.com/FreeRDP/FreeRDP/blob/9ef1e81c559bb19d613b4da2d68908ea5d7f9259/libfreerdp/core/update.c#L293
```

vuln code
```
static void update_read_synchronize(rdpUpdate* update, wStream* s)
{
	WINPR_UNUSED(update);
	Stream_Seek_UINT16(s); /* pad2Octets (2 bytes) */
	                       /**
	                        * The Synchronize Update is an artifact from the
	                        * T.128 protocol and should be ignored.
	                        */
}

```
the code just seek the stream pointer without check stream's length, it could lead `_s->pointer - _s->buffer > _s->length`
 Then the check in other functions could fail, and could lead out of bounds read later.




--- end body ---

comments :
--- start comments ---

--- end comments ---