Add maximum buffer size.

src/protocols/rdp/guac_rdpdr/rdpdr_fs_messages.c

@@ -148,12 +148,16 @@ void guac_rdpdr_fs_process_read(guac_rdpdr_device* device,
     Stream_Read_UINT32(input_stream, length);
     Stream_Read_UINT64(input_stream, offset);
 
-    /* Allocate buffer */
-    buffer = malloc(length);
-
     GUAC_RDP_DEBUG(2, "[file_id=%i] length=%i, offset=%" PRIu64,
              file_id, length, (uint64_t) offset);
 
+    /* Ensure buffer size does not exceed a safe maximum */
+    if (length > GUAC_RDP_MAX_READ_BUFFER)
+        length = GUAC_RDP_MAX_READ_BUFFER;
+
+    /* Allocate buffer */
+    buffer = malloc(length);
+
     /* Attempt read */
     bytes_read = guac_rdp_fs_read((guac_rdp_fs*) device->data, file_id, offset,
             buffer, length);

src/protocols/rdp/guac_rdpdr/rdpdr_service.h

@@ -49,6 +49,11 @@
 #include <guacamole/client.h>
 #include <freerdp/utils/svc_plugin.h>
 
+/**
+ * The maximum number of bytes to allow for a device read.
+ */
+#define GUAC_RDP_MAX_READ_BUFFER 4194304
+
 typedef struct guac_rdpdrPlugin guac_rdpdrPlugin;
 typedef struct guac_rdpdr_device guac_rdpdr_device;