In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0.
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
F953BF38-4A6C-41EE-B646-37702989F524
2.0.0
1.1.0
OR
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*
B3293E55-5506-4587-A318-D1734F781C09
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
A31C8344-3E02-4EB8-8BD8-4C84B7959624
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
902B8056-9E37-443B-8905-8AA93E2447FB
OR
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
OR
version
```
https://github.com/FreeRDP/FreeRDP/blob/9ef1e81c559bb19d613b4da2d68908ea5d7f9259/libfreerdp/core/autodetect.c#L459
```

vuln code 

autodetect_recv_bandwidth_measure_results read 8 bytes from stream without check stream's length

```
static BOOL autodetect_recv_bandwidth_measure_results(rdpRdp* rdp, wStream* s,
                                                      AUTODETECT_RSP_PDU* autodetectRspPdu)
{
	BOOL success = TRUE;

	if (autodetectRspPdu->headerLength != 0x0E)
		return FALSE;

	WLog_VRB(AUTODETECT_TAG, "received Bandwidth Measure Results PDU");
	Stream_Read_UINT32(s, rdp->autodetect->bandwidthMeasureTimeDelta); /* timeDelta (4 bytes) */
	Stream_Read_UINT32(s, rdp->autodetect->bandwidthMeasureByteCount); /* byteCount (4 bytes) */

```





memory out of bounds read in autodetect_recv_bandwidth_measure_results
This is a GitHub Issue
repo:FreeRDP
owner:FreeRDP
Title : memory out of bounds read in autodetect_recv_bandwidth_measure_results
Issue date:

--- start body ---
version
```
https://github.com/FreeRDP/FreeRDP/blob/9ef1e81c559bb19d613b4da2d68908ea5d7f9259/libfreerdp/core/autodetect.c#L459
```

vuln code 

autodetect_recv_bandwidth_measure_results read 8 bytes from stream without check stream's length

```
static BOOL autodetect_recv_bandwidth_measure_results(rdpRdp* rdp, wStream* s,
                                                      AUTODETECT_RSP_PDU* autodetectRspPdu)
{
	BOOL success = TRUE;

	if (autodetectRspPdu->headerLength != 0x0E)
		return FALSE;

	WLog_VRB(AUTODETECT_TAG, "received Bandwidth Measure Results PDU");
	Stream_Read_UINT32(s, rdp->autodetect->bandwidthMeasureTimeDelta); /* timeDelta (4 bytes) */
	Stream_Read_UINT32(s, rdp->autodetect->bandwidthMeasureByteCount); /* byteCount (4 bytes) */

```





--- end body ---

comments :
--- start comments ---

--- end comments ---