hitoshura25/cvefixes huggingface dataset:
CVE-2020-11047 (C, published 2020-05-07T20:15Z)
Description: value: In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/autodetect.c
Commit message: Fixed #6009: Bounds checks in autodetect_recv_bandwidth_measure_results


Vulnerable code:

Fixed code:
	if (Stream_GetRemainingLength(s) < 8)
		return -1;
CVE-2020-11048 (C, published 2020-05-07T20:15Z)
Description: value: In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session. No data extraction is possible. This has been fixed in 2.0.0.
Severity: LOW (CVSS v3 base score: 2.2)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/rdp.c
Commit message: Fixed #6007: Boundary checks in rdp_read_flow_control_pdu


Vulnerable code:
static void rdp_read_flow_control_pdu(wStream* s, UINT16* type);
	Stream_Read_UINT16(s, *length); /* totalLength */
	if (*length == 0x8000)
		rdp_read_flow_control_pdu(s, type);
	if (((size_t)*length - 2) > Stream_GetRemainingLength(s))
	if (*length > 4)
void rdp_read_flow_control_pdu(wStream* s, UINT16* type)

Fixed code:
static BOOL rdp_read_flow_control_pdu(wStream* s, UINT16* type);
	UINT16 len;
	Stream_Read_UINT16(s, len); /* totalLength */

	*length = len;
	if (len == 0x8000)
		if (!rdp_read_flow_control_pdu(s, type))
			return FALSE;
	if ((len < 4) || ((len - 2) > Stream_GetRemainingLength(s)))
	if (len > 4)
BOOL rdp_read_flow_control_pdu(wStream* s, UINT16* type)
	if (!type)
		return FALSE;
	if (Stream_GetRemainingLength(s) < 6)
		return FALSE;
	return TRUE;
CVE-2020-11049 (Unknown, published 2020-05-07T20:15Z)
Description: value: In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read of client memory that is then passed on to the protocol parser. This has been patched in 2.0.0.
Severity: LOW (CVSS v3 base score: 2.2)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
Commit message: Merge pull request #6019 from akallabeth/bound_access_fixes

Fix issues with boundary access.

Vulnerable code:

Fixed code:
CVE-2020-11058 (C, published 2020-05-12T21:15Z)
Description: value: In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0.
Severity: LOW (CVSS v3 base score: 2.2)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/capabilities.c
Commit message: Fixed #6011: Bounds check in rdp_read_font_capability_set


Vulnerable code:
	if (length > 4)
	if (length > 6)

Fixed code:
	if (length > 5)
	if (length > 7)
CVE-2020-11087 (C, published 2020-05-29T20:15Z)
Description: value: In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage. This has been fixed in 2.1.0.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
winpr/libwinpr/sspi/NTLM/ntlm_message.c
Commit message: Fixed oob read in ntlm_read_AuthenticateMessage


Vulnerable code:
	UINT32 flags;
	NTLM_AV_PAIR* AvFlags;
	flags = 0;
	AvFlags = NULL;
	{
		Stream_Free(s, FALSE);
		return SEC_E_INVALID_TOKEN;
	}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INVALID_TOKEN;
	}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INVALID_TOKEN;
	}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INVALID_TOKEN;
	}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INVALID_TOKEN;
	}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INVALID_TOKEN;
	}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INVALID_TOKEN;
	}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INVALID_TOKEN;
	}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INVALID_TOKEN;
	}
		{
			Stream_Free(s, FALSE);
			return SEC_E_INVALID_TOKEN;
		}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INTERNAL_ERROR;
	}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INTERNAL_ERROR;
	}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INTERNAL_ERROR;
	}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INTERNAL_ERROR;
	}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INTERNAL_ERROR;
	}
		{
			Stream_Free(s, FALSE);
			return SEC_E_INTERNAL_ERROR;
		}

		if (ntlm_read_ntlm_v2_response(snt, &(context->NTLMv2Response)) < 0)
		{
			Stream_Free(s, FALSE);
			Stream_Free(snt, FALSE);
			return SEC_E_INVALID_TOKEN;
		}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INTERNAL_ERROR;
	}
		{
			Stream_Free(s, FALSE);
			return SEC_E_INVALID_TOKEN;
		}
	{
		Stream_Free(s, FALSE);
		return SEC_E_INTERNAL_ERROR;
	}
		{
			Stream_Free(s, FALSE);
			return SEC_E_INVALID_TOKEN;
		}
		{
			Stream_Free(s, FALSE);
			return SEC_E_INTERNAL_ERROR;
		}
		{
			Stream_Free(s, FALSE);
			return SEC_E_INTERNAL_ERROR;
		}

Fixed code:
	SECURITY_STATUS status = SEC_E_INVALID_TOKEN;
	UINT32 flags = 0;
	NTLM_AV_PAIR* AvFlags = NULL;

		goto fail;
		goto fail;
		goto fail;
		goto fail;
		goto fail;
		goto fail;
		goto fail;
		goto fail;
	if (Stream_GetRemainingLength(s) < 4)
		goto fail;
		goto fail;
			goto fail;
	status = SEC_E_INTERNAL_ERROR;
		goto fail;
		goto fail;
		goto fail;
		goto fail;
		goto fail;
		int rc;
			goto fail;
		status = SEC_E_INVALID_TOKEN;
		rc = ntlm_read_ntlm_v2_response(snt, &(context->NTLMv2Response));
		if (rc < 0)
			goto fail;
		status = SEC_E_INTERNAL_ERROR;

		goto fail;
			goto fail;
		goto fail;
		status = SEC_E_INVALID_TOKEN;
			goto fail;
	status = SEC_E_INTERNAL_ERROR;

			goto fail;
			goto fail;

fail:
	Stream_Free(s, FALSE);
	return status;
CVE-2020-11088 (C, published 2020-05-29T20:15Z)
Description: value: In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
winpr/libwinpr/sspi/NTLM/ntlm_message.c
Commit message: Fixed oob read in ntlm_read_NegotiateMessage


Vulnerable code:

Fixed code:
	if (Stream_GetRemainingLength(s) < 4)
	{
		Stream_Free(s, FALSE);
		return SEC_E_INVALID_TOKEN;
	}
CVE-2020-11089 (C, published 2020-05-29T20:15Z)
Description: value: In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
channels/parallel/client/parallel_main.c
Commit message: Fixed oob read in parallel_process_irp_create


Vulnerable code:
	Stream_Seek(irp->input, 28);
	status = ConvertFromUnicode(CP_UTF8, 0, (WCHAR*)Stream_Pointer(irp->input), PathLength / 2,
	                            &path, 0, NULL, NULL);

Fixed code:
	WCHAR* ptr;
	if (!Stream_SafeSeek(irp->input, 28))
		return ERROR_INVALID_DATA;
	if (Stream_GetRemainingLength(irp->input) < 4)
		return ERROR_INVALID_DATA;
	ptr = (WCHAR*)Stream_Pointer(irp->input);
	if (!Stream_SafeSeek(irp->input, PathLength))
		return ERROR_INVALID_DATA;
	status = ConvertFromUnicode(CP_UTF8, 0, ptr, PathLength / 2, &path, 0, NULL, NULL);
CVE-2020-11098 (C, published 2020-06-22T22:15Z)
Description: value: In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/cache/glyph.c
Commit message: Fixed Out-of-bound read in glyph_cache_put

CVE-2020-11098 thanks to @antonio-morales for finding this.


Vulnerable code:
	if (index > glyphCache->glyphCache[id].number)

Fixed code:
	if (index >= glyphCache->glyphCache[id].number)
CVE-2020-11099 (C, published 2020-06-22T22:15Z)
Description: value: In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/license.c
Commit message: Fixed OOB Read in license_read_new_or_upgrade_license_packet

CVE-2020-11099 thanks to @antonio-morales for finding this.


Vulnerable code:

Fixed code:
	if (Stream_GetRemainingLength(licenseStream) < 8)
		goto out_free_stream;

	if (Stream_GetRemainingLength(licenseStream) < 4)
		goto out_free_stream;
	if (Stream_GetRemainingLength(licenseStream) < 4)
		goto out_free_stream;
	if (Stream_GetRemainingLength(licenseStream) < 4)
		goto out_free_stream;
CVE-2020-13396 (Other, published 2020-05-22T18:15Z)
Description: value: An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
ChangeLog
Commit message: Updated changelog for 2.1.1

(cherry picked from commit 470b21d32dd9c6b4673209c8be1e896882581a2c)


Vulnerable code:

Fixed code:
# 2020-05-20  Version 2.1.1

Important notes:
* CVE: GHSL-2020-100 OOB Read in ntlm_read_ChallengeMessage
* CVE: GHSL-2020-101 OOB Read in security_fips_decrypt due to uninitialized value
* CVE: GHSL-2020-102 OOB Write in crypto_rsa_common
* Enforce synchronous legacy RDP encryption count (#6156)
* Fixed some leaks and crashes missed in 2.1.0
* Removed dynamic channel listener limits
* Lots of resource cleanup fixes (clang sanitizers)
* A couple of performance improvements
* Various small annoyances eliminated (typos, prefilled username for windows client, ...)


For a complete and detailed change log since the last release candidate run:
git log 2.1.0..2.1.1
CVE-2020-13397 (Other, published 2020-05-22T18:15Z)
Description: value: An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
ChangeLog
Commit message: Updated changelog for 2.1.1

(cherry picked from commit 470b21d32dd9c6b4673209c8be1e896882581a2c)


Vulnerable code:

Fixed code:
# 2020-05-20  Version 2.1.1

Important notes:
* CVE: GHSL-2020-100 OOB Read in ntlm_read_ChallengeMessage
* CVE: GHSL-2020-101 OOB Read in security_fips_decrypt due to uninitialized value
* CVE: GHSL-2020-102 OOB Write in crypto_rsa_common
* Enforce synchronous legacy RDP encryption count (#6156)
* Fixed some leaks and crashes missed in 2.1.0
* Removed dynamic channel listener limits
* Lots of resource cleanup fixes (clang sanitizers)
* A couple of performance improvements
* Various small annoyances eliminated (typos, prefilled username for windows client, ...)


For a complete and detailed change log since the last release candidate run:
git log 2.1.0..2.1.1
CVE-2020-13398 (Other, published 2020-05-22T18:15Z)
Description: value: An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c.
Severity: MEDIUM (CVSS v3 base score: 8.3)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
ChangeLog
Commit message: Updated changelog for 2.1.1

(cherry picked from commit 470b21d32dd9c6b4673209c8be1e896882581a2c)


Vulnerable code:

Fixed code:
# 2020-05-20  Version 2.1.1

Important notes:
* CVE: GHSL-2020-100 OOB Read in ntlm_read_ChallengeMessage
* CVE: GHSL-2020-101 OOB Read in security_fips_decrypt due to uninitialized value
* CVE: GHSL-2020-102 OOB Write in crypto_rsa_common
* Enforce synchronous legacy RDP encryption count (#6156)
* Fixed some leaks and crashes missed in 2.1.0
* Removed dynamic channel listener limits
* Lots of resource cleanup fixes (clang sanitizers)
* A couple of performance improvements
* Various small annoyances eliminated (typos, prefilled username for windows client, ...)


For a complete and detailed change log since the last release candidate run:
git log 2.1.0..2.1.1
CVE-2020-4030 (C, published 2020-06-22T22:15Z)
Description: value: In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
winpr/libwinpr/utils/trio/trio.c
winpr/libwinpr/utils/trio/triostr.c
Commit message: Fixed TrioParse and trio_length limts.

CVE-2020-4030 thanks to @antonio-morales for finding this.


Vulnerable code:
	int length;
		if (precision == 0)
		if (trio_length(name) >= MAX_USER_NAME)
	return strlen(string);

Fixed code:
	int length = 0;
		if (precision <= 0)
		if (trio_length_max(name, MAX_USER_NAME) >= MAX_USER_NAME)
#include <limits.h>
	return trio_length_max(string, INT_MAX);
CVE-2020-4031 (C, published 2020-06-22T22:15Z)
Description: value: In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
server/shadow/shadow_server.c
Commit message: Fixed double free


Vulnerable code:
			free(list);

Fixed code:
				{
					free(list);
				}
			{
				free(list);
			}
CVE-2020-4032 (C, published 2020-06-22T22:15Z)
Description: value: In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /relax-order-checks are affected. This is fixed in version 2.1.2.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-681 \u2014 Incorrect Conversion between Numeric Types
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/orders.c
Commit message: Fixed OOB read in update_recv_secondary_order

CVE-2020-4032 thanks to @antonio-morales for finding this.


Vulnerable code:
	diff = start - end;
		Stream_Seek(s, diff);

Fixed code:
	diff = end - start;
		if (!Stream_SafeSeek(s, diff))
			return FALSE;
CVE-2020-4033 (C, published 2020-06-22T22:15Z)
Description: value: In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/codec/include/bitmap.c
Commit message: Fixed out of bound read in RLEDECOMPRESS

CVE-2020-4033 thanks to @antonio-morales for finding this.


Vulnerable code:

Fixed code:
					if (pbSrc >= pbEnd)
						return FALSE;
				if (pbSrc >= pbEnd)
					return FALSE;
				if (pbSrc >= pbEnd)
					return FALSE;
				if (pbSrc >= pbEnd)
					return FALSE;
				if (pbSrc >= pbEnd)
					return FALSE;
					if (pbSrc >= pbEnd)
						return FALSE;
CVE-2021-37594 (C, published 2021-07-30T14:15Z)
Description: value: In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_SIZE File Contents Request PDU.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
client/Windows/wf_cliprdr.c
Commit message: Fixed missing input checks for file contents request

reported by Valentino Ricotta (Thalium)


Vulnerable code:

Fixed code:
			if (clipboard->nFiles <= fileContentsRequest->listIndex)
				goto error;
			if (clipboard->nFiles <= fileContentsRequest->listIndex)
				goto error;
CVE-2021-37595 (C, published 2021-07-30T14:15Z)
Description: value: In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_RANGE File Contents Request PDU.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
client/Windows/wf_cliprdr.c
Commit message: Fixed missing input checks for file contents request

reported by Valentino Ricotta (Thalium)


Vulnerable code:

Fixed code:
			if (clipboard->nFiles <= fileContentsRequest->listIndex)
				goto error;
			if (clipboard->nFiles <= fileContentsRequest->listIndex)
				goto error;
CVE-2023-39350 (C, published 2023-08-31T20:15Z)
Description: value: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-191 \u2014 Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/codec/rfx.c
Commit message: [coded,rfx] check indices are within range

reported by @pwn2carr


Vulnerable code:

Fixed code:
			if (tile->quantIdxY >= context->numQuant)
			{
				WLog_Print(context->priv->log, WLOG_ERROR,
				           "quantIdxY %" PRIu8 " >= numQuant %" PRIu8, tile->quantIdxY,
				           context->numQuant);
				rc = FALSE;
				break;
			}
			if (tile->quantIdxCb >= context->numQuant)
			{
				WLog_Print(context->priv->log, WLOG_ERROR,
				           "quantIdxCb %" PRIu8 " >= numQuant %" PRIu8, tile->quantIdxCb,
				           context->numQuant);
				rc = FALSE;
				break;
			}
			if (tile->quantIdxCr >= context->numQuant)
			{
				WLog_Print(context->priv->log, WLOG_ERROR,
				           "quantIdxCr %" PRIu8 " >= numQuant %" PRIu8, tile->quantIdxCr,
				           context->numQuant);
				rc = FALSE;
				break;
			}
CVE-2023-39354 (C, published 2023-08-31T20:15Z)
Description: value: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `context->Planes` without  checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/codec/nsc.c
libfreerdp/codec/nsc_types.h
Commit message: [codec,nsc] fix input length validation


Vulnerable code:
static BOOL nsc_rle_decode(BYTE* in, BYTE* out, UINT32 outSize, UINT32 originalSize)
			if (*in < 0xFF)
	BYTE* rle = context->Planes;
			if (!nsc_rle_decode(rle, context->priv->PlaneBuffers[i],

Fixed code:
static BOOL nsc_rle_decode(const BYTE* in, size_t inSize, BYTE* out, UINT32 outSize,
                           UINT32 originalSize)
		if (inSize < 1)
			return FALSE;
		inSize--;

		else if (inSize < 1)
			return FALSE;
			inSize--;
			if (inSize < 1)
				return FALSE;
			else if (*in < 0xFF)
				inSize--;
				if (inSize < 5)
					return FALSE;
				inSize -= 5;
	if (inSize < 4)
		return FALSE;
	const BYTE* rle = context->Planes;
	size_t rleSize = context->PlanesSize;
		if (rleSize < planeSize)
			return FALSE;

			if (!nsc_rle_decode(rle, rleSize, context->priv->PlaneBuffers[i],
			if (rleSize < originalSize)
				return FALSE;

	context->PlanesSize = total;
	size_t PlanesSize;