[GUACAMOLE-764] RDPDR file read/write may be truncated to 32 bits

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.2.0
• Component/s: RDP
• Assignee: Unassigned
• Reporter: Mike Jumper
• Created: 23/Mar/19 21:10
• Updated: 02/Feb/21 18:53
• Resolved: 29/Apr/19 02:03

Description

While file sizes are now properly-represented with 64-bit integers (see GUACAMOLE-268), the offset of each read/write is still a simple int. This will limit the location of each read or write to a 32-bit addressable space, thus effectively limiting the size of files transferred to 4 GB:

int guac_rdp_fs_write(guac_rdp_fs* fs, int file_id, int offset,
        void* buffer, int length) {
    ...

    /* Attempt write */
    lseek(file->fd, offset, SEEK_SET);
    bytes_written = write(file->fd, buffer, length);

    ...

See: https://github.com/apache/guacamole-server/blob/67680bd2d51e7949453f0f7ffc7f4234a1136715/src/protocols/rdp/rdp_fs.c#L405-L452

It couldn't hurt to check over the rest of the RDP implementation to see where we might be reading a 64-bit value into an int. Usages of the Stream_Read_UINT64() macro which read into an int will happily truncate the result without any compiler warning due to the type cast included within the macro definition.

Issue Links

• is related to: GUACAMOLE-1112 RDPDR file read/write may be truncated depending on platform
• is related to: GUACAMOLE-1276 RDP file uploads may (still) be truncated to 32 bits
• relates to: GUACAMOLE-268 RDPDR file size may be truncated to 32 bits