VUL: check bytes remaining in xrdp_rdp_process_data_input

1 files changed, 8 insertions, 0 deletions

diff --git a/libxrdp/xrdp_rdp.c b/libxrdp/xrdp_rdp.c
index bd075a59..a1a330c2 100644
--- a/libxrdp/xrdp_rdp.c
+++ b/libxrdp/xrdp_rdp.c
@@ -1237,11 +1237,19 @@ xrdp_rdp_process_data_input(struct xrdp_rdp* self, struct stream* s)
   int param2;
   int time;
 
+  if (!s_check_rem(s, 4))
+  {
+    return 1;
+  }
   in_uint16_le(s, num_events);
   in_uint8s(s, 2); /* pad */
   DEBUG(("in xrdp_rdp_process_data_input %d events", num_events));
   for (index = 0; index < num_events; index++)
   {
+    if (!s_check_rem(s, 12))
+    {
+      return 1;
+    }
     in_uint32_le(s, time);
     in_uint16_le(s, msg_type);
     in_uint16_le(s, device_flags);