In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0.
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
F953BF38-4A6C-41EE-B646-37702989F524
2.0.0
1.1.0
OR
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*
B3293E55-5506-4587-A318-D1734F781C09
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
A31C8344-3E02-4EB8-8BD8-4C84B7959624
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
902B8056-9E37-443B-8905-8AA93E2447FB
OR
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
OR
version
```
https://github.com/FreeRDP/FreeRDP/blob/9ef1e81c559bb19d613b4da2d68908ea5d7f9259/libfreerdp/core/rdp.c#L1129
```



vuln code

if `Stream_GetRemainingLength(s) =  5` and `*length = 5`,  it could one byte overflow read in `Stream_Read_UINT16(s, *channel_id);`




```
BOOL rdp_read_share_control_header(wStream* s, UINT16* length, UINT16* type, UINT16* channel_id)
{
	if (Stream_GetRemainingLength(s) < 2)
		return FALSE;

	Stream_Read_UINT16(s, *length); /* totalLength */

	if (((size_t)*length - 2) > Stream_GetRemainingLength(s))
		return FALSE;

	Stream_Read_UINT16(s, *type); /* pduType */
	*type &= 0x0F;                /* type is in the 4 least significant bits */

	if (*length > 4)
		Stream_Read_UINT16(s, *channel_id);   // memory out of bounds read
	return TRUE;
}
```


memory out of bounds read in rdp_read_share_control_header
This is a GitHub Issue
repo:FreeRDP
owner:FreeRDP
Title : memory out of bounds read in rdp_read_share_control_header
Issue date:

--- start body ---
version
```
https://github.com/FreeRDP/FreeRDP/blob/9ef1e81c559bb19d613b4da2d68908ea5d7f9259/libfreerdp/core/rdp.c#L1129
```



vuln code

if `Stream_GetRemainingLength(s) =  5` and `*length = 5`,  it could one byte overflow read in `Stream_Read_UINT16(s, *channel_id);`




```
BOOL rdp_read_share_control_header(wStream* s, UINT16* length, UINT16* type, UINT16* channel_id)
{
	if (Stream_GetRemainingLength(s) < 2)
		return FALSE;

	Stream_Read_UINT16(s, *length); /* totalLength */

	if (((size_t)*length - 2) > Stream_GetRemainingLength(s))
		return FALSE;

	Stream_Read_UINT16(s, *type); /* pduType */
	*type &= 0x0F;                /* type is in the 4 least significant bits */

	if (*length > 4)
		Stream_Read_UINT16(s, *channel_id);   // memory out of bounds read
	return TRUE;
}
```


--- end body ---

comments :
--- start comments ---

--- end comments ---