From 88b7859c870d8ab2c1e99ee55339e1658749fc0d Mon Sep 17 00:00:00 2001
From: Mati Shabtay <35010736+m4ntis@users.noreply.github.com>
Date: Fri, 15 Mar 2019 09:37:35 +0200
Subject: [PATCH] server/rdpgfx_main.c: Fixed caps advertise PDU recv (#5304)

---
 channels/rdpgfx/server/rdpgfx_main.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/channels/rdpgfx/server/rdpgfx_main.c b/channels/rdpgfx/server/rdpgfx_main.c
index 7542522..0990d94 100644
--- a/channels/rdpgfx/server/rdpgfx_main.c
+++ b/channels/rdpgfx/server/rdpgfx_main.c
@@ -1194,7 +1194,6 @@ static UINT rdpgfx_recv_caps_advertise_pdu(RdpgfxServerContext* context,
 	RDPGFX_CAPSET* capsSets;
 	RDPGFX_CAPS_ADVERTISE_PDU pdu;
 	UINT error = CHANNEL_RC_OK;
-	UINT32 capsDataLength;
 
 	if (Stream_GetRemainingLength(s) < 2)
 	{
@@ -1221,9 +1220,9 @@ static UINT rdpgfx_recv_caps_advertise_pdu(RdpgfxServerContext* context,
 	{
 		RDPGFX_CAPSET* capsSet = &(pdu.capsSets[index]);
 		Stream_Read_UINT32(s, capsSet->version); /* version (4 bytes) */
-		Stream_Read_UINT32(s, capsDataLength); /* capsDataLength (4 bytes) */
+		Stream_Read_UINT32(s, capsSet->length); /* capsDataLength (4 bytes) */
 
-		if (capsDataLength >= 4)
+		if (capsSet->length >= 4)
 			Stream_Peek_UINT32(s, capsSet->flags); /* capsData (4 bytes) */
 
 		Stream_Seek(s, capsSet->length);
-- 
2.7.4