[WIP] RDP code enhancements.

src/protocols/rdp/channels/rdpsnd/rdpsnd.c

@@ -35,9 +35,14 @@ void guac_rdpsnd_process_receive(guac_rdp_common_svc* svc,
     guac_rdpsnd* rdpsnd = (guac_rdpsnd*) svc->data;
     guac_rdpsnd_pdu_header header;
 
+    /* Check size prior to trying to read data. */
+    if (Stream_GetRemainingLength(input_stream) < (sizeof(header) + header.body_size))
+        return;
+    
     /* Read RDPSND PDU header */
     Stream_Read_UINT8(input_stream, header.message_type);
     Stream_Seek_UINT8(input_stream);
+    
     Stream_Read_UINT16(input_stream, header.body_size);
 
     /* 

src/protocols/rdp/plugins/guac-common-svc/guac-common-svc.c

@@ -116,6 +116,10 @@ static VOID guac_rdp_common_svc_handle_open_event(LPVOID user_param,
         svc->_input_stream = Stream_New(NULL, total_length);
     }
 
+    /* leave if we don't have a stream. */
+    if (svc->_input_stream == NULL)
+        return;
+    
     /* Add chunk to buffer only if sufficient space remains */
     if (Stream_EnsureRemainingCapacity(svc->_input_stream, data_length))
         Stream_Write(svc->_input_stream, data, data_length);
@@ -137,6 +141,7 @@ static VOID guac_rdp_common_svc_handle_open_event(LPVOID user_param,
             svc->_receive_handler(svc, svc->_input_stream);
 
         Stream_Free(svc->_input_stream, TRUE);
+        svc->_input_stream = NULL;
 
     }
 

src/protocols/rdp/plugins/guacai/guacai-messages.c

@@ -39,6 +39,10 @@
 static void guac_rdp_ai_read_format(wStream* stream,
         guac_rdp_ai_format* format) {
 
+    /* Bail out if the stream doesn't contain enough data. */
+    if (Stream_GetRemainingLength(stream) < (18 + format->data_size))
+        return;
+    
     /* Read audio format into structure */
     Stream_Read_UINT16(stream, format->tag); /* wFormatTag */
     Stream_Read_UINT16(stream, format->channels); /* nChannels */
@@ -262,6 +266,10 @@ void guac_rdp_ai_process_formats(guac_client* client,
     Stream_Read_UINT32(stream, num_formats); /* NumFormats */
     Stream_Seek_UINT32(stream); /* cbSizeFormatsPacket (MUST BE IGNORED) */
 
+    /* Check amount of data. */
+    if (Stream_GetRemainingLength(stream) < (8 + nnum_formats))
+        return;
+    
     UINT32 index;
     for (index = 0; index < num_formats; index++) {
 

src/protocols/rdp/plugins/guacai/guacai.c

@@ -56,6 +56,10 @@ static void guac_rdp_ai_handle_data(guac_client* client,
     BYTE message_id;
     Stream_Read_UINT8(stream, message_id);
 
+    /* If not enough data, bail out. */
+    if (Stream_GetRemainingLength(stream) < 1)
+        return;
+    
     /* Invoke appropriate message processor based on ID */
     switch (message_id) {