Github user mike-jumper commented on a diff in the pull request:
https://github.com/apache/guacamole-server/pull/154#discussion_r175278420
--- Diff: src/protocols/rdp/guac_rdpdr/rdpdr_printer.c ---
@@ -141,18 +143,25 @@ static void
guac_rdpdr_device_printer_announce_handler(guac_rdpdr_device* device
Stream_Write(output_stream, "PRN1\0\0\0\0", 8); /* DOS name */
/* Printer data */
- Stream_Write_UINT32(output_stream, 24 + GUAC_PRINTER_DRIVER_LENGTH +
GUAC_PRINTER_NAME_LENGTH);
+ int settings_length = guac_utf8_strlen(device->device_name);
+ int printer_name_length = (settings_length + 1) * 2;
+ char* printer_name = malloc(printer_name_length);
+ guac_rdp_utf8_to_utf16((const unsigned char*)device->device_name,
+ settings_length, printer_name, printer_name_length);
+ printer_name[printer_name_length - 2] = '\0';
+ printer_name[printer_name_length - 1] = '\0';
+ Stream_Write_UINT32(output_stream, 24 + GUAC_PRINTER_DRIVER_LENGTH +
printer_name_length);
Stream_Write_UINT32(output_stream,
RDPDR_PRINTER_ANNOUNCE_FLAG_DEFAULTPRINTER
| RDPDR_PRINTER_ANNOUNCE_FLAG_NETWORKPRINTER);
Stream_Write_UINT32(output_stream, 0); /* reserved - must be 0 */
Stream_Write_UINT32(output_stream, 0); /* PnPName length (PnPName is
ultimately ignored) */
Stream_Write_UINT32(output_stream, GUAC_PRINTER_DRIVER_LENGTH); /*
DriverName length */
- Stream_Write_UINT32(output_stream, GUAC_PRINTER_NAME_LENGTH); /*
PrinterName length */
+ Stream_Write_UINT32(output_stream, printer_name_length); /*
PrinterName length */
Stream_Write_UINT32(output_stream, 0); /*
CachedFields length */
Stream_Write(output_stream, GUAC_PRINTER_DRIVER,
GUAC_PRINTER_DRIVER_LENGTH);
- Stream_Write(output_stream, GUAC_PRINTER_NAME,
GUAC_PRINTER_NAME_LENGTH);
+ Stream_Write(output_stream, printer_name, printer_name_length);
--- End diff --
We may need to do more with respect to verifying the necessary space is
actually available. Looking into the dynamic allocation of the stream buffer,
we're currently allocating a static 256 bytes to contain all RDPDR devices:
https://github.com/apache/guacamole-server/blob/344ed4f42ea715a2e0e7dfd09867964ecfc320c2/src/protocols/rdp/guac_rdpdr/rdpdr_messages.c#L126
This was sufficient when the length of device names was known and this
length could not possible be exceeded even if both drive and printer were
enabled, but device names are now arbitrary.
Enforcing length limits on device names, truncating the names, etc. would
be one possibility. Dynamically calculating the necessary space would be
another (though more complex).
---
