From 18deeba63c4091dfa96973a02df5bc214b4844c3 Mon Sep 17 00:00:00 2001 From: Armin Novak Date: Sun, 12 Jul 2026 17:37:48 +0200 Subject: [PATCH] [channels,audin] limit FramesPerPacket --- channels/audin/client/audin_main.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/channels/audin/client/audin_main.c b/channels/audin/client/audin_main.c index 23093fb8e..7c403cbbb 100644 --- a/channels/audin/client/audin_main.c +++ b/channels/audin/client/audin_main.c @@ -485,7 +485,6 @@ static UINT audin_process_open(AUDIN_PLUGIN* audin, AUDIN_CHANNEL_CALLBACK* call Stream_Read_UINT32(s, initialFormat); WLog_Print(audin->log, WLOG_DEBUG, "FramesPerPacket=%" PRIu32 " initialFormat=%" PRIu32 "", FramesPerPacket, initialFormat); - audin->FramesPerPacket = FramesPerPacket; if (initialFormat >= callback->formats_count) { @@ -494,6 +493,15 @@ static UINT audin_process_open(AUDIN_PLUGIN* audin, AUDIN_CHANNEL_CALLBACK* call return ERROR_INVALID_DATA; } + /* The RDP protocol field allows UINT32_MAX, but most backend API use INT32 as input parameter + * or do some math with it, so ensure that the value does not exceed reasonable limits */ + if (FramesPerPacket >= INT32_MAX) + { + WLog_Print(audin->log, WLOG_ERROR, "invalid frames per packet %" PRIu32, FramesPerPacket); + return ERROR_INVALID_DATA; + } + + audin->FramesPerPacket = FramesPerPacket; audin->format = &callback->formats[initialFormat]; if (!audin_open_device(audin, callback))