Vulnerability: In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2.
Vulnerability ID: CVE-2020-11099
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/FreeRDP/FreeRDP
Published: 2020-06-22
File: libfreerdp/core/license.c
Commit message: Fixed OOB Read in license_read_new_or_upgrade_license_packet

CVE-2020-11099 thanks to @antonio-morales for finding this.
Commit author: akallabeth

Vulnerable version (before fix):
 BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s) 	if (!licenseStream) 		goto out_free_blob;  	Stream_Read_UINT16(licenseStream, os_minor); 	Stream_Read_UINT16(licenseStream, os_major);  BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s) 	Stream_Seek(licenseStream, cbScope);  	/* CompanyName */ 	Stream_Read_UINT32(licenseStream, cbCompanyName); 	if (Stream_GetRemainingLength(licenseStream) < cbCompanyName) 		goto out_free_stream; BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s) 	Stream_Seek(licenseStream, cbCompanyName);  	/* productId */ 	Stream_Read_UINT32(licenseStream, cbProductId); 	if (Stream_GetRemainingLength(licenseStream) < cbProductId) 		goto out_free_stream; BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s) 	Stream_Seek(licenseStream, cbProductId);  	/* licenseInfo */ 	Stream_Read_UINT32(licenseStream, cbLicenseInfo); 	if (Stream_GetRemainingLength(licenseStream) < cbLicenseInfo) 		goto out_free_stream;

Fixed version (after fix):
 BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s) 	if (!licenseStream) 		goto out_free_blob;  	if (Stream_GetRemainingLength(licenseStream) < 8) 		goto out_free_stream;  	Stream_Read_UINT16(licenseStream, os_minor); 	Stream_Read_UINT16(licenseStream, os_major);  BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s) 	Stream_Seek(licenseStream, cbScope);  	/* CompanyName */ 	if (Stream_GetRemainingLength(licenseStream) < 4) 		goto out_free_stream; 	Stream_Read_UINT32(licenseStream, cbCompanyName); 	if (Stream_GetRemainingLength(licenseStream) < cbCompanyName) 		goto out_free_stream; BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s) 	Stream_Seek(licenseStream, cbCompanyName);  	/* productId */ 	if (Stream_GetRemainingLength(licenseStream) < 4) 		goto out_free_stream; 	Stream_Read_UINT32(licenseStream, cbProductId); 	if (Stream_GetRemainingLength(licenseStream) < cbProductId) 		goto out_free_stream; BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s) 	Stream_Seek(licenseStream, cbProductId);  	/* licenseInfo */ 	if (Stream_GetRemainingLength(licenseStream) < 4) 		goto out_free_stream; 	Stream_Read_UINT32(licenseStream, cbLicenseInfo); 	if (Stream_GetRemainingLength(licenseStream) < cbLicenseInfo) 		goto out_free_stream;

Patch:
patch: @@ -1252,6 +1252,9 @@ BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s)
 	if (!licenseStream)
 		goto out_free_blob;
 
+	if (Stream_GetRemainingLength(licenseStream) < 8)
+		goto out_free_stream;
+
 	Stream_Read_UINT16(licenseStream, os_minor);
 	Stream_Read_UINT16(licenseStream, os_major);
 
@@ -1266,6 +1269,8 @@ BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s)
 	Stream_Seek(licenseStream, cbScope);
 
 	/* CompanyName */
+	if (Stream_GetRemainingLength(licenseStream) < 4)
+		goto out_free_stream;
 	Stream_Read_UINT32(licenseStream, cbCompanyName);
 	if (Stream_GetRemainingLength(licenseStream) < cbCompanyName)
 		goto out_free_stream;
@@ -1276,6 +1281,8 @@ BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s)
 	Stream_Seek(licenseStream, cbCompanyName);
 
 	/* productId */
+	if (Stream_GetRemainingLength(licenseStream) < 4)
+		goto out_free_stream;
 	Stream_Read_UINT32(licenseStream, cbProductId);
 	if (Stream_GetRemainingLength(licenseStream) < cbProductId)
 		goto out_free_stream;
@@ -1286,6 +1293,8 @@ BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s)
 	Stream_Seek(licenseStream, cbProductId);
 
 	/* licenseInfo */
+	if (Stream_GetRemainingLength(licenseStream) < 4)
+		goto out_free_stream;
 	Stream_Read_UINT32(licenseStream, cbLicenseInfo);
 	if (Stream_GetRemainingLength(licenseStream) < cbLicenseInfo)
 		goto out_free_stream;
path: libfreerdp/core/license.c