{"action":"created","issue":{"url":"https://api.github.com/repos/FreeRDP/FreeRDP/issues/4925","repository_url":"https://api.github.com/repos/FreeRDP/FreeRDP","labels_url":"https://api.github.com/repos/FreeRDP/FreeRDP/issues/4925/labels{/name}","comments_url":"https://api.github.com/repos/FreeRDP/FreeRDP/issues/4925/comments","events_url":"https://api.github.com/repos/FreeRDP/FreeRDP/issues/4925/events","html_url":"https://github.com/FreeRDP/FreeRDP/issues/4925","id":369911715,"node_id":"MDU6SXNzdWUzNjk5MTE3MTU=","number":4925,"title":"color.c : freerdp_image_copy : unchecked memory bounds leads to crash","user":{"login":"openconcerto","id":1234263,"node_id":"MDQ6VXNlcjEyMzQyNjM=","avatar_url":"https://avatars1.githubusercontent.com/u/1234263?v=4","gravatar_id":"","url":"https://api.github.com/users/openconcerto","html_url":"https://github.com/openconcerto","followers_url":"https://api.github.com/users/openconcerto/followers","following_url":"https://api.github.com/users/openconcerto/following{/other_user}","gists_url":"https://api.github.com/users/openconcerto/gists{/gist_id}","starred_url":"https://api.github.com/users/openconcerto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openconcerto/subscriptions","organizations_url":"https://api.github.com/users/openconcerto/orgs","repos_url":"https://api.github.com/users/openconcerto/repos","events_url":"https://api.github.com/users/openconcerto/events{/privacy}","received_events_url":"https://api.github.com/users/openconcerto/received_events","type":"User","site_admin":false},"labels":[{"id":198376,"node_id":"MDU6TGFiZWwxOTgzNzY=","url":"https://api.github.com/repos/FreeRDP/FreeRDP/labels/blocker","name":"blocker","color":"FF0C02","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/FreeRDP/FreeRDP/milestones/10","html_url":"https://github.com/FreeRDP/FreeRDP/milestone/10","labels_url":"https://api.github.com/repos/FreeRDP/FreeRDP/milestones/10/labels","id":3262235,"node_id":"MDk6TWlsZXN0b25lMzI2MjIzNQ==","number":10,"title":"2.0.0","description":"2.0.0 release","creator":{"login":"bmiklautz","id":195793,"node_id":"MDQ6VXNlcjE5NTc5Mw==","avatar_url":"https://avatars0.githubusercontent.com/u/195793?v=4","gravatar_id":"","url":"https://api.github.com/users/bmiklautz","html_url":"https://github.com/bmiklautz","followers_url":"https://api.github.com/users/bmiklautz/followers","following_url":"https://api.github.com/users/bmiklautz/following{/other_user}","gists_url":"https://api.github.com/users/bmiklautz/gists{/gist_id}","starred_url":"https://api.github.com/users/bmiklautz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bmiklautz/subscriptions","organizations_url":"https://api.github.com/users/bmiklautz/orgs","repos_url":"https://api.github.com/users/bmiklautz/repos","events_url":"https://api.github.com/users/bmiklautz/events{/privacy}","received_events_url":"https://api.github.com/users/bmiklautz/received_events","type":"User","site_admin":false},"open_issues":59,"closed_issues":95,"state":"open","created_at":"2018-04-12T14:01:12Z","updated_at":"2018-10-15T09:52:10Z","due_on":null,"closed_at":null},"comments":11,"created_at":"2018-10-14T15:13:03Z","updated_at":"2018-10-15T21:04:22Z","closed_at":null,"author_association":"NONE","body":"If a server send wrong or out of client screen coordinates command parameters (which can be valid),\r\nxfreerdp is seriously \"garbarging\" memory.\r\n\r\nThis issue causes serious issues of compatibility and can lead to exploit from a malicious server.\r\n\r\nThe problem is present in the master branch.\r\nFor example, the parameters in  freerdp_image_copy (codec/color.c) and other free_rdp functions MUST check these parameters :\r\nnDstStep, nXDst, nYDst,\r\nnWidth, nHeight,\r\nnSrcStep, nXSrc, nYSrc\r\n\r\n(It took me some hours to find the cause of random crashes of xfreerdp and Remmina)\r\n\r\nPlease note that in the RDP GDI Specification ([MS-RDPEGDI]), coordinates MUST be considered as signed values (see 2.2.2.2.1.1.1.1), but your implementation is \"converting\" the INT32s from the order structure to UINT32 parameters in free_rdp* functions.\r\n"},"comment":{"url":"https://api.github.com/repos/FreeRDP/FreeRDP/issues/comments/430012598","html_url":"https://github.com/FreeRDP/FreeRDP/issues/4925#issuecomment-430012598","issue_url":"https://api.github.com/repos/FreeRDP/FreeRDP/issues/4925","id":430012598,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMDAxMjU5OA==","user":{"login":"openconcerto","id":1234263,"node_id":"MDQ6VXNlcjEyMzQyNjM=","avatar_url":"https://avatars1.githubusercontent.com/u/1234263?v=4","gravatar_id":"","url":"https://api.github.com/users/openconcerto","html_url":"https://github.com/openconcerto","followers_url":"https://api.github.com/users/openconcerto/followers","following_url":"https://api.github.com/users/openconcerto/following{/other_user}","gists_url":"https://api.github.com/users/openconcerto/gists{/gist_id}","starred_url":"https://api.github.com/users/openconcerto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openconcerto/subscriptions","organizations_url":"https://api.github.com/users/openconcerto/orgs","repos_url":"https://api.github.com/users/openconcerto/repos","events_url":"https://api.github.com/users/openconcerto/events{/privacy}","received_events_url":"https://api.github.com/users/openconcerto/received_events","type":"User","site_admin":false},"created_at":"2018-10-15T21:04:22Z","updated_at":"2018-10-15T21:04:22Z","author_association":"NONE","body":"The displays is corrupted and after some minutes, it crashed... (I use valgrind).\r\n\r\n[14:02:30:798] [26461:26462] [DEBUG][com.freerdp.core.update] - Primary Drawing Order [0x13] MemBlt rop=S [0x00cc0020]\r\n[14:02:30:798] [26461:26462] [DEBUG][com.freerdp.core.update] - Primary Drawing Order [0x13] MemBlt rop=S [0x00cc0020]\r\n[14:02:30:798] [26461:26462] [DEBUG][com.freerdp.core.update] - Primary Drawing Order [0x10] OpaqueRect\r\n[14:02:30:799] [26461:26462] [DEBUG][com.freerdp.core.update] - Primary Drawing Order [0x13] MemBlt rop=S [0x00cc0020]\r\n[14:02:30:799] [26461:26462] [DEBUG][com.freerdp.core.update] - Primary Drawing Order [0x13] MemBlt rop=S [0x00cc0020]\r\n[14:02:30:799] [26461:26462] [DEBUG][com.freerdp.core.update] - Primary Drawing Order [0x13] MemBlt rop=S [0x00cc0020]\r\n[14:02:30:799] [26461:26462] [DEBUG][com.freerdp.core.update] - Secondary Drawing Order [0x05] Cache Bitmap V2 (Compressed)\r\n[14:02:30:801] [26461:26462] [DEBUG][com.freerdp.core.update] - Primary Drawing Order [0x13] MemBlt rop=S [0x00cc0020]\r\n[14:02:30:801] [26461:26462] [DEBUG][com.freerdp.core.update] - Secondary Drawing Order [0x05] Cache Bitmap V2 (Compressed)\r\n[14:02:30:803] [26461:26462] [DEBUG][com.freerdp.core.update] - Primary Drawing Order [0x13] MemBlt rop=S [0x00cc0020]\r\n[14:02:30:803] [26461:26462] [DEBUG][com.freerdp.core.update] - Primary Drawing Order [0x13] MemBlt rop=S [0x00cc0020]\r\n[14:02:30:803] [26461:26462] [DEBUG][com.freerdp.core.update] - Secondary Drawing Order [0x05] Cache Bitmap V2 (Compressed)\r\n[14:02:30:804] [26461:26462] [DEBUG][com.freerdp.core.update] - Primary Drawing Order [0x13] MemBlt rop=S [0x00cc0020]\r\n==26461== \r\n==26461== Process terminating with default action of signal 11 (SIGSEGV)\r\n==26461==    at 0x715AE75: raise (raise.c:46)\r\n==26461==    by 0x64B62E6: fatal_handler (signal.c:67)\r\n==26461==    by 0x715AF1F: ??? (in /lib/x86_64-linux-gnu/libc-2.27.so)\r\n==26461==    by 0x4C367DF: memmove (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\r\n==26461==    by 0x657E05C: freerdp_image_copy (color.c:507)\r\n==26461==    by 0x64C41BC: gdi_BitBlt (bitmap.c:486)\r\n==26461==    by 0x64D2BE7: gdi_memblt (gdi.c:821)\r\n==26461==    by 0x64D6744: update_gdi_memblt (bitmap.c:65)\r\n==26461==    by 0x6520AFC: update_recv_primary_order (orders.c:3602)\r\n==26461==    by 0x65229E3: update_recv_order (orders.c:4083)\r\n==26461==    by 0x654A36B: fastpath_recv_orders (fastpath.c:291)\r\n==26461==    by 0x654A65D: fastpath_recv_update (fastpath.c:389)\r\n==26461== \r\n==26461== HEAP SUMMARY:\r\n==26461==     in use at exit: 40,037,319 bytes in 12,145 blocks\r\n==26461==   total heap usage: 43,350 allocs, 31,205 frees, 61,783,991 bytes allocated\r\n==26461== \r\n==26461== LEAK SUMMARY:\r\n==26461==    definitely lost: 0 bytes in 0 blocks\r\n==26461==    indirectly lost: 0 bytes in 0 blocks\r\n==26461==      possibly lost: 17,004,152 bytes in 2,123 blocks\r\n==26461==    still reachable: 23,033,167 bytes in 10,022 blocks\r\n==26461==                       of which reachable via heuristic:\r\n==26461==                         newarray           : 1,536 bytes in 16 blocks\r\n==26461==         suppressed: 0 bytes in 0 blocks\r\n==26461== Rerun with --leak-check=full to see details of leaked memory\r\n==26461== \r\n==26461== For counts of detected and suppressed errors, rerun with: -v\r\n==26461== ERROR SUMMARY: 789128 errors from 6 contexts (suppressed: 166 from 1)\r\nErreur de segmentation (core dumped)\r\n\r\n"}}
{"actor":{"display_login":"openconcerto"}}