diff --git a/libxrdp/xrdp_sec.c b/libxrdp/xrdp_sec.c index 3e9cef66..fd8dfa36 100644 --- a/libxrdp/xrdp_sec.c +++ b/libxrdp/xrdp_sec.c @@ -1969,6 +1969,13 @@ xrdp_sec_process_mcs_data_monitors(struct xrdp_sec *self, struct stream *s) client_info->width = (x2 - x1) + 1; client_info->height = (y2 - y1) + 1; } + /* make sure virtual desktop size is ok */ + if ((client_info->width > 0x7FFE && client_info->width < 0xC8) || + (client_info->height > 0x7FFE && client_info->height < 0xC8)) + { + LLOGLN(0, ("[ERROR] xrdp_sec_process_mcs_data_monitors: error, virtual desktop width / height is too large")); + return 1; /* error */ + } /* keep a copy of non negative monitor info values for xrdp_wm usage */ for (index = 0; index < monitorCount; index++)