In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0.
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
F953BF38-4A6C-41EE-B646-37702989F524
2.0.0
1.1.0
OR
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
OR
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
A31C8344-3E02-4EB8-8BD8-4C84B7959624
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
902B8056-9E37-443B-8905-8AA93E2447FB
OR
version
```
https://github.com/FreeRDP/FreeRDP/blob/9ef1e81c559bb19d613b4da2d68908ea5d7f9259/libfreerdp/core/window.c#L187
```

vuln code 

`update_read_icon_info`  first read `iconInfo->cbColorTable`, `iconInfo->cbBitsMask` and `iconInfo->cbBitsColor` from the wStream, 

```
static BOOL update_read_icon_info(wStream* s, ICON_INFO* iconInfo)
{
        ..................................................
        ..................................................
			Stream_Read_UINT16(s, iconInfo->cbColorTable); /* cbColorTable (2 bytes) */
			break;
	}
        // 
	Stream_Read_UINT16(s, iconInfo->cbBitsMask);  /* cbBitsMask (2 bytes) */
	Stream_Read_UINT16(s, iconInfo->cbBitsColor); /* cbBitsColor (2 bytes) */
```

And then it check cbBitsMask and cbBitsColor
```
	if (Stream_GetRemainingLength(s) < iconInfo->cbBitsMask + iconInfo->cbBitsColor)
		return FALSE;
```
Then it could call Stream_Read to read data from s, size is `cbBitsMask+cbColorTable+cbBitsColor`

```
        ....................................................................................................
        ....................................................................................................
        ....................................................................................................
	Stream_Read(s, iconInfo->bitsMask, iconInfo->cbBitsMask);

        ....................................................................................................
        ....................................................................................................

		Stream_Read(s, iconInfo->colorTable, iconInfo->cbColorTable);

        ....................................................................................................
        ....................................................................................................
	Stream_Read(s, iconInfo->bitsColor, iconInfo->cbBitsColor);
```

so when `cbBitsMask+cbBitsColor < Stream_GetRemainingLength(s)`  and `cbBitsMask+cbColorTable+cbBitsColor > Stream_GetRemainingLength(s) `, it could lead memory out of bounds read














memory out of bounds read in update_read_icon_info
This is a GitHub Issue
repo:FreeRDP
owner:FreeRDP
Title : memory out of bounds read in update_read_icon_info
Issue date:

--- start body ---
version
```
https://github.com/FreeRDP/FreeRDP/blob/9ef1e81c559bb19d613b4da2d68908ea5d7f9259/libfreerdp/core/window.c#L187
```

vuln code 

`update_read_icon_info`  first read `iconInfo->cbColorTable`, `iconInfo->cbBitsMask` and `iconInfo->cbBitsColor` from the wStream, 

```
static BOOL update_read_icon_info(wStream* s, ICON_INFO* iconInfo)
{
        ..................................................
        ..................................................
			Stream_Read_UINT16(s, iconInfo->cbColorTable); /* cbColorTable (2 bytes) */
			break;
	}
        // 
	Stream_Read_UINT16(s, iconInfo->cbBitsMask);  /* cbBitsMask (2 bytes) */
	Stream_Read_UINT16(s, iconInfo->cbBitsColor); /* cbBitsColor (2 bytes) */
```

And then it check cbBitsMask and cbBitsColor
```
	if (Stream_GetRemainingLength(s) < iconInfo->cbBitsMask + iconInfo->cbBitsColor)
		return FALSE;
```
Then it could call Stream_Read to read data from s, size is `cbBitsMask+cbColorTable+cbBitsColor`

```
        ....................................................................................................
        ....................................................................................................
        ....................................................................................................
	Stream_Read(s, iconInfo->bitsMask, iconInfo->cbBitsMask);

        ....................................................................................................
        ....................................................................................................

		Stream_Read(s, iconInfo->colorTable, iconInfo->cbColorTable);

        ....................................................................................................
        ....................................................................................................
	Stream_Read(s, iconInfo->bitsColor, iconInfo->cbBitsColor);
```

so when `cbBitsMask+cbBitsColor < Stream_GetRemainingLength(s)`  and `cbBitsMask+cbColorTable+cbBitsColor > Stream_GetRemainingLength(s) `, it could lead memory out of bounds read














--- end body ---

comments :
--- start comments ---

--- end comments ---