https://github.com/FreeRDP/FreeRDP/commit/80adde17ddc4b596ed1dae0922a0c54ab3d4b8ea CVE: CVE-2022-39318 CVE-2022-39319 Upstream-Status: Backport Signed-off-by: Lee Chee Yang From 80adde17ddc4b596ed1dae0922a0c54ab3d4b8ea Mon Sep 17 00:00:00 2001 From: akallabeth Date: Thu, 13 Oct 2022 08:27:41 +0200 Subject: [PATCH] Fixed division by zero in urbdrc (cherry picked from commit 731f8419d04b481d7160de1f34062d630ed48765) --- channels/urbdrc/client/libusb/libusb_udevice.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c index 505c31d7b55..ef87f195f38 100644 --- a/channels/urbdrc/client/libusb/libusb_udevice.c +++ b/channels/urbdrc/client/libusb/libusb_udevice.c @@ -1221,12 +1221,18 @@ static int libusb_udev_isoch_transfer(IUDEVICE* idev, URBDRC_CHANNEL_CALLBACK* c if (!Buffer) Stream_Seek(user_data->data, (NumberOfPackets * 12)); - iso_packet_size = BufferSize / NumberOfPackets; - iso_transfer = libusb_alloc_transfer(NumberOfPackets); + if (NumberOfPackets > 0) + { + iso_packet_size = BufferSize / NumberOfPackets; + iso_transfer = libusb_alloc_transfer((int)NumberOfPackets); + } if (iso_transfer == NULL) { - WLog_Print(urbdrc->log, WLOG_ERROR, "Error: libusb_alloc_transfer."); + WLog_Print(urbdrc->log, WLOG_ERROR, + "Error: libusb_alloc_transfer [NumberOfPackets=%" PRIu32 ", BufferSize=%" PRIu32 + " ]", + NumberOfPackets, BufferSize); async_transfer_user_data_free(user_data); return -1; }