FreeRDP/FreeRDP — pull request #1167 by dpoe (2013-04-05 19:03:44+00:00)
Title: Fix for expected PDU_TYPE_DEMAND_ACTIVE 0001, got 0007

This is related to issue #729 and it is probably #729's cause.

The problem here is that during rdp_client_connect_demand_active, an error PDU may be sent from the server. The code is set up to handle unexpected PDUs, but it skips over a fixed number of bytes (RDP_PACKET_HEADER_MAX_LENGTH) rather than basing it on the content of the headers (TPKT+X224+T125, etc.). In summary, it skips over 15 bytes when it should be skipping over 14, and then when the demand_active parsing picks up again, it starts in the wrong place and fails.

The fix is to use the same header-parsing code to handle the error packet header, rather than relying on a fixed offset. That code is smart enough to compute the offsets correctly.