hero123457/xrdp
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
4,116 Commits 8 Branches 40 Tags 19 MiB
71594b5114
Commit Graph

4116 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Koichiro IWAO
71594b5114
Bump version for v0.9.22 2023-05-07 15:03:13 +09:00
Koichiro IWAO
1b3be3e641 Update NEWS for v0.9.22 2023-05-07 15:03:05 +09:00
matt335672
2e5dd686dc
Merge pull request #2548 from matt335672/v0_9_list_improvements 
V0 9 list improvements
 2023-02-13 14:34:18 +00:00
matt335672
7198f58d6f Add simple list test cases 2023-02-11 14:52:23 +00:00
matt335672
152c31ca89 Add memory allocation checking to the list module 
The list module lacks memory allocation checking, and
consequently can coredump on list_create() or
list_add_item().
 2023-02-10 14:34:22 +00:00
matt335672
1faca4c1f7
Merge pull request #2521 from matt335672/v0_9_cppcheck_2_10 
Bump cppcheck version to 2.10
 2023-01-29 16:17:40 +00:00
matt335672
2d66b2f8d4 Bump cppcheck version to 2.10 2023-01-29 16:00:21 +00:00
matt335672
f31fee3052
Merge pull request #2508 from matt335672/v0_9_otaconix_patch_1 
[V0.9] Tiny fix in pseudocode description of startwm.sh
 2023-01-18 15:29:34 +00:00
matt335672
1e1eeec140
Merge pull request #2507 from matt335672/v0_9_check_pcsc_sock_create_err 
[V0.9] Don't try to listen on the scard socket if it isn't there
 2023-01-18 15:29:01 +00:00
matt335672
cae8215f3f
Merge pull request #2509 from matt335672/v0_9_no_pwd_no_autologin 
[V0.9] Disable autologon for empty passwords
 2023-01-18 15:28:34 +00:00
matt335672
ba4c9b9893 Disable autologon for empty passwords 
Although there is nothing in the specification to prevent automatic
logons with empty passwords, this is not a secure default.

The autologon flag INFO_AUTOLOGON ([MS-RDPBCGR] 2.2.1.11.1.1) is now
ignored for empty passwords.
 2023-01-18 15:08:38 +00:00
otaconix
a80e66e2d2 Tiny fix in pseudocode description of startwm.sh 
I realize there's not much value in this PR, but I noticed this, so I thought I'd fix it 🙂
 2023-01-18 15:07:10 +00:00
matt335672
6aac2e942d Don't try to listen on the scard socket if it isn't there 
If the scard local socket can't be created, there's no point
in trying to listen on it. This will just fill the chansrv log
file with errors.
 2023-01-18 14:40:02 +00:00
metalefty
d459047924
Merge pull request #2470 from metalefty/v0.9-release 
Release v0.9.21.1
 2022-12-13 17:59:38 +09:00
Koichiro IWAO
9eedaf9fa2 Bump version to v0.9.21.1 2022-12-13 17:47:10 +09:00
Koichiro IWAO
28a39a5d9f Update NEWS for v0.9.21.1 2022-12-13 17:46:54 +09:00
Koichiro IWAO
6308e23e1f gitignore: add some build artifacts 2022-12-13 10:00:00 +09:00
metalefty
75556d2a69
Merge pull request #2468 from matt335672/v0_9_fix_slackbuild_missing_file 
Add xrdp-sesman.system to distributed files
 2022-12-13 09:05:18 +09:00
matt335672
19da7a92eb Add xrdp-sesman.system to distributed files 
Distributed file list also now sorted for ease of checking
 2022-12-12 19:43:08 +00:00
metalefty
83a4d55b14
Merge pull request #2464 from metalefty/v0.9-release 
Release v0.9.21
 2022-12-10 21:14:26 +09:00
Koichiro IWAO
a4e83996db Bump version to v0.9.21 2022-12-10 21:08:48 +09:00
Koichiro IWAO
07605c7d65 Update NEWS for v0.9.21 2022-12-10 21:08:48 +09:00
matt335672
faa7021a0b
Merge pull request #2462 from matt335672/fix_devredir 
Remove double '!' from test
 2022-12-09 18:19:39 +00:00
matt335672
814d56317c Remove double '!' from test 
Commit 7ad7b05261 introduced a regression
which prevented remote drives being accessible. I picked it up in testing,
but then failed to commit the change.
 2022-12-09 18:12:25 +00:00
matt335672
fbf374c8b0
Merge pull request #2461 from metalefty/ci-fix 
Fix CI failure after 8484767
 2022-12-09 17:21:49 +00:00
metalefty
36c54d9776
Merge pull request #2460 from matt335672/v0_9_pcscd_sock_permissions 
Set permissions on pcsc socket dir to owner only
 2022-12-10 00:12:02 +09:00
Koichiro IWAO
2f1196bdc4 Fix CI failure after 8484767 
libscp_v0.c:228:52: error: comparison of integer expressions of different signedness: ‘int’ and ‘unsigned int’ [-Werror=sign-compare]
  228 |         if ((trans->in_s->end - trans->in_s->data) < trans->header_size)
      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~
 2022-12-09 23:21:26 +09:00
metalefty
b442abe467
Merge pull request from GHSA-2f49-wwpm-78pj 
CVE-2022-23478
 2022-12-09 22:12:51 +09:00
metalefty
de1352183a
Merge pull request from GHSA-56pq-2pm9-7fhm 
CVE-2022-23482
 2022-12-09 22:12:28 +09:00
metalefty
6a64039773
Merge pull request from GHSA-59wp-3wq6-jh5v 
CVE-2022-23493
 2022-12-09 22:12:14 +09:00
metalefty
7c7cc2523a
Merge pull request from GHSA-hm75-9jcg-p7hq 
CVE-2022-23481
 2022-12-09 22:11:57 +09:00
metalefty
a1484cd0a1
Merge pull request from GHSA-38rw-9ch2-fcxq 
CVE-2022-23483
 2022-12-09 22:11:40 +09:00
metalefty
a8bb8959c3
Merge pull request from GHSA-rqfx-5fv8-q9c6 
CVE-2022-23484
 2022-12-09 22:11:25 +09:00
metalefty
8484767250
Merge pull request from GHSA-pgx2-3fjj-fqqh 
CVE-2022-23479
 2022-12-09 22:10:58 +09:00
metalefty
0418502eb3
Merge pull request from GHSA-3jmx-f6hv-95wg 
CVE-2022-23480
 2022-12-09 22:10:33 +09:00
metalefty
09e1a0561e
Merge pull request from GHSA-hqw2-jx2c-wrr2 
Prevent buffer overflow for oversized audio format from client
 2022-12-09 22:10:10 +09:00
metalefty
7c71a4f560
Merge pull request from GHSA-8c2f-mw8m-qpx6 
Login window - replace g_sprintf() withl g_snprintf() calls
 2022-12-09 22:09:34 +09:00
matt335672
413678ef3d Set permissions on pcsc socket dir to owner only 
There is no reason for any user other than the current one to be able
to communicate with the remote smartcard.
 2022-12-09 11:57:46 +00:00
matt335672
e0578b5621
Merge pull request #2457 from metalefty/v0.9-cherry-pick 
[v0.9] cherry-pick for v0.9.21
 2022-12-09 10:42:03 +00:00
matt335672
030db5524b CVE-2022-23493 
Check chansrv channel ID on a channel close

Prevent OOB read if an invalid channel ID is sent.
 2022-12-09 10:30:49 +00:00
Koichiro IWAO
4256d84676 vnc: add mouse button 6, 7, 8 support 
(cherry picked from commit 2b0c903afe)
 2022-12-09 17:01:15 +09:00
Koichiro IWAO
6e0c496564 vnc: Constify existing use of magic numbers 
(cherry picked from commit 70bc5ea092)
 2022-12-09 17:00:59 +09:00
Mosakuji Hokuto
70e14f760e Update pamdir_suse to accommodate with TW pam.d move (#2413) 
On newer builds of openSUSE tumbleweed the path of pam.d has moved from
/usr/etc/pam.d to /usr/lib/pam.d, which prevents install script to
correctly guess pam rules. Updating path in mkpamrules solves the
problem.

(cherry picked from commit 4ff968bc98)
 2022-12-09 17:00:29 +09:00
matt335672
ba2b9fc606 Changes to cope with trans->header_size being unsigned 2022-12-08 14:41:19 +00:00
matt335672
60864014b7 CVE-2022-23479 
Detect attempts to overflow input buffer

If application code hasn't properly sanitised the header_size
for a transport, it is possible for read requests to be issued
which overflow the input buffer. This change detects this
at a low level and bounces the read request.
 2022-12-08 14:41:19 +00:00
matt335672
191ed3e3fa Remove unused g_full_name_for_filesystem 
Not only was this unused, the way it was read could lead to a
buffer overflow (CVE-2022-23480)
 2022-12-08 14:13:48 +00:00
matt335672
c2c6efb1d3 CVE-2022-23484 
Add check for RAIL window text size
 2022-12-08 10:43:42 +00:00
matt335672
35cca701c7 CVE-2022-23483 
Sanitise channel data being passed from application

Avoids OOB read if the size field is incorrect.
 2022-12-08 10:41:30 +00:00
matt335672
bb9766c79f CVE-2022-23482 
Check minimum length of TS_UD_CS_CORE message
 2022-12-08 10:38:58 +00:00
matt335672
c77e974080 CVE-2022-23481 
Add length checks to client confirm active PDU parsing
 2022-12-08 10:37:57 +00:00