File xrdp-CVE-2022-23483.patch of Package xrdp.27289

From 54d49147679e8f5e75527ac701d51793f0746c52 Mon Sep 17 00:00:00 2001
From: matt335672 <30179339+matt335672@users.noreply.github.com>
Date: Wed, 7 Dec 2022 10:21:41 +0000
Subject: [PATCH 7/8] CVE-2022-23483

Sanitise channel data being passed from application

Avoids OOB read if the size field is incorrect.
---
 xrdp/xrdp_mm.c | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/xrdp/xrdp_mm.c b/xrdp/xrdp_mm.c
index 4c716d46..2c6999c6 100644
--- a/xrdp/xrdp_mm.c
+++ b/xrdp/xrdp_mm.c
@@ -718,31 +718,32 @@ static int
 xrdp_mm_trans_process_channel_data(struct xrdp_mm *self, struct trans *trans)
 {
     struct stream *s;
-    int size;
-    int total_size;
+    unsigned int size;
+    unsigned int total_size;
     int chan_id;
     int chan_flags;
-    int rv;
+    int rv = 0;
 
     s = trans_get_in_s(trans);
 
-    if (s == 0)
+    if (!s_check_rem_and_log(s, 10, "Reading channel data header"))
     {
-        return 1;
+        rv = 1;
     }
-
-    in_uint16_le(s, chan_id);
-    in_uint16_le(s, chan_flags);
-    in_uint16_le(s, size);
-    in_uint32_le(s, total_size);
-    rv = xrdp_mm_trans_send_channel_data_response(self, trans);
-
-    if (rv == 0)
+    else
     {
-        if (is_channel_allowed(self->wm, chan_id))
+        in_uint16_le(s, chan_id);
+        in_uint16_le(s, chan_flags);
+        in_uint16_le(s, size);
+        in_uint32_le(s, total_size);
+        if (!s_check_rem_and_log(s, size, "Reading channel data data"))
+        {
+            rv = 1;
+        }
+        else
         {
-            rv = libxrdp_send_to_channel(self->wm->session, chan_id, s->p, size, total_size,
-                                         chan_flags);
+            rv = libxrdp_send_to_channel(self->wm->session, chan_id,
+                                         s->p, size, total_size, chan_flags);
         }
     }
 
-- 
2.39.0