From c426da400707b6f4c3455c8b6c140d9790ac26b7 Mon Sep 17 00:00:00 2001
From: Jay Sorg <jay.sorg@gmail.com>
Date: Tue, 12 Nov 2024 10:55:10 -0800
Subject: [PATCH] openh264 check for room in compressed buffer

---
 xrdp/xrdp_encoder_openh264.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/xrdp/xrdp_encoder_openh264.c b/xrdp/xrdp_encoder_openh264.c
index 18c4164dc..5dcc36b66 100644
--- a/xrdp/xrdp_encoder_openh264.c
+++ b/xrdp/xrdp_encoder_openh264.c
@@ -286,6 +286,11 @@ xrdp_encoder_openh264_encode(void *handle, int session, int left, int top,
                 write_location = cdata + lcdata_bytes;
                 payload = layer->pBsBuf + layer_position;
                 size = layer->pNalLengthInByte[jndex];
+                if (lcdata_bytes + size > *cdata_bytes)
+                {
+                    LOG(LOG_LEVEL_INFO, "out of room");
+                    return 5;
+                }
                 g_memcpy(write_location, payload, size);
                 layer_position += size;
                 lcdata_bytes += size;