In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session. No data extraction is possible. This has been fixed in 2.0.0.
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
C492C074-0329-4949-9533-ED0FE1E0B088
2.0.0
1.0.0
OR
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*
B3293E55-5506-4587-A318-D1734F781C09
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
A31C8344-3E02-4EB8-8BD8-4C84B7959624
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
902B8056-9E37-443B-8905-8AA93E2447FB
OR
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
OR
version
```
https://github.com/FreeRDP/FreeRDP/blob/9ef1e81c559bb19d613b4da2d68908ea5d7f9259/libfreerdp/core/rdp.c#L1129
```

vuln code
`rdp_read_share_control_header` could read 2 byte from stream, if `*length == 0x8000` , it could call `rdp_read_flow_control_pdu`.

```
BOOL rdp_read_share_control_header(wStream* s, UINT16* length, UINT16* type, UINT16* channel_id)
{
	if (Stream_GetRemainingLength(s) < 2)
		return FALSE;

	Stream_Read_UINT16(s, *length); /* totalLength */

	if (*length == 0x8000)
	{
		rdp_read_flow_control_pdu(s, type);   // vuln function

```
`rdp_read_flow_control_pdu` just read 1byte and seek some byte from stream without check length, it could `lead _s->pointer - _s->buffer > _s->length`, then the check in other function could failed

```
void rdp_read_flow_control_pdu(wStream* s, UINT16* type)
{

	UINT8 pduType;
	Stream_Read_UINT8(s, pduType); /* pduTypeFlow */
	*type = pduType;
	Stream_Seek_UINT8(s);  /* pad8bits */
	Stream_Seek_UINT8(s);  /* flowIdentifier */
	Stream_Seek_UINT8(s);  /* flowNumber */
	Stream_Seek_UINT16(s); /* pduSource */
}
```










memory out of bounds read in rdp_read_flow_control_pdu
This is a GitHub Issue
repo:FreeRDP
owner:FreeRDP
Title : memory out of bounds read in rdp_read_flow_control_pdu
Issue date:

--- start body ---
version
```
https://github.com/FreeRDP/FreeRDP/blob/9ef1e81c559bb19d613b4da2d68908ea5d7f9259/libfreerdp/core/rdp.c#L1129
```

vuln code
`rdp_read_share_control_header` could read 2 byte from stream, if `*length == 0x8000` , it could call `rdp_read_flow_control_pdu`.

```
BOOL rdp_read_share_control_header(wStream* s, UINT16* length, UINT16* type, UINT16* channel_id)
{
	if (Stream_GetRemainingLength(s) < 2)
		return FALSE;

	Stream_Read_UINT16(s, *length); /* totalLength */

	if (*length == 0x8000)
	{
		rdp_read_flow_control_pdu(s, type);   // vuln function

```
`rdp_read_flow_control_pdu` just read 1byte and seek some byte from stream without check length, it could `lead _s->pointer - _s->buffer > _s->length`, then the check in other function could failed

```
void rdp_read_flow_control_pdu(wStream* s, UINT16* type)
{

	UINT8 pduType;
	Stream_Read_UINT8(s, pduType); /* pduTypeFlow */
	*type = pduType;
	Stream_Seek_UINT8(s);  /* pad8bits */
	Stream_Seek_UINT8(s);  /* flowIdentifier */
	Stream_Seek_UINT8(s);  /* flowNumber */
	Stream_Seek_UINT16(s); /* pduSource */
}
```










--- end body ---

comments :
--- start comments ---

--- end comments ---