Description: fix rdp client license read challenge packet DoS
Origin: backport, https://github.com/FreeRDP/FreeRDP/commit/03ab68318966c3a22935a02838daaea7b7fbe96c
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869880

Index: freerdp-1.0.2/libfreerdp-core/license.c
===================================================================
--- freerdp-1.0.2.orig/libfreerdp-core/license.c	2017-08-03 09:02:33.435317148 -0400
+++ freerdp-1.0.2/libfreerdp-core/license.c	2017-08-03 09:11:56.443296524 -0400
@@ -205,7 +205,8 @@ boolean license_recv(rdpLicense* license
 			break;
 
 		case PLATFORM_CHALLENGE:
-			license_read_platform_challenge_packet(license, s);
+			if (!license_read_platform_challenge_packet(license, s))
+				return false;
 			license_send_platform_challenge_response_packet(license);
 			break;
 
@@ -470,19 +471,25 @@ void license_free_product_info(PRODUCT_I
  * @param blob license binary blob
  */
 
-void license_read_binary_blob(STREAM* s, LICENSE_BLOB* blob)
+boolean license_read_binary_blob(STREAM* s, LICENSE_BLOB* blob)
 {
 	uint16 wBlobType;
 
+	if (stream_get_left(s) < 4)
+		return false;
+
 	stream_read_uint16(s, wBlobType); /* wBlobType (2 bytes) */
 	stream_read_uint16(s, blob->length); /* wBlobLen (2 bytes) */
 
+	if (stream_get_left(s) < blob->length)
+		return false;
+
 	/*
  	 * Server can choose to not send data by setting len to 0.
  	 * If so, it may not bother to set the type, so shortcut the warning
  	 */
 	if (blob->type != BB_ANY_BLOB && blob->length == 0)
-		return;
+		return true;
 
 	if (blob->type != wBlobType && blob->type != BB_ANY_BLOB)
 	{
@@ -493,6 +500,7 @@ void license_read_binary_blob(STREAM* s,
 	blob->data = (uint8*) xmalloc(blob->length);
 
 	stream_read(s, blob->data, blob->length); /* blobData */
+	return true;
 }
 
 /**
@@ -583,7 +591,8 @@ boolean license_read_scope_list(STREAM*
 	for (i = 0; i < scopeCount; i++)
 	{
 		scopeList->array[i].type = BB_SCOPE_BLOB;
-		license_read_binary_blob(s, &scopeList->array[i]);
+		if (!license_read_binary_blob(s, &scopeList->array[i]))
+			return false;
 	}
 	return true;
 }
@@ -640,10 +649,12 @@ boolean license_read_license_request_pac
 		return false;
 
 	/* KeyExchangeList */
-	license_read_binary_blob(s, license->key_exchange_list);
+	if (!license_read_binary_blob(s, license->key_exchange_list))
+		return false;
 
 	/* ServerCertificate */
-	license_read_binary_blob(s, license->server_certificate);
+	if (!license_read_binary_blob(s, license->server_certificate))
+		return false;
 
 	/* ScopeList */
 	if (!license_read_scope_list(s, license->scope_list))
@@ -667,21 +678,28 @@ boolean license_read_license_request_pac
  * @param s stream
  */
 
-void license_read_platform_challenge_packet(rdpLicense* license, STREAM* s)
+boolean license_read_platform_challenge_packet(rdpLicense* license, STREAM* s)
 {
 	DEBUG_LICENSE("Receiving Platform Challenge Packet");
 
+	if (stream_get_left(s) < 4)
+		return false;
+
 	stream_seek(s, 4); /* ConnectFlags, Reserved (4 bytes) */
 
 	/* EncryptedPlatformChallenge */
 	license->encrypted_platform_challenge->type = BB_ANY_BLOB;
-	license_read_binary_blob(s, license->encrypted_platform_challenge);
+
+	if (!license_read_binary_blob(s, license->encrypted_platform_challenge))
+		return false;
+
 	license->encrypted_platform_challenge->type = BB_ENCRYPTED_DATA_BLOB;
 
 	/* MACData (16 bytes) */
 	stream_seek(s, 16);
 
 	license_decrypt_platform_challenge(license);
+	return true;
 }
 
 /**
Index: freerdp-1.0.2/libfreerdp-core/license.h
===================================================================
--- freerdp-1.0.2.orig/libfreerdp-core/license.h	2017-08-03 08:57:45.915327680 -0400
+++ freerdp-1.0.2/libfreerdp-core/license.h	2017-08-03 09:07:10.639306993 -0400
@@ -172,7 +172,7 @@ boolean license_read_product_info(STREAM
 
 LICENSE_BLOB* license_new_binary_blob(uint16 type);
 void license_free_binary_blob(LICENSE_BLOB* blob);
-void license_read_binary_blob(STREAM* s, LICENSE_BLOB* blob);
+boolean license_read_binary_blob(STREAM* s, LICENSE_BLOB* blob);
 void license_write_binary_blob(STREAM* s, LICENSE_BLOB* blob);
 
 SCOPE_LIST* license_new_scope_list();
@@ -180,7 +180,7 @@ void license_free_scope_list(SCOPE_LIST*
 boolean license_read_scope_list(STREAM* s, SCOPE_LIST* scopeList);
 
 boolean license_read_license_request_packet(rdpLicense* license, STREAM* s);
-void license_read_platform_challenge_packet(rdpLicense* license, STREAM* s);
+boolean license_read_platform_challenge_packet(rdpLicense* license, STREAM* s);
 void license_read_new_license_packet(rdpLicense* license, STREAM* s);
 void license_read_upgrade_license_packet(rdpLicense* license, STREAM* s);
 void license_read_error_alert_packet(rdpLicense* license, STREAM* s);
