| https://github.com/FreeRDP/FreeRDP/commit/80adde17ddc4b596ed1dae0922a0c54ab3d4b8ea |
| CVE: CVE-2022-39318 CVE-2022-39319 |
| Upstream-Status: Backport |
| Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> |
| |
| From 80adde17ddc4b596ed1dae0922a0c54ab3d4b8ea Mon Sep 17 00:00:00 2001 |
| From: akallabeth <akallabeth@posteo.net> |
| Date: Thu, 13 Oct 2022 08:27:41 +0200 |
| Subject: [PATCH] Fixed division by zero in urbdrc |
| |
| (cherry picked from commit 731f8419d04b481d7160de1f34062d630ed48765) |
| --- |
| channels/urbdrc/client/libusb/libusb_udevice.c | 12 +++++++++--- |
| 1 file changed, 9 insertions(+), 3 deletions(-) |
| |
| diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c |
| index 505c31d7b55..ef87f195f38 100644 |
| --- a/channels/urbdrc/client/libusb/libusb_udevice.c |
| +++ b/channels/urbdrc/client/libusb/libusb_udevice.c |
| @@ -1221,12 +1221,18 @@ static int libusb_udev_isoch_transfer(IUDEVICE* idev, URBDRC_CHANNEL_CALLBACK* c |
| if (!Buffer) |
| Stream_Seek(user_data->data, (NumberOfPackets * 12)); |
| |
| - iso_packet_size = BufferSize / NumberOfPackets; |
| - iso_transfer = libusb_alloc_transfer(NumberOfPackets); |
| + if (NumberOfPackets > 0) |
| + { |
| + iso_packet_size = BufferSize / NumberOfPackets; |
| + iso_transfer = libusb_alloc_transfer((int)NumberOfPackets); |
| + } |
| |
| if (iso_transfer == NULL) |
| { |
| - WLog_Print(urbdrc->log, WLOG_ERROR, "Error: libusb_alloc_transfer."); |
| + WLog_Print(urbdrc->log, WLOG_ERROR, |
| + "Error: libusb_alloc_transfer [NumberOfPackets=%" PRIu32 ", BufferSize=%" PRIu32 |
| + " ]", |
| + NumberOfPackets, BufferSize); |
| async_transfer_user_data_free(user_data); |
| return -1; |
| } |