From b3a642164a770179aaa04315f9c2fd28d450ba3f Mon Sep 17 00:00:00 2001
From: Armin Novak <armin.novak@thincast.com>
Date: Tue, 14 Jan 2020 15:14:40 +0100
Subject: [PATCH] Fixed planar size checks.

---
 libfreerdp/codec/planar.c | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/libfreerdp/codec/planar.c b/libfreerdp/codec/planar.c
index 5cbde45..4cd115c 100644
--- a/libfreerdp/codec/planar.c
+++ b/libfreerdp/codec/planar.c
@@ -565,9 +565,13 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
 
 	if (!rle) /* RAW */
 	{
+		UINT32 base = planeSize * 3;
+		if (cs)
+			base = planeSize + planeSize / 2;
+
 		if (alpha)
 		{
-			if ((SrcSize - (srcp - pSrcData)) < (planeSize * 4))
+			if ((SrcSize - (srcp - pSrcData)) < (planeSize + base))
 				return FALSE;
 
 			planes[3] = srcp;                    /* AlphaPlane */
@@ -580,7 +584,7 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
 		}
 		else
 		{
-			if ((SrcSize - (srcp - pSrcData)) < (planeSize * 3))
+			if ((SrcSize - (srcp - pSrcData)) < base)
 				return FALSE;
 
 			planes[0] = srcp;                    /* LumaOrRedPlane */
@@ -732,8 +736,9 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
 			rleBuffer[2] = rleBuffer[1] + planeSize; /* GreenChromaOrBluePlane */
 			if (useAlpha)
 			{
-				status = planar_decompress_plane_rle_only(planes[3], rleSizes[3], rleBuffer[3],
-				                                          nSrcWidth, nSrcHeight); /* AlphaPlane */
+				status =
+				    planar_decompress_plane_rle_only(planes[3], rleSizes[3], rleBuffer[3],
+				                                     rawWidths[3], rawHeights[3]); /* AlphaPlane */
 
 				if (status < 0)
 					return FALSE;
@@ -743,20 +748,21 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
 				srcp += rleSizes[3];
 
 			status = planar_decompress_plane_rle_only(planes[0], rleSizes[0], rleBuffer[0],
-			                                          nSrcWidth, nSrcHeight); /* LumaPlane */
+			                                          rawWidths[0], rawHeights[0]); /* LumaPlane */
 
 			if (status < 0)
 				return FALSE;
 
 			status =
-			    planar_decompress_plane_rle_only(planes[1], rleSizes[1], rleBuffer[1], nSrcWidth,
-			                                     nSrcHeight); /* OrangeChromaPlane */
+			    planar_decompress_plane_rle_only(planes[1], rleSizes[1], rleBuffer[1], rawWidths[1],
+			                                     rawHeights[1]); /* OrangeChromaPlane */
 
 			if (status < 0)
 				return FALSE;
 
-			status = planar_decompress_plane_rle_only(planes[2], rleSizes[2], rleBuffer[2],
-			                                          nSrcWidth, nSrcHeight); /* GreenChromaPlane */
+			status =
+			    planar_decompress_plane_rle_only(planes[2], rleSizes[2], rleBuffer[2], rawWidths[2],
+			                                     rawHeights[2]); /* GreenChromaPlane */
 
 			if (status < 0)
 				return FALSE;
@@ -764,7 +770,7 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
 			*planes = *rleBuffer;
 		}
 
-		if (!rle) /* RAW */
+		/* RAW */
 		{
 			if (cs)
 			{ /* Chroma subsampling for Co and Cg:
@@ -822,7 +828,7 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
 			return FALSE;
 	}
 
-	return (SrcSize == (srcp - pSrcData)) ? TRUE : FALSE;
+	return TRUE;
 }
 
 static INLINE BOOL freerdp_split_color_planes(const BYTE* data, UINT32 format, UINT32 width,
-- 
2.7.4