Decription: fix rdp client license read product info DoS
Origin: backport, https://github.com/FreeRDP/FreeRDP/commit/03ab68318966c3a22935a02838daaea7b7fbe96c
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869880

Index: freerdp-1.0.2/libfreerdp-core/license.c
===================================================================
--- freerdp-1.0.2.orig/libfreerdp-core/license.c	2017-08-03 08:46:22.607352711 -0400
+++ freerdp-1.0.2/libfreerdp-core/license.c	2017-08-03 09:02:33.435317148 -0400
@@ -380,19 +380,49 @@ void license_decrypt_platform_challenge(
  * @param productInfo product information
  */
 
-void license_read_product_info(STREAM* s, PRODUCT_INFO* productInfo)
+boolean license_read_product_info(STREAM* s, PRODUCT_INFO* productInfo)
 {
+	if (stream_get_left(s) < 8)
+		return false;
+
 	stream_read_uint32(s, productInfo->dwVersion); /* dwVersion (4 bytes) */
 
 	stream_read_uint32(s, productInfo->cbCompanyName); /* cbCompanyName (4 bytes) */
 
+	/* Name must be > 0, but there is no upper limit defined, use UINT32_MAX */
+	if ((productInfo->cbCompanyName < 2) || (productInfo->cbCompanyName % 2 != 0))
+		return false;
+
+	if (stream_get_left(s) < productInfo->cbCompanyName)
+		return false;
+
 	productInfo->pbCompanyName = (uint8*) xmalloc(productInfo->cbCompanyName);
+	if (!productInfo->pbCompanyName)
+		return false;
 	stream_read(s, productInfo->pbCompanyName, productInfo->cbCompanyName);
 
+	if (stream_get_left(s) < 4)
+		goto out_fail;
+
 	stream_read_uint32(s, productInfo->cbProductId); /* cbProductId (4 bytes) */
 
+	if ((productInfo->cbProductId < 2) || (productInfo->cbProductId % 2 != 0))
+		goto out_fail;
+
+	if (stream_get_left(s) < productInfo->cbProductId)
+		goto out_fail;
+
 	productInfo->pbProductId = (uint8*) xmalloc(productInfo->cbProductId);
+	if (!productInfo->pbProductId)
+		goto out_fail;
+
 	stream_read(s, productInfo->pbProductId, productInfo->cbProductId);
+	return true;
+
+	out_fail:
+		xfree(productInfo->pbCompanyName);
+		productInfo->pbCompanyName = NULL;
+		return false;
 }
 
 /**
@@ -606,7 +636,8 @@ boolean license_read_license_request_pac
 	stream_read(s, license->server_random, 32);
 
 	/* ProductInfo */
-	license_read_product_info(s, license->product_info);
+	if (!license_read_product_info(s, license->product_info))
+		return false;
 
 	/* KeyExchangeList */
 	license_read_binary_blob(s, license->key_exchange_list);
Index: freerdp-1.0.2/libfreerdp-core/license.h
===================================================================
--- freerdp-1.0.2.orig/libfreerdp-core/license.h	2017-08-03 08:46:22.607352711 -0400
+++ freerdp-1.0.2/libfreerdp-core/license.h	2017-08-03 08:57:45.915327680 -0400
@@ -168,7 +168,7 @@ void license_decrypt_platform_challenge(
 
 PRODUCT_INFO* license_new_product_info();
 void license_free_product_info(PRODUCT_INFO* productInfo);
-void license_read_product_info(STREAM* s, PRODUCT_INFO* productInfo);
+boolean license_read_product_info(STREAM* s, PRODUCT_INFO* productInfo);
 
 LICENSE_BLOB* license_new_binary_blob(uint16 type);
 void license_free_binary_blob(LICENSE_BLOB* blob);
