fix(pdu): fixes three overflows in pointer.rs and one in bitmap.rs (#410)

crates/ironrdp-fuzzing/src/oracles/mod.rs

@@ -45,7 +45,18 @@ pub fn pdu_decode(data: &[u8]) {
 
     let _ = decode::<fast_path::FastPathHeader>(data);
     let _ = decode::<fast_path::FastPathUpdatePdu<'_>>(data);
+    let _ = fast_path::FastPathUpdate::decode_with_code(data, fast_path::UpdateCode::Orders);
+    let _ = fast_path::FastPathUpdate::decode_with_code(data, fast_path::UpdateCode::Bitmap);
+    let _ = fast_path::FastPathUpdate::decode_with_code(data, fast_path::UpdateCode::Palette);
+    let _ = fast_path::FastPathUpdate::decode_with_code(data, fast_path::UpdateCode::Synchronize);
     let _ = fast_path::FastPathUpdate::decode_with_code(data, fast_path::UpdateCode::SurfaceCommands);
+    let _ = fast_path::FastPathUpdate::decode_with_code(data, fast_path::UpdateCode::HiddenPointer);
+    let _ = fast_path::FastPathUpdate::decode_with_code(data, fast_path::UpdateCode::DefaultPointer);
+    let _ = fast_path::FastPathUpdate::decode_with_code(data, fast_path::UpdateCode::PositionPointer);
+    let _ = fast_path::FastPathUpdate::decode_with_code(data, fast_path::UpdateCode::ColorPointer);
+    let _ = fast_path::FastPathUpdate::decode_with_code(data, fast_path::UpdateCode::CachedPointer);
+    let _ = fast_path::FastPathUpdate::decode_with_code(data, fast_path::UpdateCode::NewPointer);
+    let _ = fast_path::FastPathUpdate::decode_with_code(data, fast_path::UpdateCode::LargePointer);
 
     let _ = decode::<surface_commands::SurfaceCommand<'_>>(data);
     let _ = decode::<surface_commands::SurfaceBitsPdu<'_>>(data);

crates/ironrdp-pdu/src/basic_output/bitmap.rs

@@ -155,6 +155,14 @@ impl<'de> PduDecode<'de> for BitmapData<'de> {
         let (compressed_data_header, buffer_length) = if compression_flags.contains(Compression::BITMAP_COMPRESSION)
             && !compression_flags.contains(Compression::NO_BITMAP_COMPRESSION_HDR)
         {
+            // Check if encoded_bitmap_data_length is at least CompressedDataHeader::ENCODED_SIZE
+            if encoded_bitmap_data_length < CompressedDataHeader::ENCODED_SIZE as u16 {
+                return Err(invalid_message_err!(
+                    "cbCompEncodedBitmapDataLength",
+                    "length is less than CompressedDataHeader::ENCODED_SIZE"
+                ));
+            }
+
             let buffer_length = encoded_bitmap_data_length as usize - CompressedDataHeader::ENCODED_SIZE;
             (Some(CompressedDataHeader::decode(src)?), buffer_length)
         } else {

crates/ironrdp-pdu/src/basic_output/pointer.rs

@@ -66,6 +66,9 @@ impl ColorPointerAttribute<'_> {
         const XOR_MASK_SIZE_FIELD: &str = "lengthXorMask";
 
         let check_mask = |mask: &[u8], field: &'static str| {
+            if pointer_height == 0 {
+                return Err(invalid_message_err!(field, "pointer height cannot be zero"));
+            }
             if large_ptr && (mask.len() > u32::MAX as usize) {
                 return Err(invalid_message_err!(field, "pointer mask is too big for u32 size"));
             }
@@ -130,7 +133,8 @@ impl<'a> PduDecode<'a> for ColorPointerAttribute<'a> {
         let length_and_mask = src.read_u16();
         let length_xor_mask = src.read_u16();
 
-        let expected_masks_size = (length_and_mask + length_xor_mask) as usize;
+        // Convert to usize during the addition to prevent overflow and match expected type
+        let expected_masks_size = (length_and_mask as usize) + (length_xor_mask as usize);
         ensure_size!(in: src, size: expected_masks_size);
 
         let xor_mask = src.read_slice(length_xor_mask as usize);
@@ -287,14 +291,15 @@ impl<'a> PduDecode<'a> for LargePointerAttribute<'a> {
         let hot_spot = Point16::decode(src)?;
         let width = src.read_u16();
         let height = src.read_u16();
-        let length_and_mask = src.read_u32();
-        let length_xor_mask = src.read_u32();
+        // Convert to usize to prevent overflow during addition
+        let length_and_mask = src.read_u32() as usize;
+        let length_xor_mask = src.read_u32() as usize;
 
-        let expected_masks_size = (length_and_mask + length_xor_mask) as usize;
+        let expected_masks_size = length_and_mask + length_xor_mask;
         ensure_size!(in: src, size: expected_masks_size);
 
-        let xor_mask = src.read_slice(length_xor_mask as usize);
-        let and_mask = src.read_slice(length_and_mask as usize);
+        let xor_mask = src.read_slice(length_xor_mask);
+        let and_mask = src.read_slice(length_and_mask);
 
         ColorPointerAttribute::check_masks_alignment(and_mask, xor_mask, height, true)?;