Coverage Report

Created: 2026-10-15 06:31

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/FreeRDP/channels/geometry/client/geometry_main.c
Line
Count
Source
1
/**
2
 * FreeRDP: A Remote Desktop Protocol Implementation
3
 * Geometry tracking Virtual Channel Extension
4
 *
5
 * Copyright 2017 David Fort <contact@hardening-consulting.com>
6
 *
7
 * Licensed under the Apache License, Version 2.0 (the "License");
8
 * you may not use this file except in compliance with the License.
9
 * You may obtain a copy of the License at
10
 *
11
 *     http://www.apache.org/licenses/LICENSE-2.0
12
 *
13
 * Unless required by applicable law or agreed to in writing, software
14
 * distributed under the License is distributed on an "AS IS" BASIS,
15
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16
 * See the License for the specific language governing permissions and
17
 * limitations under the License.
18
 */
19
20
#include <freerdp/config.h>
21
22
#include <stdio.h>
23
#include <stdlib.h>
24
#include <string.h>
25
26
#include <winpr/crt.h>
27
#include <winpr/synch.h>
28
#include <winpr/print.h>
29
#include <winpr/stream.h>
30
#include <winpr/cmdline.h>
31
#include <winpr/collections.h>
32
33
#include <freerdp/addin.h>
34
#include <freerdp/client/channels.h>
35
#include <freerdp/client/geometry.h>
36
#include <freerdp/channels/log.h>
37
38
0
#define TAG CHANNELS_TAG("geometry.client")
39
40
#include "geometry_main.h"
41
42
typedef struct
43
{
44
  GENERIC_DYNVC_PLUGIN base;
45
  GeometryClientContext* context;
46
} GEOMETRY_PLUGIN;
47
48
static UINT32 mappedGeometryHash(const void* v)
49
0
{
50
0
  const UINT64* g = (const UINT64*)v;
51
0
  return (UINT32)((*g >> 32) + (*g & 0xffffffff));
52
0
}
53
54
static BOOL mappedGeometryKeyCompare(const void* v1, const void* v2)
55
0
{
56
0
  const UINT64* g1 = (const UINT64*)v1;
57
0
  const UINT64* g2 = (const UINT64*)v2;
58
0
  return *g1 == *g2;
59
0
}
60
61
static void freerdp_rgndata_reset(FREERDP_RGNDATA* data)
62
0
{
63
0
  data->nRectCount = 0;
64
0
}
65
66
static UINT32 geometry_read_RGNDATA(wLog* logger, wStream* s, UINT32 len, FREERDP_RGNDATA* rgndata)
67
0
{
68
0
  WINPR_ASSERT(rgndata);
69
70
0
  if (len < 32)
71
0
  {
72
0
    WLog_Print(logger, WLOG_ERROR, "invalid RGNDATA");
73
0
    return ERROR_INVALID_DATA;
74
0
  }
75
76
0
  const UINT32 dwSize = Stream_Get_UINT32(s);
77
78
0
  if (dwSize != 32)
79
0
  {
80
0
    WLog_Print(logger, WLOG_ERROR, "invalid RGNDATA dwSize");
81
0
    return ERROR_INVALID_DATA;
82
0
  }
83
84
0
  const UINT32 iType = Stream_Get_UINT32(s);
85
86
0
  if (iType != RDH_RECTANGLE)
87
0
  {
88
0
    WLog_Print(logger, WLOG_ERROR, "iType %" PRIu32 " for RGNDATA is not supported", iType);
89
0
    return ERROR_UNSUPPORTED_TYPE;
90
0
  }
91
92
0
  rgndata->nRectCount = Stream_Get_UINT32(s);
93
0
  Stream_Seek_UINT32(s); /* nRgnSize IGNORED */
94
0
  {
95
0
    const INT32 x = Stream_Get_INT32(s);
96
0
    const INT32 y = Stream_Get_INT32(s);
97
0
    const INT32 right = Stream_Get_INT32(s);
98
0
    const INT32 bottom = Stream_Get_INT32(s);
99
0
    if ((abs(x) > INT16_MAX) || (abs(y) > INT16_MAX))
100
0
    {
101
0
      WLog_Print(logger, WLOG_ERROR, "x=%" PRId32 " or y=%" PRId32 " does not fit into INT16",
102
0
                 x, y);
103
0
      return ERROR_INVALID_DATA;
104
0
    }
105
0
    const INT32 w = right - x;
106
0
    const INT32 h = bottom - y;
107
0
    if ((abs(w) > INT16_MAX) || (abs(h) > INT16_MAX))
108
0
    {
109
0
      WLog_Print(logger, WLOG_ERROR, "w=%" PRId32 " or h=%" PRId32 " does not fit into INT16",
110
0
                 w, h);
111
0
      return ERROR_INVALID_DATA;
112
0
    }
113
0
    if ((x > right) || (y > bottom))
114
0
    {
115
0
      WLog_Print(logger, WLOG_ERROR,
116
0
                 "One of x=%" PRId32 " > right=%" PRId32 " or y=%" PRId32
117
0
                 " > bottom=%" PRId32,
118
0
                 x, right, y, bottom);
119
0
      return ERROR_INVALID_DATA;
120
0
    }
121
0
    rgndata->boundingRect.x = (INT16)x;
122
0
    rgndata->boundingRect.y = (INT16)y;
123
0
    rgndata->boundingRect.width = (INT16)w;
124
0
    rgndata->boundingRect.height = (INT16)h;
125
0
  }
126
0
  len -= 32;
127
128
0
  if (len / (4 * 4) < rgndata->nRectCount)
129
0
  {
130
0
    WLog_Print(logger, WLOG_ERROR, "not enough data for region rectangles");
131
0
    return ERROR_INVALID_DATA;
132
0
  }
133
134
0
  if (rgndata->nRectCount)
135
0
  {
136
0
    RDP_RECT* tmp = realloc(rgndata->rects, rgndata->nRectCount * sizeof(RDP_RECT));
137
138
0
    if (!tmp)
139
0
    {
140
0
      WLog_Print(logger, WLOG_ERROR, "unable to allocate memory for %" PRIu32 " RECTs",
141
0
                 rgndata->nRectCount);
142
0
      return CHANNEL_RC_NO_MEMORY;
143
0
    }
144
0
    rgndata->rects = tmp;
145
146
0
    for (UINT32 i = 0; i < rgndata->nRectCount; i++)
147
0
    {
148
0
      RDP_RECT* rect = &rgndata->rects[i];
149
150
0
      if (!Stream_CheckAndLogRequiredLengthWLog(logger, s, 16))
151
0
        return CHANNEL_RC_NULL_DATA;
152
153
0
      const INT32 x = Stream_Get_INT32(s);
154
0
      const INT32 y = Stream_Get_INT32(s);
155
0
      const INT32 right = Stream_Get_INT32(s);
156
0
      const INT32 bottom = Stream_Get_INT32(s);
157
0
      if ((abs(x) > INT16_MAX) || (abs(y) > INT16_MAX))
158
0
      {
159
0
        WLog_Print(logger, WLOG_ERROR, "x=%" PRId32 " or y=%" PRId32 " does not fit INT16",
160
0
                   x, y);
161
0
        return ERROR_INVALID_DATA;
162
0
      }
163
0
      const INT32 w = right - x;
164
0
      const INT32 h = bottom - y;
165
0
      if ((abs(w) > INT16_MAX) || (abs(h) > INT16_MAX))
166
0
        return ERROR_INVALID_DATA;
167
168
0
      if ((x > right) || (y > bottom))
169
0
      {
170
0
        WLog_Print(logger, WLOG_ERROR,
171
0
                   "One of x=%" PRId32 " > right=%" PRId32 ", y=%" PRId32
172
0
                   " > bottom=%" PRId32,
173
0
                   x, right, y, bottom);
174
0
        return ERROR_INVALID_DATA;
175
0
      }
176
0
      rect->x = (INT16)x;
177
0
      rect->y = (INT16)y;
178
0
      rect->width = (INT16)w;
179
0
      rect->height = (INT16)h;
180
0
    }
181
0
  }
182
183
0
  return CHANNEL_RC_OK;
184
0
}
185
186
/**
187
 * Function description
188
 *
189
 * @return 0 on success, otherwise a Win32 error code
190
 */
191
static UINT geometry_recv_pdu(GENERIC_CHANNEL_CALLBACK* callback, wStream* s)
192
0
{
193
0
  UINT ret = CHANNEL_RC_OK;
194
195
0
  WINPR_ASSERT(callback);
196
0
  GEOMETRY_PLUGIN* geometry = (GEOMETRY_PLUGIN*)callback->plugin;
197
0
  WINPR_ASSERT(geometry);
198
199
0
  wLog* logger = geometry->base.log;
200
0
  GeometryClientContext* context = (GeometryClientContext*)geometry->base.iface.pInterface;
201
0
  WINPR_ASSERT(context);
202
203
0
  if (!Stream_CheckAndLogRequiredLengthWLog(logger, s, 4))
204
0
    return ERROR_INVALID_DATA;
205
206
0
  const UINT32 length = Stream_Get_UINT32(s); /* Length (4 bytes) */
207
208
0
  if (!Stream_CheckAndLogRequiredLengthWLog(logger, s, (length - 4)))
209
0
  {
210
0
    WLog_Print(logger, WLOG_ERROR, "invalid packet length");
211
0
    return ERROR_INVALID_DATA;
212
0
  }
213
214
0
  if (!Stream_CheckAndLogRequiredLengthWLog(logger, s, 20))
215
0
    return ERROR_INVALID_DATA;
216
217
0
  context->remoteVersion = Stream_Get_UINT32(s);
218
0
  const UINT64 id = Stream_Get_UINT64(s);
219
0
  const UINT32 updateType = Stream_Get_UINT32(s);
220
0
  Stream_Seek_UINT32(s); /* flags */
221
222
0
  MAPPED_GEOMETRY* mappedGeometry = HashTable_GetItemValue(context->geometries, &id);
223
224
0
  if (updateType == GEOMETRY_CLEAR)
225
0
  {
226
0
    if (!mappedGeometry)
227
0
    {
228
0
      WLog_Print(logger, WLOG_ERROR,
229
0
                 "geometry 0x%" PRIx64 " not found here, ignoring clear command", id);
230
0
      return CHANNEL_RC_OK;
231
0
    }
232
233
0
    WLog_Print(logger, WLOG_DEBUG, "clearing geometry 0x%" PRIx64 "", id);
234
235
0
    if (mappedGeometry->MappedGeometryClear &&
236
0
        !mappedGeometry->MappedGeometryClear(mappedGeometry))
237
0
      return ERROR_INTERNAL_ERROR;
238
239
0
    if (!HashTable_Remove(context->geometries, &id))
240
0
      WLog_Print(logger, WLOG_ERROR, "geometry not removed from geometries");
241
0
  }
242
0
  else if (updateType == GEOMETRY_UPDATE)
243
0
  {
244
0
    BOOL newOne = FALSE;
245
246
0
    if (!mappedGeometry)
247
0
    {
248
0
      newOne = TRUE;
249
0
      WLog_Print(logger, WLOG_DEBUG, "creating geometry 0x%" PRIx64 "", id);
250
0
      mappedGeometry = calloc(1, sizeof(MAPPED_GEOMETRY));
251
0
      if (!mappedGeometry)
252
0
        return CHANNEL_RC_NO_MEMORY;
253
254
0
      mappedGeometry->refCounter = 1;
255
0
      mappedGeometry->mappingId = id;
256
257
0
      if (!HashTable_Insert(context->geometries, &(mappedGeometry->mappingId),
258
0
                            mappedGeometry))
259
0
      {
260
0
        WLog_Print(logger, WLOG_ERROR,
261
0
                   "unable to register geometry 0x%" PRIx64 " in the table", id);
262
0
        free(mappedGeometry);
263
0
        return CHANNEL_RC_NO_MEMORY;
264
0
      }
265
0
    }
266
0
    else
267
0
    {
268
0
      WLog_Print(logger, WLOG_DEBUG, "updating geometry 0x%" PRIx64 "", id);
269
0
    }
270
271
0
    if (!Stream_CheckAndLogRequiredLengthWLog(logger, s, 48))
272
0
    {
273
      // NOLINTNEXTLINE(clang-analyzer-unix.Malloc): HashTable_Insert ownership mappedGeometry
274
0
      return ERROR_INVALID_DATA;
275
0
    }
276
277
0
    mappedGeometry->topLevelId = Stream_Get_UINT64(s);
278
279
0
    mappedGeometry->left = Stream_Get_INT32(s);
280
0
    mappedGeometry->top = Stream_Get_INT32(s);
281
0
    mappedGeometry->right = Stream_Get_INT32(s);
282
0
    mappedGeometry->bottom = Stream_Get_INT32(s);
283
284
0
    if (mappedGeometry->left > mappedGeometry->right)
285
0
    {
286
0
      WLog_Print(logger, WLOG_ERROR, "invalid left=%" PRId32 " > right=%" PRId32,
287
0
                 mappedGeometry->left, mappedGeometry->right);
288
0
      return ERROR_INVALID_DATA;
289
0
    }
290
0
    if (mappedGeometry->top > mappedGeometry->bottom)
291
0
    {
292
0
      WLog_Print(logger, WLOG_ERROR, "invalid top=%" PRId32 " > bottom=%" PRId32,
293
0
                 mappedGeometry->top, mappedGeometry->bottom);
294
0
      return ERROR_INVALID_DATA;
295
0
    }
296
297
0
    mappedGeometry->topLevelLeft = Stream_Get_INT32(s);
298
0
    mappedGeometry->topLevelTop = Stream_Get_INT32(s);
299
0
    mappedGeometry->topLevelRight = Stream_Get_INT32(s);
300
0
    mappedGeometry->topLevelBottom = Stream_Get_INT32(s);
301
302
0
    if (mappedGeometry->topLevelLeft > mappedGeometry->topLevelRight)
303
0
    {
304
0
      WLog_Print(logger, WLOG_ERROR,
305
0
                 "invalid topLevelLeft=%" PRId32 " > topLevelRight=%" PRId32,
306
0
                 mappedGeometry->topLevelLeft, mappedGeometry->topLevelRight);
307
0
      return ERROR_INVALID_DATA;
308
0
    }
309
0
    if (mappedGeometry->topLevelTop > mappedGeometry->topLevelBottom)
310
0
    {
311
0
      WLog_Print(logger, WLOG_ERROR,
312
0
                 "invalid topLevelTop=%" PRId32 " > topLevelBottom=%" PRId32,
313
0
                 mappedGeometry->topLevelTop, mappedGeometry->topLevelBottom);
314
0
      return ERROR_INVALID_DATA;
315
0
    }
316
317
0
    const UINT32 geometryType = Stream_Get_UINT32(s);
318
0
    if (geometryType != 0x02)
319
0
    {
320
0
      WLog_Print(logger, WLOG_DEBUG, "geometryType should be set to 0x02 and is 0x%" PRIx32,
321
0
                 geometryType);
322
0
      return ERROR_INVALID_DATA;
323
0
    }
324
325
0
    const UINT32 cbGeometryBuffer = Stream_Get_UINT32(s);
326
0
    if (!Stream_CheckAndLogRequiredLengthWLog(logger, s, cbGeometryBuffer))
327
0
    {
328
      // NOLINTNEXTLINE(clang-analyzer-unix.Malloc): HashTable_Insert ownership mappedGeometry
329
0
      return ERROR_INVALID_DATA;
330
0
    }
331
332
0
    if (cbGeometryBuffer > 0)
333
0
    {
334
0
      ret = geometry_read_RGNDATA(logger, s, cbGeometryBuffer, &mappedGeometry->geometry);
335
0
      if (ret != CHANNEL_RC_OK)
336
0
        return ret;
337
0
    }
338
0
    else
339
0
    {
340
0
      freerdp_rgndata_reset(&mappedGeometry->geometry);
341
0
    }
342
343
0
    if (newOne)
344
0
    {
345
0
      if (context->MappedGeometryAdded &&
346
0
          !context->MappedGeometryAdded(context, mappedGeometry))
347
0
      {
348
0
        WLog_Print(logger, WLOG_ERROR, "geometry added callback failed");
349
0
        ret = ERROR_INTERNAL_ERROR;
350
0
      }
351
0
    }
352
0
    else
353
0
    {
354
0
      if (mappedGeometry->MappedGeometryUpdate &&
355
0
          !mappedGeometry->MappedGeometryUpdate(mappedGeometry))
356
0
      {
357
0
        WLog_Print(logger, WLOG_ERROR, "geometry update callback failed");
358
0
        ret = ERROR_INTERNAL_ERROR;
359
0
      }
360
0
    }
361
0
  }
362
0
  else
363
0
  {
364
0
    WLog_Print(logger, WLOG_ERROR, "unknown updateType=%" PRIu32 "", updateType);
365
0
    ret = CHANNEL_RC_OK;
366
0
  }
367
368
0
  return ret;
369
0
}
370
371
/**
372
 * Function description
373
 *
374
 * @return 0 on success, otherwise a Win32 error code
375
 */
376
static UINT geometry_on_data_received(IWTSVirtualChannelCallback* pChannelCallback, wStream* data)
377
0
{
378
0
  GENERIC_CHANNEL_CALLBACK* callback = (GENERIC_CHANNEL_CALLBACK*)pChannelCallback;
379
0
  return geometry_recv_pdu(callback, data);
380
0
}
381
382
/**
383
 * Function description
384
 *
385
 * @return 0 on success, otherwise a Win32 error code
386
 */
387
static UINT geometry_on_close(IWTSVirtualChannelCallback* pChannelCallback)
388
0
{
389
0
  free(pChannelCallback);
390
0
  return CHANNEL_RC_OK;
391
0
}
392
393
static void mappedGeometryUnref_void(void* arg)
394
0
{
395
0
  MAPPED_GEOMETRY* g = (MAPPED_GEOMETRY*)arg;
396
0
  mappedGeometryUnref(g);
397
0
}
398
399
/**
400
 * Channel Client Interface
401
 */
402
403
static const IWTSVirtualChannelCallback geometry_callbacks = { geometry_on_data_received,
404
                                                             nullptr, /* Open */
405
                                                             geometry_on_close, nullptr };
406
407
static void geometry_plugin_free(GeometryClientContext* context)
408
0
{
409
0
  if (!context)
410
0
    return;
411
0
  HashTable_Free(context->geometries);
412
0
  free(context);
413
0
}
414
static void terminate_plugin_cb(GENERIC_DYNVC_PLUGIN* base)
415
0
{
416
0
  GEOMETRY_PLUGIN* geometry = (GEOMETRY_PLUGIN*)base;
417
418
0
  if (!geometry)
419
0
    return;
420
421
0
  geometry_plugin_free(geometry->context);
422
0
}
423
424
static UINT init_plugin_cb(GENERIC_DYNVC_PLUGIN* base, WINPR_ATTR_UNUSED rdpContext* rcontext,
425
                           rdpSettings* settings)
426
0
{
427
0
  GEOMETRY_PLUGIN* geometry = (GEOMETRY_PLUGIN*)base;
428
429
0
  WINPR_ASSERT(base);
430
0
  WINPR_UNUSED(settings);
431
432
0
  GeometryClientContext* context =
433
0
      (GeometryClientContext*)calloc(1, sizeof(GeometryClientContext));
434
0
  if (!context)
435
0
    goto fail;
436
437
0
  context->geometries = HashTable_New(FALSE);
438
0
  if (!context->geometries)
439
0
    goto fail;
440
441
0
  if (!HashTable_SetHashFunction(context->geometries, mappedGeometryHash))
442
0
    goto fail;
443
444
0
  {
445
0
    wObject* obj = HashTable_KeyObject(context->geometries);
446
0
    obj->fnObjectEquals = mappedGeometryKeyCompare;
447
0
  }
448
0
  {
449
0
    wObject* obj = HashTable_ValueObject(context->geometries);
450
0
    obj->fnObjectFree = mappedGeometryUnref_void;
451
0
  }
452
0
  context->handle = (void*)geometry;
453
454
0
  geometry->context = context;
455
0
  geometry->base.iface.pInterface = (void*)context;
456
457
0
  return CHANNEL_RC_OK;
458
459
0
fail:
460
0
  geometry_plugin_free(context);
461
0
  return CHANNEL_RC_NO_MEMORY;
462
0
}
463
464
/**
465
 * Function description
466
 *
467
 * @return 0 on success, otherwise a Win32 error code
468
 */
469
FREERDP_ENTRY_POINT(UINT VCAPITYPE geometry_DVCPluginEntry(IDRDYNVC_ENTRY_POINTS* pEntryPoints))
470
0
{
471
0
  return freerdp_generic_DVCPluginEntry(pEntryPoints, TAG, GEOMETRY_DVC_CHANNEL_NAME,
472
0
                                        sizeof(GEOMETRY_PLUGIN), sizeof(GENERIC_CHANNEL_CALLBACK),
473
0
                                        &geometry_callbacks, init_plugin_cb, terminate_plugin_cb);
474
0
}