Description: fix integer overflow in license_read_scope_list
Origin: backport, https://github.com/FreeRDP/FreeRDP/commit/f1d6afca6ae620f9855a33280bdc6f3ad9153be0
Bug-Redhat: https://bugzilla.redhat.com/show_bug.cgi?id=998941

Index: freerdp-1.0.2/libfreerdp-core/license.c
===================================================================
--- freerdp-1.0.2.orig/libfreerdp-core/license.c	2017-08-03 07:26:54.491527376 -0400
+++ freerdp-1.0.2/libfreerdp-core/license.c	2017-08-03 08:18:45.083413429 -0400
@@ -199,7 +199,8 @@ boolean license_recv(rdpLicense* license
 	switch (bMsgType)
 	{
 		case LICENSE_REQUEST:
-			license_read_license_request_packet(license, s);
+			if (!license_read_license_request_packet(license, s))
+				return false;
 			license_send_new_license_request_packet(license);
 			break;
 
@@ -533,12 +534,17 @@ void license_free_binary_blob(LICENSE_BL
  * @param scopeList scope list
  */
 
-void license_read_scope_list(STREAM* s, SCOPE_LIST* scopeList)
+boolean license_read_scope_list(STREAM* s, SCOPE_LIST* scopeList)
 {
 	uint32 i;
 	uint32 scopeCount;
 
+	if (stream_get_left(s) < 4)
+		return false;
+
 	stream_read_uint32(s, scopeCount); /* ScopeCount (4 bytes) */
+	if (scopeCount > stream_get_left(s) / 4)  /* every blob is at least 4 bytes */
+		return false;
 
 	scopeList->count = scopeCount;
 	scopeList->array = (LICENSE_BLOB*) xmalloc(sizeof(LICENSE_BLOB) * scopeCount);
@@ -549,6 +555,7 @@ void license_read_scope_list(STREAM* s,
 		scopeList->array[i].type = BB_SCOPE_BLOB;
 		license_read_binary_blob(s, &scopeList->array[i]);
 	}
+	return true;
 }
 
 /**
@@ -593,7 +600,7 @@ void license_free_scope_list(SCOPE_LIST*
  * @param s stream
  */
 
-void license_read_license_request_packet(rdpLicense* license, STREAM* s)
+boolean license_read_license_request_packet(rdpLicense* license, STREAM* s)
 {
 	/* ServerRandom (32 bytes) */
 	stream_read(s, license->server_random, 32);
@@ -608,7 +615,8 @@ void license_read_license_request_packet
 	license_read_binary_blob(s, license->server_certificate);
 
 	/* ScopeList */
-	license_read_scope_list(s, license->scope_list);
+	if (!license_read_scope_list(s, license->scope_list))
+		return false;
 
 	/* Parse Server Certificate */
 	certificate_read_server_certificate(license->certificate,
@@ -617,6 +625,8 @@ void license_read_license_request_packet
 	license_generate_keys(license);
 	license_generate_hwid(license);
 	license_encrypt_premaster_secret(license);
+
+	return true;
 }
 
 /**
Index: freerdp-1.0.2/libfreerdp-core/license.h
===================================================================
--- freerdp-1.0.2.orig/libfreerdp-core/license.h	2013-01-02 16:46:59.000000000 -0500
+++ freerdp-1.0.2/libfreerdp-core/license.h	2017-08-03 08:18:05.259414888 -0400
@@ -177,9 +177,9 @@ void license_write_binary_blob(STREAM* s
 
 SCOPE_LIST* license_new_scope_list();
 void license_free_scope_list(SCOPE_LIST* scopeList);
-void license_read_scope_list(STREAM* s, SCOPE_LIST* scopeList);
+boolean license_read_scope_list(STREAM* s, SCOPE_LIST* scopeList);
 
-void license_read_license_request_packet(rdpLicense* license, STREAM* s);
+boolean license_read_license_request_packet(rdpLicense* license, STREAM* s);
 void license_read_platform_challenge_packet(rdpLicense* license, STREAM* s);
 void license_read_new_license_packet(rdpLicense* license, STREAM* s);
 void license_read_upgrade_license_packet(rdpLicense* license, STREAM* s);
