Coverage Report

Created: 2026-08-13 06:33

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/FreeRDP/libfreerdp/core/surface.c
Line
Count
Source
1
/**
2
 * FreeRDP: A Remote Desktop Protocol Implementation
3
 * Surface Commands
4
 *
5
 * Copyright 2011 Vic Lee
6
 *
7
 * Licensed under the Apache License, Version 2.0 (the "License");
8
 * you may not use this file except in compliance with the License.
9
 * You may obtain a copy of the License at
10
 *
11
 *     http://www.apache.org/licenses/LICENSE-2.0
12
 *
13
 * Unless required by applicable law or agreed to in writing, software
14
 * distributed under the License is distributed on an "AS IS" BASIS,
15
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16
 * See the License for the specific language governing permissions and
17
 * limitations under the License.
18
 */
19
20
#include <freerdp/config.h>
21
22
#include "settings.h"
23
24
#include <winpr/assert.h>
25
#include <winpr/cast.h>
26
27
#include <freerdp/utils/pcap.h>
28
#include <freerdp/log.h>
29
30
#include "../cache/cache.h"
31
#include "surface.h"
32
33
#define TAG FREERDP_TAG("core.surface")
34
35
static BOOL update_recv_surfcmd_bitmap_header_ex(wStream* s, TS_COMPRESSED_BITMAP_HEADER_EX* header)
36
2.44k
{
37
2.44k
  if (!s || !header)
38
0
    return FALSE;
39
40
2.44k
  if (!Stream_CheckAndLogRequiredLength(TAG, s, 24))
41
112
    return FALSE;
42
43
2.33k
  Stream_Read_UINT32(s, header->highUniqueId);
44
2.33k
  Stream_Read_UINT32(s, header->lowUniqueId);
45
2.33k
  Stream_Read_UINT64(s, header->tmMilliseconds);
46
2.33k
  Stream_Read_UINT64(s, header->tmSeconds);
47
2.33k
  return TRUE;
48
2.44k
}
49
50
static BOOL update_recv_surfcmd_bitmap_ex(wStream* s, TS_BITMAP_DATA_EX* bmp)
51
5.01k
{
52
5.01k
  if (!s || !bmp)
53
0
    return FALSE;
54
55
5.01k
  if (!Stream_CheckAndLogRequiredLength(TAG, s, 12))
56
264
    return FALSE;
57
58
4.75k
  Stream_Read_UINT8(s, bmp->bpp);
59
4.75k
  Stream_Read_UINT8(s, bmp->flags);
60
4.75k
  Stream_Seek(s, 1); /* reserved */
61
4.75k
  Stream_Read_UINT8(s, bmp->codecID);
62
4.75k
  Stream_Read_UINT16(s, bmp->width);
63
4.75k
  Stream_Read_UINT16(s, bmp->height);
64
4.75k
  Stream_Read_UINT32(s, bmp->bitmapDataLength);
65
66
4.75k
  if ((bmp->width == 0) || (bmp->height == 0))
67
349
  {
68
349
    WLog_ERR(TAG, "invalid size value width=%" PRIu16 ", height=%" PRIu16, bmp->width,
69
349
             bmp->height);
70
349
    return FALSE;
71
349
  }
72
73
4.40k
  if ((bmp->bpp < 1) || (bmp->bpp > 32))
74
751
  {
75
751
    WLog_ERR(TAG, "invalid bpp value %" PRIu32 "", bmp->bpp);
76
751
    return FALSE;
77
751
  }
78
79
3.65k
  if (bmp->flags & EX_COMPRESSED_BITMAP_HEADER_PRESENT)
80
2.44k
  {
81
2.44k
    if (!update_recv_surfcmd_bitmap_header_ex(s, &bmp->exBitmapDataHeader))
82
112
      return FALSE;
83
2.44k
  }
84
85
3.54k
  bmp->bitmapData = Stream_Pointer(s);
86
3.54k
  if (!Stream_SafeSeek(s, bmp->bitmapDataLength))
87
1.24k
  {
88
1.24k
    WLog_ERR(TAG, "expected bitmapDataLength %" PRIu32 ", not enough data",
89
1.24k
             bmp->bitmapDataLength);
90
1.24k
    return FALSE;
91
1.24k
  }
92
2.29k
  return TRUE;
93
3.54k
}
94
95
static BOOL update_recv_surfcmd_is_rect_valid(const rdpContext* context,
96
                                              const SURFACE_BITS_COMMAND* cmd)
97
7.32k
{
98
7.32k
  WINPR_ASSERT(context);
99
7.32k
  WINPR_ASSERT(context->settings);
100
7.32k
  WINPR_ASSERT(cmd);
101
102
  /* We need a rectangle with left/top being smaller than right/bottom.
103
   * Also do not allow empty rectangles. */
104
7.32k
  if ((cmd->destTop >= cmd->destBottom) || (cmd->destLeft >= cmd->destRight))
105
1.11k
  {
106
1.11k
    WLog_WARN(TAG,
107
1.11k
              "Empty surface bits command rectangle: %" PRIu16 "x%" PRIu16 "-%" PRIu16
108
1.11k
              "x%" PRIu16,
109
1.11k
              cmd->destLeft, cmd->destTop, cmd->destRight, cmd->destBottom);
110
1.11k
    return FALSE;
111
1.11k
  }
112
113
  /* The rectangle needs to fit into our session size */
114
6.20k
  const DWORD DesktopWidth = freerdp_settings_get_uint32(context->settings, FreeRDP_DesktopWidth);
115
6.20k
  const DWORD DesktopHeight =
116
6.20k
      freerdp_settings_get_uint32(context->settings, FreeRDP_DesktopHeight);
117
6.20k
  if ((cmd->destRight > DesktopWidth) || (cmd->destBottom > DesktopHeight))
118
1.19k
  {
119
1.19k
    WLog_WARN(TAG,
120
1.19k
              "Invalid surface bits command rectangle: %" PRIu16 "x%" PRIu16 "-%" PRIu16
121
1.19k
              "x%" PRIu16 " does not fit %" PRIu32 "x%" PRIu32,
122
1.19k
              cmd->destLeft, cmd->destTop, cmd->destRight, cmd->destBottom, DesktopWidth,
123
1.19k
              DesktopHeight);
124
1.19k
    return FALSE;
125
1.19k
  }
126
127
5.01k
  return TRUE;
128
6.20k
}
129
130
static BOOL update_recv_surfcmd_surface_bits(rdpUpdate* update, wStream* s, UINT16 cmdType)
131
8.00k
{
132
8.00k
  rdp_update_internal* up = update_cast(update);
133
8.00k
  BOOL rc = FALSE;
134
8.00k
  SURFACE_BITS_COMMAND cmd = WINPR_C_ARRAY_INIT;
135
136
8.00k
  WINPR_ASSERT(up);
137
138
8.00k
  if (!Stream_CheckAndLogRequiredLength(TAG, s, 8))
139
682
    goto fail;
140
141
7.32k
  cmd.cmdType = cmdType;
142
7.32k
  Stream_Read_UINT16(s, cmd.destLeft);
143
7.32k
  Stream_Read_UINT16(s, cmd.destTop);
144
7.32k
  Stream_Read_UINT16(s, cmd.destRight);
145
7.32k
  Stream_Read_UINT16(s, cmd.destBottom);
146
147
7.32k
  if (!update_recv_surfcmd_is_rect_valid(update->context, &cmd))
148
2.30k
    goto fail;
149
150
5.01k
  if (!update_recv_surfcmd_bitmap_ex(s, &cmd.bmp))
151
2.72k
    goto fail;
152
153
2.29k
  up->stats.base[RDP_STATS_SURFACE_BITS]++;
154
2.29k
  switch (cmd.bmp.codecID)
155
2.29k
  {
156
100
    case RDP_CODEC_ID_REMOTEFX:
157
100
      up->stats.base[RDP_STATS_SURFACE_BITS_RFX]++;
158
100
      break;
159
71
    case RDP_CODEC_ID_IMAGE_REMOTEFX:
160
71
      up->stats.base[RDP_STATS_SURFACE_BITS_RFX_IMAGE]++;
161
71
      break;
162
209
    case RDP_CODEC_ID_NSCODEC:
163
209
      up->stats.base[RDP_STATS_SURFACE_BITS_NSC]++;
164
209
      break;
165
279
    case RDP_CODEC_ID_NONE:
166
279
      up->stats.base[RDP_STATS_SURFACE_BITS_NONE]++;
167
279
      break;
168
1.63k
    default:
169
1.63k
      up->stats.base[RDP_STATS_SURFACE_BITS_UNKNOWN]++;
170
1.63k
      break;
171
2.29k
  }
172
173
2.29k
  if (!IFCALLRESULT(TRUE, update->SurfaceBits, update->context, &cmd))
174
1.37k
  {
175
1.37k
    WLog_DBG(TAG, "update->SurfaceBits implementation failed");
176
1.37k
    goto fail;
177
1.37k
  }
178
179
914
  rc = TRUE;
180
8.00k
fail:
181
8.00k
  return rc;
182
914
}
183
184
static BOOL update_recv_surfcmd_frame_marker(rdpUpdate* update, wStream* s)
185
1.83k
{
186
1.83k
  SURFACE_FRAME_MARKER marker = WINPR_C_ARRAY_INIT;
187
1.83k
  rdp_update_internal* up = update_cast(update);
188
189
1.83k
  WINPR_ASSERT(s);
190
191
1.83k
  if (!Stream_CheckAndLogRequiredLength(TAG, s, 2))
192
210
    return FALSE;
193
194
1.62k
  Stream_Read_UINT16(s, marker.frameAction);
195
1.62k
  if (!Stream_CheckAndLogRequiredLength(TAG, s, 4))
196
1.01k
    WLog_WARN(TAG,
197
1.62k
              "[SERVER-BUG]: got %" PRIuz ", expected %u"
198
1.62k
              " bytes. [MS-RDPBCGR] 2.2.9.2.3 Frame Marker Command (TS_FRAME_MARKER) is "
199
1.62k
              "missing frameId, ignoring",
200
1.62k
              Stream_GetRemainingLength(s), 4u);
201
612
  else
202
612
    Stream_Read_UINT32(s, marker.frameId);
203
1.62k
  WLog_Print(up->log, WLOG_DEBUG, "SurfaceFrameMarker: action: %s (%" PRIu32 ") id: %" PRIu32 "",
204
1.62k
             (!marker.frameAction) ? "Begin" : "End", marker.frameAction, marker.frameId);
205
206
1.62k
  if (!update->SurfaceFrameMarker)
207
330
  {
208
330
    WINPR_ASSERT(update->context);
209
330
    if (freerdp_settings_get_bool(update->context->settings, FreeRDP_DeactivateClientDecoding))
210
0
      return TRUE;
211
330
    WLog_ERR(TAG, "Missing callback update->SurfaceFrameMarker");
212
330
    return FALSE;
213
330
  }
214
215
1.29k
  if (!update->SurfaceFrameMarker(update->context, &marker))
216
1.29k
  {
217
1.29k
    WLog_DBG(TAG, "update->SurfaceFrameMarker implementation failed");
218
1.29k
    return FALSE;
219
1.29k
  }
220
221
0
  return TRUE;
222
1.29k
}
223
224
BOOL update_recv_surfcmds(rdpUpdate* update, wStream* s)
225
34.2k
{
226
34.2k
  UINT16 cmdType = 0;
227
34.2k
  rdp_update_internal* up = update_cast(update);
228
229
34.2k
  WINPR_ASSERT(s);
230
231
35.1k
  while (Stream_GetRemainingLength(s) >= 2)
232
20.7k
  {
233
20.7k
    const size_t start = Stream_GetPosition(s);
234
20.7k
    const BYTE* mark = Stream_ConstPointer(s);
235
236
20.7k
    Stream_Read_UINT16(s, cmdType);
237
238
20.7k
    switch (cmdType)
239
20.7k
    {
240
6.58k
      case CMDTYPE_SET_SURFACE_BITS:
241
8.00k
      case CMDTYPE_STREAM_SURFACE_BITS:
242
8.00k
        if (!update_recv_surfcmd_surface_bits(update, s, cmdType))
243
7.09k
          return FALSE;
244
914
        break;
245
246
1.83k
      case CMDTYPE_FRAME_MARKER:
247
1.83k
        up->stats.base[RDP_STATS_SURFACE_FRAME_MARKER]++;
248
1.83k
        if (!update_recv_surfcmd_frame_marker(update, s))
249
1.83k
          return FALSE;
250
251
0
        break;
252
253
10.8k
      default:
254
10.8k
        WLog_ERR(TAG, "unknown cmdType 0x%04" PRIX16 "", cmdType);
255
10.8k
        return FALSE;
256
20.7k
    }
257
258
914
    if (up->dump_rfx)
259
0
    {
260
0
      const size_t size = Stream_GetPosition(s) - start;
261
      /* TODO: treat return values */
262
0
      if (!pcap_add_record(up->pcap_rfx, mark, size))
263
0
        return FALSE;
264
0
      pcap_flush(up->pcap_rfx);
265
0
    }
266
914
  }
267
268
14.4k
  return TRUE;
269
34.2k
}
270
271
static BOOL update_write_surfcmd_bitmap_header_ex(wStream* s,
272
                                                  const TS_COMPRESSED_BITMAP_HEADER_EX* header)
273
903
{
274
903
  if (!s || !header)
275
0
    return FALSE;
276
277
903
  if (!Stream_EnsureRemainingCapacity(s, 24))
278
0
    return FALSE;
279
280
903
  Stream_Write_UINT32(s, header->highUniqueId);
281
903
  Stream_Write_UINT32(s, header->lowUniqueId);
282
903
  Stream_Write_UINT64(s, header->tmMilliseconds);
283
903
  Stream_Write_UINT64(s, header->tmSeconds);
284
903
  return TRUE;
285
903
}
286
287
static BOOL update_write_surfcmd_bitmap_ex(wStream* s, const TS_BITMAP_DATA_EX* bmp)
288
1.37k
{
289
1.37k
  if (!s || !bmp)
290
0
    return FALSE;
291
292
1.37k
  if (!Stream_EnsureRemainingCapacity(s, 12))
293
0
    return FALSE;
294
295
1.37k
  if (bmp->codecID > UINT8_MAX)
296
0
  {
297
0
    WLog_ERR(TAG, "Invalid TS_BITMAP_DATA_EX::codecID=0x%04" PRIx16 "", bmp->codecID);
298
0
    return FALSE;
299
0
  }
300
1.37k
  Stream_Write_UINT8(s, bmp->bpp);
301
1.37k
  Stream_Write_UINT8(s, bmp->flags);
302
1.37k
  Stream_Write_UINT8(s, 0); /* reserved1, reserved2 */
303
1.37k
  Stream_Write_UINT8(s, (UINT8)bmp->codecID);
304
1.37k
  Stream_Write_UINT16(s, bmp->width);
305
1.37k
  Stream_Write_UINT16(s, bmp->height);
306
1.37k
  Stream_Write_UINT32(s, bmp->bitmapDataLength);
307
308
1.37k
  if (bmp->flags & EX_COMPRESSED_BITMAP_HEADER_PRESENT)
309
903
  {
310
903
    if (!update_write_surfcmd_bitmap_header_ex(s, &bmp->exBitmapDataHeader))
311
0
      return FALSE;
312
903
  }
313
314
1.37k
  if (!Stream_EnsureRemainingCapacity(s, bmp->bitmapDataLength))
315
0
    return FALSE;
316
317
1.37k
  Stream_Write(s, bmp->bitmapData, bmp->bitmapDataLength);
318
1.37k
  return TRUE;
319
1.37k
}
320
321
BOOL update_write_surfcmd_surface_bits(wStream* s, const SURFACE_BITS_COMMAND* cmd)
322
1.37k
{
323
1.37k
  if (!Stream_EnsureRemainingCapacity(s, SURFCMD_SURFACE_BITS_HEADER_LENGTH))
324
0
    return FALSE;
325
326
1.37k
  WINPR_ASSERT(cmd->cmdType <= UINT16_MAX);
327
1.37k
  UINT16 cmdType = (UINT16)cmd->cmdType;
328
1.37k
  switch (cmdType)
329
1.37k
  {
330
997
    case CMDTYPE_SET_SURFACE_BITS:
331
1.37k
    case CMDTYPE_STREAM_SURFACE_BITS:
332
1.37k
      break;
333
0
    default:
334
0
    {
335
0
      const UINT16 defaultCmdType = CMDTYPE_STREAM_SURFACE_BITS;
336
0
      WLog_WARN(TAG,
337
0
                "SURFACE_BITS_COMMAND->cmdType 0x%04" PRIx16
338
0
                " not allowed, correcting to 0x%04" PRIx16,
339
0
                cmdType, defaultCmdType);
340
0
      cmdType = defaultCmdType;
341
0
    }
342
0
    break;
343
1.37k
  }
344
345
1.37k
  Stream_Write_UINT16(s, WINPR_ASSERTING_INT_CAST(uint16_t, cmdType));
346
1.37k
  Stream_Write_UINT16(s, WINPR_ASSERTING_INT_CAST(uint16_t, cmd->destLeft));
347
1.37k
  Stream_Write_UINT16(s, WINPR_ASSERTING_INT_CAST(uint16_t, cmd->destTop));
348
1.37k
  Stream_Write_UINT16(s, WINPR_ASSERTING_INT_CAST(uint16_t, cmd->destRight));
349
1.37k
  Stream_Write_UINT16(s, WINPR_ASSERTING_INT_CAST(uint16_t, cmd->destBottom));
350
1.37k
  return update_write_surfcmd_bitmap_ex(s, &cmd->bmp);
351
1.37k
}
352
353
BOOL update_write_surfcmd_frame_marker(wStream* s, UINT16 frameAction, UINT32 frameId)
354
1.28k
{
355
1.28k
  if (!Stream_EnsureRemainingCapacity(s, SURFCMD_FRAME_MARKER_LENGTH))
356
0
    return FALSE;
357
358
1.28k
  Stream_Write_UINT16(s, CMDTYPE_FRAME_MARKER);
359
1.28k
  Stream_Write_UINT16(s, frameAction);
360
1.28k
  Stream_Write_UINT32(s, frameId);
361
1.28k
  return TRUE;
362
1.28k
}