Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ignore TS_MULTIFRAGMENTUPDATE_CAPABILITYSET from client if fp disabled #1593

Merged
merged 1 commit into from
May 27, 2020

Conversation

matt335672
Copy link
Member

Fixes #1569

rdesktop 1.9.0 (as delivered with Ubuntu 20.04) sends a TS_MULTIFRAGMENTUPDATE_CAPABILITYSET structure ([MS-RDPBCGR] 2.2.7.2.6) with a MaxRequestSize of 65535.

If the user has disabled fastpath output using use_fastpath in xrdp.ini, the following happens:-

  • An output buffer is created of size 32768 in xrdp_orders_create().
  • Receipt of TS_MULTIFRAGMENTUPDATE_CAPABILITYSET in xrdp_caps_process_multifragmentupdate() sets client_info.max_fastpath_frag_bytes to 65535.
  • This value is used by xrdp_orders_check() va the MAX_ORDERS_SIZE macro to determine when to send the orders buffer. Consequently the buffer overflows when being written to.

This PR simply ignores any sent MaxRequestSize value if fastpath output is disabled.

@metalefty metalefty added the protocol reladted to RDP protocol, xrdp violates protocol spec, etc label May 26, 2020
@metalefty
Copy link
Member

@metalefty
Copy link
Member

Fair enough. Nice work.

@metalefty
Copy link
Member

Merge it.

@matt335672 matt335672 linked an issue May 27, 2020 that may be closed by this pull request
@matt335672 matt335672 merged commit 358f07d into neutrinolabs:devel May 27, 2020
@matt335672 matt335672 deleted the issue1569 branch May 27, 2020 07:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
protocol reladted to RDP protocol, xrdp violates protocol spec, etc
Projects
None yet
2 participants