In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0.
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
D678CADD-67F7-4293-9771-33B33AEC1D4F
2.0.0
1.2.0
OR
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
A31C8344-3E02-4EB8-8BD8-4C84B7959624
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
902B8056-9E37-443B-8905-8AA93E2447FB
OR
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
OR
version
```
https://github.com/FreeRDP/FreeRDP/blob/9ef1e81c559bb19d613b4da2d68908ea5d7f9259/libfreerdp/core/orders.c#L2167
```

vuln code

`update_read_cache_bitmap_v3_order` first read new_len from stream, and pass the new_len to  realloc

Then it could call `realloc(bitmapData->data, 0)`, this could free `bitmapData->data`, and return NULL

realloc function source code
```
 void *__libc_realloc(void *oldmem, size_t bytes)
{

  if (bytes == 0 && oldmem != NULL)  // if bytes =0, it could free(oldmem).
  {
    __libc_free(oldmem);
    return 0;
  }
```

when new_data is NULL, it could call free_cache_bitmap_v3_order to free  `bitmapData->data` again.

Double Free!

function code.

```
static CACHE_BITMAP_V3_ORDER* update_read_cache_bitmap_v3_order
{
	Stream_Read_UINT32(s, new_len);     // if new_len = 0

	if (Stream_GetRemainingLength(s) < new_len)  //pass this check
		goto fail;

	new_data = (BYTE*)realloc(bitmapData->data, new_len);  // realloc could free bitmapData->data

	if (!new_data) // new_data could be NULL
		goto fail;


fail:
	free_cache_bitmap_v3_order(update->context, cache_bitmap_v3);  // free bitmapData->data again.
	return NULL;
}
```






double free in update_read_cache_bitmap_v3_order
This is a GitHub Issue
repo:FreeRDP
owner:FreeRDP
Title : double free in update_read_cache_bitmap_v3_order
Issue date:

--- start body ---
version
```
https://github.com/FreeRDP/FreeRDP/blob/9ef1e81c559bb19d613b4da2d68908ea5d7f9259/libfreerdp/core/orders.c#L2167
```

vuln code

`update_read_cache_bitmap_v3_order` first read new_len from stream, and pass the new_len to  realloc

Then it could call `realloc(bitmapData->data, 0)`, this could free `bitmapData->data`, and return NULL

realloc function source code
```
 void *__libc_realloc(void *oldmem, size_t bytes)
{

  if (bytes == 0 && oldmem != NULL)  // if bytes =0, it could free(oldmem).
  {
    __libc_free(oldmem);
    return 0;
  }
```

when new_data is NULL, it could call free_cache_bitmap_v3_order to free  `bitmapData->data` again.

Double Free!

function code.

```
static CACHE_BITMAP_V3_ORDER* update_read_cache_bitmap_v3_order
{
	Stream_Read_UINT32(s, new_len);     // if new_len = 0

	if (Stream_GetRemainingLength(s) < new_len)  //pass this check
		goto fail;

	new_data = (BYTE*)realloc(bitmapData->data, new_len);  // realloc could free bitmapData->data

	if (!new_data) // new_data could be NULL
		goto fail;


fail:
	free_cache_bitmap_v3_order(update->context, cache_bitmap_v3);  // free bitmapData->data again.
	return NULL;
}
```






--- end body ---

comments :
--- start comments ---

--- end comments ---