Coverage Report

Created: 2026-01-17 07:16

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/FreeRDP/libfreerdp/core/surface.c
Line
Count
Source
1
/**
2
 * FreeRDP: A Remote Desktop Protocol Implementation
3
 * Surface Commands
4
 *
5
 * Copyright 2011 Vic Lee
6
 *
7
 * Licensed under the Apache License, Version 2.0 (the "License");
8
 * you may not use this file except in compliance with the License.
9
 * You may obtain a copy of the License at
10
 *
11
 *     http://www.apache.org/licenses/LICENSE-2.0
12
 *
13
 * Unless required by applicable law or agreed to in writing, software
14
 * distributed under the License is distributed on an "AS IS" BASIS,
15
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16
 * See the License for the specific language governing permissions and
17
 * limitations under the License.
18
 */
19
20
#include <freerdp/config.h>
21
22
#include "settings.h"
23
24
#include <winpr/assert.h>
25
#include <winpr/cast.h>
26
27
#include <freerdp/utils/pcap.h>
28
#include <freerdp/log.h>
29
30
#include "../cache/cache.h"
31
#include "surface.h"
32
33
#define TAG FREERDP_TAG("core.surface")
34
35
static BOOL update_recv_surfcmd_bitmap_header_ex(wStream* s, TS_COMPRESSED_BITMAP_HEADER_EX* header)
36
178
{
37
178
  if (!s || !header)
38
0
    return FALSE;
39
40
178
  if (!Stream_CheckAndLogRequiredLength(TAG, s, 24))
41
9
    return FALSE;
42
43
169
  Stream_Read_UINT32(s, header->highUniqueId);
44
169
  Stream_Read_UINT32(s, header->lowUniqueId);
45
169
  Stream_Read_UINT64(s, header->tmMilliseconds);
46
169
  Stream_Read_UINT64(s, header->tmSeconds);
47
169
  return TRUE;
48
178
}
49
50
static BOOL update_recv_surfcmd_bitmap_ex(wStream* s, TS_BITMAP_DATA_EX* bmp)
51
881
{
52
881
  if (!s || !bmp)
53
0
    return FALSE;
54
55
881
  if (!Stream_CheckAndLogRequiredLength(TAG, s, 12))
56
13
    return FALSE;
57
58
868
  Stream_Read_UINT8(s, bmp->bpp);
59
868
  Stream_Read_UINT8(s, bmp->flags);
60
868
  Stream_Seek(s, 1); /* reserved */
61
868
  Stream_Read_UINT8(s, bmp->codecID);
62
868
  Stream_Read_UINT16(s, bmp->width);
63
868
  Stream_Read_UINT16(s, bmp->height);
64
868
  Stream_Read_UINT32(s, bmp->bitmapDataLength);
65
66
868
  if ((bmp->width == 0) || (bmp->height == 0))
67
35
  {
68
35
    WLog_ERR(TAG, "invalid size value width=%" PRIu16 ", height=%" PRIu16, bmp->width,
69
35
             bmp->height);
70
35
    return FALSE;
71
35
  }
72
73
833
  if ((bmp->bpp < 1) || (bmp->bpp > 32))
74
31
  {
75
31
    WLog_ERR(TAG, "invalid bpp value %" PRIu32 "", bmp->bpp);
76
31
    return FALSE;
77
31
  }
78
79
802
  if (bmp->flags & EX_COMPRESSED_BITMAP_HEADER_PRESENT)
80
178
  {
81
178
    if (!update_recv_surfcmd_bitmap_header_ex(s, &bmp->exBitmapDataHeader))
82
9
      return FALSE;
83
178
  }
84
85
793
  bmp->bitmapData = Stream_Pointer(s);
86
793
  if (!Stream_SafeSeek(s, bmp->bitmapDataLength))
87
105
  {
88
105
    WLog_ERR(TAG, "expected bitmapDataLength %" PRIu32 ", not enough data",
89
105
             bmp->bitmapDataLength);
90
105
    return FALSE;
91
105
  }
92
688
  return TRUE;
93
793
}
94
95
static BOOL update_recv_surfcmd_is_rect_valid(const rdpContext* context,
96
                                              const SURFACE_BITS_COMMAND* cmd)
97
1.09k
{
98
1.09k
  WINPR_ASSERT(context);
99
1.09k
  WINPR_ASSERT(context->settings);
100
1.09k
  WINPR_ASSERT(cmd);
101
102
  /* We need a rectangle with left/top being smaller than right/bottom.
103
   * Also do not allow empty rectangles. */
104
1.09k
  if ((cmd->destTop >= cmd->destBottom) || (cmd->destLeft >= cmd->destRight))
105
143
  {
106
143
    WLog_WARN(TAG,
107
143
              "Empty surface bits command rectangle: %" PRIu16 "x%" PRIu16 "-%" PRIu16
108
143
              "x%" PRIu16,
109
143
              cmd->destLeft, cmd->destTop, cmd->destRight, cmd->destBottom);
110
143
    return FALSE;
111
143
  }
112
113
  /* The rectangle needs to fit into our session size */
114
953
  if ((cmd->destRight > context->settings->DesktopWidth) ||
115
889
      (cmd->destBottom > context->settings->DesktopHeight))
116
72
  {
117
72
    WLog_WARN(TAG,
118
72
              "Invalid surface bits command rectangle: %" PRIu16 "x%" PRIu16 "-%" PRIu16
119
72
              "x%" PRIu16 " does not fit %" PRIu32 "x%" PRIu32,
120
72
              cmd->destLeft, cmd->destTop, cmd->destRight, cmd->destBottom,
121
72
              context->settings->DesktopWidth, context->settings->DesktopHeight);
122
72
    return FALSE;
123
72
  }
124
125
881
  return TRUE;
126
953
}
127
128
static BOOL update_recv_surfcmd_surface_bits(rdpUpdate* update, wStream* s, UINT16 cmdType)
129
1.12k
{
130
1.12k
  BOOL rc = FALSE;
131
1.12k
  SURFACE_BITS_COMMAND cmd = { 0 };
132
133
1.12k
  if (!Stream_CheckAndLogRequiredLength(TAG, s, 8))
134
27
    goto fail;
135
136
1.09k
  cmd.cmdType = cmdType;
137
1.09k
  Stream_Read_UINT16(s, cmd.destLeft);
138
1.09k
  Stream_Read_UINT16(s, cmd.destTop);
139
1.09k
  Stream_Read_UINT16(s, cmd.destRight);
140
1.09k
  Stream_Read_UINT16(s, cmd.destBottom);
141
142
1.09k
  if (!update_recv_surfcmd_is_rect_valid(update->context, &cmd))
143
215
    goto fail;
144
145
881
  if (!update_recv_surfcmd_bitmap_ex(s, &cmd.bmp))
146
193
    goto fail;
147
148
688
  if (!IFCALLRESULT(TRUE, update->SurfaceBits, update->context, &cmd))
149
89
  {
150
89
    WLog_DBG(TAG, "update->SurfaceBits implementation failed");
151
89
    goto fail;
152
89
  }
153
154
599
  rc = TRUE;
155
1.12k
fail:
156
1.12k
  return rc;
157
599
}
158
159
static BOOL update_recv_surfcmd_frame_marker(rdpUpdate* update, wStream* s)
160
90
{
161
90
  SURFACE_FRAME_MARKER marker = { 0 };
162
90
  rdp_update_internal* up = update_cast(update);
163
164
90
  WINPR_ASSERT(s);
165
166
90
  if (!Stream_CheckAndLogRequiredLength(TAG, s, 2))
167
11
    return FALSE;
168
169
79
  Stream_Read_UINT16(s, marker.frameAction);
170
79
  if (!Stream_CheckAndLogRequiredLength(TAG, s, 4))
171
27
    WLog_WARN(TAG,
172
79
              "[SERVER-BUG]: got %" PRIuz ", expected %u"
173
79
              " bytes. [MS-RDPBCGR] 2.2.9.2.3 Frame Marker Command (TS_FRAME_MARKER) is "
174
79
              "missing frameId, ignoring",
175
79
              Stream_GetRemainingLength(s), 4u);
176
52
  else
177
52
    Stream_Read_UINT32(s, marker.frameId);
178
79
  WLog_Print(up->log, WLOG_DEBUG, "SurfaceFrameMarker: action: %s (%" PRIu32 ") id: %" PRIu32 "",
179
79
             (!marker.frameAction) ? "Begin" : "End", marker.frameAction, marker.frameId);
180
181
79
  if (!update->SurfaceFrameMarker)
182
30
  {
183
30
    WINPR_ASSERT(update->context);
184
30
    if (freerdp_settings_get_bool(update->context->settings, FreeRDP_DeactivateClientDecoding))
185
0
      return TRUE;
186
30
    WLog_ERR(TAG, "Missing callback update->SurfaceFrameMarker");
187
30
    return FALSE;
188
30
  }
189
190
49
  if (!update->SurfaceFrameMarker(update->context, &marker))
191
49
  {
192
49
    WLog_DBG(TAG, "update->SurfaceFrameMarker implementation failed");
193
49
    return FALSE;
194
49
  }
195
196
0
  return TRUE;
197
49
}
198
199
int update_recv_surfcmds(rdpUpdate* update, wStream* s)
200
21.5k
{
201
21.5k
  UINT16 cmdType = 0;
202
21.5k
  rdp_update_internal* up = update_cast(update);
203
204
21.5k
  WINPR_ASSERT(s);
205
206
22.1k
  while (Stream_GetRemainingLength(s) >= 2)
207
9.84k
  {
208
9.84k
    const size_t start = Stream_GetPosition(s);
209
9.84k
    const BYTE* mark = Stream_ConstPointer(s);
210
211
9.84k
    Stream_Read_UINT16(s, cmdType);
212
213
9.84k
    switch (cmdType)
214
9.84k
    {
215
464
      case CMDTYPE_SET_SURFACE_BITS:
216
1.12k
      case CMDTYPE_STREAM_SURFACE_BITS:
217
1.12k
        if (!update_recv_surfcmd_surface_bits(update, s, cmdType))
218
524
          return -1;
219
220
599
        break;
221
222
599
      case CMDTYPE_FRAME_MARKER:
223
90
        if (!update_recv_surfcmd_frame_marker(update, s))
224
90
          return -1;
225
226
0
        break;
227
228
8.62k
      default:
229
8.62k
        WLog_ERR(TAG, "unknown cmdType 0x%04" PRIX16 "", cmdType);
230
8.62k
        return -1;
231
9.84k
    }
232
233
599
    if (up->dump_rfx)
234
0
    {
235
0
      const size_t size = Stream_GetPosition(s) - start;
236
      /* TODO: treat return values */
237
0
      pcap_add_record(up->pcap_rfx, mark, size);
238
0
      pcap_flush(up->pcap_rfx);
239
0
    }
240
599
  }
241
242
12.3k
  return 0;
243
21.5k
}
244
245
static BOOL update_write_surfcmd_bitmap_header_ex(wStream* s,
246
                                                  const TS_COMPRESSED_BITMAP_HEADER_EX* header)
247
59
{
248
59
  if (!s || !header)
249
0
    return FALSE;
250
251
59
  if (!Stream_EnsureRemainingCapacity(s, 24))
252
0
    return FALSE;
253
254
59
  Stream_Write_UINT32(s, header->highUniqueId);
255
59
  Stream_Write_UINT32(s, header->lowUniqueId);
256
59
  Stream_Write_UINT64(s, header->tmMilliseconds);
257
59
  Stream_Write_UINT64(s, header->tmSeconds);
258
59
  return TRUE;
259
59
}
260
261
static BOOL update_write_surfcmd_bitmap_ex(wStream* s, const TS_BITMAP_DATA_EX* bmp)
262
89
{
263
89
  if (!s || !bmp)
264
0
    return FALSE;
265
266
89
  if (!Stream_EnsureRemainingCapacity(s, 12))
267
0
    return FALSE;
268
269
89
  if (bmp->codecID > UINT8_MAX)
270
0
  {
271
0
    WLog_ERR(TAG, "Invalid TS_BITMAP_DATA_EX::codecID=0x%04" PRIx16 "", bmp->codecID);
272
0
    return FALSE;
273
0
  }
274
89
  Stream_Write_UINT8(s, bmp->bpp);
275
89
  Stream_Write_UINT8(s, bmp->flags);
276
89
  Stream_Write_UINT8(s, 0); /* reserved1, reserved2 */
277
89
  Stream_Write_UINT8(s, (UINT8)bmp->codecID);
278
89
  Stream_Write_UINT16(s, bmp->width);
279
89
  Stream_Write_UINT16(s, bmp->height);
280
89
  Stream_Write_UINT32(s, bmp->bitmapDataLength);
281
282
89
  if (bmp->flags & EX_COMPRESSED_BITMAP_HEADER_PRESENT)
283
59
  {
284
59
    if (!update_write_surfcmd_bitmap_header_ex(s, &bmp->exBitmapDataHeader))
285
0
      return FALSE;
286
59
  }
287
288
89
  if (!Stream_EnsureRemainingCapacity(s, bmp->bitmapDataLength))
289
0
    return FALSE;
290
291
89
  Stream_Write(s, bmp->bitmapData, bmp->bitmapDataLength);
292
89
  return TRUE;
293
89
}
294
295
BOOL update_write_surfcmd_surface_bits(wStream* s, const SURFACE_BITS_COMMAND* cmd)
296
89
{
297
89
  if (!Stream_EnsureRemainingCapacity(s, SURFCMD_SURFACE_BITS_HEADER_LENGTH))
298
0
    return FALSE;
299
300
89
  WINPR_ASSERT(cmd->cmdType <= UINT16_MAX);
301
89
  UINT16 cmdType = (UINT16)cmd->cmdType;
302
89
  switch (cmdType)
303
89
  {
304
84
    case CMDTYPE_SET_SURFACE_BITS:
305
89
    case CMDTYPE_STREAM_SURFACE_BITS:
306
89
      break;
307
0
    default:
308
0
    {
309
0
      const UINT16 defaultCmdType = CMDTYPE_STREAM_SURFACE_BITS;
310
0
      WLog_WARN(TAG,
311
0
                "SURFACE_BITS_COMMAND->cmdType 0x%04" PRIx16
312
0
                " not allowed, correcting to 0x%04" PRIx16,
313
0
                cmdType, defaultCmdType);
314
0
      cmdType = defaultCmdType;
315
0
    }
316
0
    break;
317
89
  }
318
319
89
  Stream_Write_UINT16(s, WINPR_ASSERTING_INT_CAST(uint16_t, cmdType));
320
89
  Stream_Write_UINT16(s, WINPR_ASSERTING_INT_CAST(uint16_t, cmd->destLeft));
321
89
  Stream_Write_UINT16(s, WINPR_ASSERTING_INT_CAST(uint16_t, cmd->destTop));
322
89
  Stream_Write_UINT16(s, WINPR_ASSERTING_INT_CAST(uint16_t, cmd->destRight));
323
89
  Stream_Write_UINT16(s, WINPR_ASSERTING_INT_CAST(uint16_t, cmd->destBottom));
324
89
  return update_write_surfcmd_bitmap_ex(s, &cmd->bmp);
325
89
}
326
327
BOOL update_write_surfcmd_frame_marker(wStream* s, UINT16 frameAction, UINT32 frameId)
328
49
{
329
49
  if (!Stream_EnsureRemainingCapacity(s, SURFCMD_FRAME_MARKER_LENGTH))
330
0
    return FALSE;
331
332
49
  Stream_Write_UINT16(s, CMDTYPE_FRAME_MARKER);
333
49
  Stream_Write_UINT16(s, frameAction);
334
49
  Stream_Write_UINT32(s, frameId);
335
49
  return TRUE;
336
49
}