coverity: fixed out of bounds read-write

2 files changed, 12 insertions, 3 deletions

diff --git a/rdp/rdp_rdp.c b/rdp/rdp_rdp.c
index 973b8fe9..70155c60 100644
--- a/rdp/rdp_rdp.c
+++ b/rdp/rdp_rdp.c
@@ -427,6 +427,12 @@ rdp_rdp_process_color_pointer_pdu(struct rdp_rdp *self, struct stream *s)
         return 1;
     }
 
+    /* there are only 32 cursors */
+    if (cache_idx > 31)
+    {
+        return 1;
+    }
+
     cursor = self->cursors + cache_idx;
     in_uint16_le(s, cursor->x);
     in_uint16_le(s, cursor->y);
@@ -457,7 +463,7 @@ rdp_rdp_process_cached_pointer_pdu(struct rdp_rdp *self, struct stream *s)
 
     in_uint16_le(s, cache_idx);
 
-    if (cache_idx >= sizeof(self->cursors) / sizeof(cursor))
+    if (cache_idx > 31)
     {
         return 1;
     }
diff --git a/sesman/chansrv/clipboard.c b/sesman/chansrv/clipboard.c
index 6d52da85..310e2093 100644
--- a/sesman/chansrv/clipboard.c
+++ b/sesman/chansrv/clipboard.c
@@ -1048,8 +1048,11 @@ clipboard_process_format_announce(struct stream *s, int clip_msg_status,
         log_debug("clipboard_process_format_announce: formatId 0x%8.8x "
                     "wszFormatName [%s] clip_msg_len %d", formatId, desc,
                     clip_msg_len);
-        g_formatIds[g_num_formatIds] = formatId;
-        g_num_formatIds++;
+        if (g_num_formatIds <= 15)
+        {
+            g_formatIds[g_num_formatIds] = formatId;
+            g_num_formatIds++;
+        }
         if (g_num_formatIds > 15)
         {
             log_debug("clipboard_process_format_announce: max formats");