/**

 * FreeRDP: A Remote Desktop Protocol Implementation

 * RDP Core

 *

 * Copyright 2011 Marc-Andre Moreau <marcandre.moreau@gmail.com>

 * Copyright 2014 DI (FH) Martin Haimberger <martin.haimberger@thincast.com>

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

#ifdef HAVE_CONFIG_H

#include "config.h"

#endif

#include <winpr/crt.h>

#include "rdp.h"

#include "info.h"

#include "redirection.h"

#include <freerdp/crypto/per.h>

#include <freerdp/log.h>

#define TAG FREERDP_TAG("core.rdp")

const char* DATA_PDU_TYPE_STRINGS[80] =

{

	"?", "?", /* 0x00 - 0x01 */

	"Update", /* 0x02 */

	"?", "?", "?", "?", "?", "?", "?", "?", /* 0x03 - 0x0A */

	"?", "?", "?", "?", "?", "?", "?", "?", "?", /* 0x0B - 0x13 */

	"Control", /* 0x14 */

	"?", "?", "?", "?", "?", "?", /* 0x15 - 0x1A */

	"Pointer", /* 0x1B */

	"Input", /* 0x1C */

	"?", "?", /* 0x1D - 0x1E */

	"Synchronize", /* 0x1F */

	"?", /* 0x20 */

	"Refresh Rect", /* 0x21 */

	"Play Sound", /* 0x22 */

	"Suppress Output", /* 0x23 */

	"Shutdown Request", /* 0x24 */

	"Shutdown Denied", /* 0x25 */

	"Save Session Info", /* 0x26 */

	"Font List", /* 0x27 */

	"Font Map", /* 0x28 */

	"Set Keyboard Indicators", /* 0x29 */

	"?", /* 0x2A */

	"Bitmap Cache Persistent List", /* 0x2B */

	"Bitmap Cache Error", /* 0x2C */

	"Set Keyboard IME Status", /* 0x2D */

	"Offscreen Cache Error", /* 0x2E */

	"Set Error Info", /* 0x2F */

	"Draw Nine Grid Error", /* 0x30 */

	"Draw GDI+ Error", /* 0x31 */

	"ARC Status", /* 0x32 */

	"?", "?", "?", /* 0x33 - 0x35 */

	"Status Info", /* 0x36 */

	"Monitor Layout", /* 0x37 */

	"FrameAcknowledge", "?", "?", /* 0x38 - 0x40 */

	"?", "?", "?", "?", "?", "?" /* 0x41 - 0x46 */

};

/**

 * Read RDP Security Header.\n

 * @msdn{cc240579}

 * @param s stream

 * @param flags security flags

 */

BOOL rdp_read_security_header(wStream* s, UINT16* flags, UINT16* length)

{

	/* Basic Security Header */

	if ((Stream_GetRemainingLength(s) < 4) || (length && (*length < 4)))

		return FALSE;

	Stream_Read_UINT16(s, *flags); /* flags */

	Stream_Seek(s, 2); /* flagsHi (unused) */

	if (length)

		*length -= 4;

	return TRUE;

}

/**

 * Write RDP Security Header.\n

 * @msdn{cc240579}

 * @param s stream

 * @param flags security flags

 */

void rdp_write_security_header(wStream* s, UINT16 flags)

{

	/* Basic Security Header */

	Stream_Write_UINT16(s, flags); /* flags */

	Stream_Write_UINT16(s, 0); /* flagsHi (unused) */

}

BOOL rdp_read_share_control_header(wStream* s, UINT16* length, UINT16* type, UINT16* channel_id)

{

	if (Stream_GetRemainingLength(s) < 2)

		return FALSE;

	/* Share Control Header */

	Stream_Read_UINT16(s, *length); /* totalLength */

	/* If length is 0x8000 then we actually got a flow control PDU that we should ignore

	 http://msdn.microsoft.com/en-us/library/cc240576.aspx */

	if (*length == 0x8000)

	{

		rdp_read_flow_control_pdu(s, type);

		*channel_id = 0;

		*length = 8;	/* Flow control PDU is 8 bytes */

		return TRUE;

	}

	if (((size_t) *length - 2) > Stream_GetRemainingLength(s))

		return FALSE;

	Stream_Read_UINT16(s, *type); /* pduType */

	*type &= 0x0F; /* type is in the 4 least significant bits */

	if (*length > 4)

		Stream_Read_UINT16(s, *channel_id); /* pduSource */

	else

		*channel_id = 0; /* Windows XP can send such short DEACTIVATE_ALL PDUs. */

	return TRUE;

}

void rdp_write_share_control_header(wStream* s, UINT16 length, UINT16 type, UINT16 channel_id)

{

	length -= RDP_PACKET_HEADER_MAX_LENGTH;

	/* Share Control Header */

	Stream_Write_UINT16(s, length); /* totalLength */

	Stream_Write_UINT16(s, type | 0x10); /* pduType */

	Stream_Write_UINT16(s, channel_id); /* pduSource */

}

BOOL rdp_read_share_data_header(wStream* s, UINT16* length, BYTE* type, UINT32* shareId,

                                BYTE* compressedType, UINT16* compressedLength)

{

	if (Stream_GetRemainingLength(s) < 12)

		return FALSE;

	/* Share Data Header */

	Stream_Read_UINT32(s, *shareId); /* shareId (4 bytes) */

	Stream_Seek_UINT8(s); /* pad1 (1 byte) */

	Stream_Seek_UINT8(s); /* streamId (1 byte) */

	Stream_Read_UINT16(s, *length); /* uncompressedLength (2 bytes) */

	Stream_Read_UINT8(s, *type); /* pduType2, Data PDU Type (1 byte) */

	Stream_Read_UINT8(s, *compressedType); /* compressedType (1 byte) */

	Stream_Read_UINT16(s, *compressedLength); /* compressedLength (2 bytes) */

	return TRUE;

}

void rdp_write_share_data_header(wStream* s, UINT16 length, BYTE type, UINT32 share_id)

{

	length -= RDP_PACKET_HEADER_MAX_LENGTH;

	length -= RDP_SHARE_CONTROL_HEADER_LENGTH;

	length -= RDP_SHARE_DATA_HEADER_LENGTH;

	/* Share Data Header */

	Stream_Write_UINT32(s, share_id); /* shareId (4 bytes) */

	Stream_Write_UINT8(s, 0); /* pad1 (1 byte) */

	Stream_Write_UINT8(s, STREAM_LOW); /* streamId (1 byte) */

	Stream_Write_UINT16(s, length); /* uncompressedLength (2 bytes) */

	Stream_Write_UINT8(s, type); /* pduType2, Data PDU Type (1 byte) */

	Stream_Write_UINT8(s, 0); /* compressedType (1 byte) */

	Stream_Write_UINT16(s, 0); /* compressedLength (2 bytes) */

}

static BOOL rdp_security_stream_init(rdpRdp* rdp, wStream* s, BOOL sec_header)

{

	if (!rdp || !s)

		return FALSE;

	if (rdp->do_crypt)

	{

		if (!Stream_SafeSeek(s, 12))

			return FALSE;

		if (rdp->settings->EncryptionMethods == ENCRYPTION_METHOD_FIPS)

		{

			if (!Stream_SafeSeek(s, 4))

				return FALSE;

		}

		rdp->sec_flags |= SEC_ENCRYPT;

		if (rdp->do_secure_checksum)

			rdp->sec_flags |= SEC_SECURE_CHECKSUM;

	}

	else if (rdp->sec_flags != 0 || sec_header)

	{

		if (!Stream_SafeSeek(s, 4))

			return FALSE;

	}

	return TRUE;

}

wStream* rdp_send_stream_init(rdpRdp* rdp)

{

	wStream* s = transport_send_stream_init(rdp->transport, 4096);

	if (!s)

		return NULL;

	if (!Stream_SafeSeek(s, RDP_PACKET_HEADER_MAX_LENGTH))

		goto fail;

	if (!rdp_security_stream_init(rdp, s, FALSE))

		goto fail;

	return s;

fail:

	Stream_Release(s);

	return NULL;

}

wStream* rdp_send_stream_pdu_init(rdpRdp* rdp)

{

	wStream* s = rdp_send_stream_init(rdp);

	if (!s)

		return NULL;

	if (!Stream_SafeSeek(s, RDP_SHARE_CONTROL_HEADER_LENGTH))

		goto fail;

	return s;

fail:

	Stream_Release(s);

	return NULL;

}

wStream* rdp_data_pdu_init(rdpRdp* rdp)

{

	wStream* s = rdp_send_stream_pdu_init(rdp);

	if (!s)

		return NULL;

	if (!Stream_SafeSeek(s, RDP_SHARE_DATA_HEADER_LENGTH))

		goto fail;

	return s;

fail:

	Stream_Release(s);

	return NULL;

}

BOOL rdp_set_error_info(rdpRdp* rdp, UINT32 errorInfo)

{

	rdp->errorInfo = errorInfo;

	if (rdp->errorInfo != ERRINFO_SUCCESS)

	{

		rdpContext* context = rdp->context;

		rdp_print_errinfo(rdp->errorInfo);

		if (context)

		{

			context->LastError = MAKE_FREERDP_ERROR(ERRINFO, errorInfo);

			if (context->pubSub)

			{

				ErrorInfoEventArgs e;

				EventArgsInit(&e, "freerdp");

				e.code = rdp->errorInfo;

				PubSub_OnErrorInfo(context->pubSub, context, &e);

			}

		}

	}

	else

	{

		rdp->context->LastError = FREERDP_ERROR_SUCCESS;

	}

	return TRUE;

}

wStream* rdp_message_channel_pdu_init(rdpRdp* rdp)

{

	wStream* s = transport_send_stream_init(rdp->transport, 4096);

	if (!s)

		return NULL;

	if (!Stream_SafeSeek(s, RDP_PACKET_HEADER_MAX_LENGTH))

		goto fail;

	if (!rdp_security_stream_init(rdp, s, TRUE))

		goto fail;

	return s;

fail:

	Stream_Release(s);

	return NULL;

}

/**

 * Read an RDP packet header.\n

 * @param rdp rdp module

 * @param s stream

 * @param length RDP packet length

 * @param channel_id channel id

 */

BOOL rdp_read_header(rdpRdp* rdp, wStream* s, UINT16* length, UINT16* channelId)

{

	BYTE li;

	BYTE byte;

	BYTE code;

	BYTE choice;

	UINT16 initiator;

	enum DomainMCSPDU MCSPDU;

	enum DomainMCSPDU domainMCSPDU;

	MCSPDU = (rdp->settings->ServerMode) ? DomainMCSPDU_SendDataRequest :

	         DomainMCSPDU_SendDataIndication;

	if (!tpkt_read_header(s, length))

		return FALSE;

	if (!tpdu_read_header(s, &code, &li))

		return FALSE;

	if (code != X224_TPDU_DATA)

	{

		if (code == X224_TPDU_DISCONNECT_REQUEST)

		{

			freerdp_abort_connect(rdp->instance);

			return TRUE;

		}

		return FALSE;

	}

	if (!per_read_choice(s, &choice))

		return FALSE;

	domainMCSPDU = (enum DomainMCSPDU)(choice >> 2);

	if (domainMCSPDU != MCSPDU)

	{

		if (domainMCSPDU != DomainMCSPDU_DisconnectProviderUltimatum)

			return FALSE;

	}

	MCSPDU = domainMCSPDU;

	if (*length < 8)

		return FALSE;

	if ((*length - 8) > Stream_GetRemainingLength(s))

		return FALSE;

	if (MCSPDU == DomainMCSPDU_DisconnectProviderUltimatum)

	{

		int reason = 0;

		TerminateEventArgs e;

		rdpContext* context;

		if (!mcs_recv_disconnect_provider_ultimatum(rdp->mcs, s, &reason))

			return FALSE;

		if (!rdp->instance)

			return FALSE;

		context = rdp->instance->context;

		context->disconnectUltimatum = reason;

		if (rdp->errorInfo == ERRINFO_SUCCESS)

		{

			/**

			 * Some servers like Windows Server 2008 R2 do not send the error info pdu

			 * when the user logs off like they should. Map DisconnectProviderUltimatum

			 * to a ERRINFO_LOGOFF_BY_USER when the errinfo code is ERRINFO_SUCCESS.

			 */

			if (reason == Disconnect_Ultimatum_provider_initiated)

				rdp_set_error_info(rdp, ERRINFO_RPC_INITIATED_DISCONNECT);

			else if (reason == Disconnect_Ultimatum_user_requested)

				rdp_set_error_info(rdp, ERRINFO_LOGOFF_BY_USER);

			else

				rdp_set_error_info(rdp, ERRINFO_RPC_INITIATED_DISCONNECT);

		}

		WLog_DBG(TAG, "DisconnectProviderUltimatum: reason: %d", reason);

		freerdp_abort_connect(rdp->instance);

		EventArgsInit(&e, "freerdp");

		e.code = 0;

		PubSub_OnTerminate(context->pubSub, context, &e);

		return TRUE;

	}

	if (Stream_GetRemainingLength(s) < 5)

		return FALSE;

	if (!per_read_integer16(s, &initiator, MCS_BASE_CHANNEL_ID)) /* initiator (UserId) */

		return FALSE;

	if (!per_read_integer16(s, channelId, 0)) /* channelId */

		return FALSE;

	Stream_Read_UINT8(s, byte); /* dataPriority + Segmentation (0x70) */

	if (!per_read_length(s, length)) /* userData (OCTET_STRING) */

		return FALSE;

	if (*length > Stream_GetRemainingLength(s))

		return FALSE;

	return TRUE;

}

/**

 * Write an RDP packet header.\n

 * @param rdp rdp module

 * @param s stream

 * @param length RDP packet length

 * @param channel_id channel id

 */

void rdp_write_header(rdpRdp* rdp, wStream* s, UINT16 length, UINT16 channelId)

{

	int body_length;

	enum DomainMCSPDU MCSPDU;

	MCSPDU = (rdp->settings->ServerMode) ? DomainMCSPDU_SendDataIndication :

	         DomainMCSPDU_SendDataRequest;

	if ((rdp->sec_flags & SEC_ENCRYPT) && (rdp->settings->EncryptionMethods == ENCRYPTION_METHOD_FIPS))

	{

		int pad;

		body_length = length - RDP_PACKET_HEADER_MAX_LENGTH - 16;

		pad = 8 - (body_length % 8);

		if (pad != 8)

			length += pad;

	}

	mcs_write_domain_mcspdu_header(s, MCSPDU, length, 0);

	per_write_integer16(s, rdp->mcs->userId, MCS_BASE_CHANNEL_ID); /* initiator */

	per_write_integer16(s, channelId, 0); /* channelId */

	Stream_Write_UINT8(s, 0x70); /* dataPriority + segmentation */

	/*

	 * We always encode length in two bytes, even though we could use

	 * only one byte if length <= 0x7F. It is just easier that way,

	 * because we can leave room for fixed-length header, store all

	 * the data first and then store the header.

	 */

	length = (length - RDP_PACKET_HEADER_MAX_LENGTH) | 0x8000;

	Stream_Write_UINT16_BE(s, length); /* userData (OCTET_STRING) */

}

static BOOL rdp_security_stream_out(rdpRdp* rdp, wStream* s, int length, UINT32 sec_flags,

                                    UINT32* pad)

{

	BYTE* data;

	BOOL status;

	sec_flags |= rdp->sec_flags;

	*pad = 0;

	if (sec_flags != 0)

	{

		rdp_write_security_header(s, sec_flags);

		if (sec_flags & SEC_ENCRYPT)

		{

			if (rdp->settings->EncryptionMethods == ENCRYPTION_METHOD_FIPS)

			{

				data = Stream_Pointer(s) + 12;

				length = length - (data - Stream_Buffer(s));

				Stream_Write_UINT16(s, 0x10); /* length */

				Stream_Write_UINT8(s, 0x1); /* TSFIPS_VERSION 1*/

				/* handle padding */

				*pad = 8 - (length % 8);

				if (*pad == 8)

					*pad = 0;

				if (*pad)

					memset(data + length, 0, *pad);

				Stream_Write_UINT8(s, *pad);

				if (!security_hmac_signature(data, length, Stream_Pointer(s), rdp))

					return FALSE;

				Stream_Seek(s, 8);

				security_fips_encrypt(data, length + *pad, rdp);

			}

			else

			{

				data = Stream_Pointer(s) + 8;

				length = length - (data - Stream_Buffer(s));

				if (sec_flags & SEC_SECURE_CHECKSUM)

					status = security_salted_mac_signature(rdp, data, length, TRUE, Stream_Pointer(s));

				else

					status = security_mac_signature(rdp, data, length, Stream_Pointer(s));

				if (!status)

					return FALSE;

				Stream_Seek(s, 8);

				if (!security_encrypt(Stream_Pointer(s), length, rdp))

					return FALSE;

			}

		}

		rdp->sec_flags = 0;

	}

	return TRUE;

}

static UINT32 rdp_get_sec_bytes(rdpRdp* rdp, UINT16 sec_flags)

{

	UINT32 sec_bytes;

	if (rdp->sec_flags & SEC_ENCRYPT)

	{

		sec_bytes = 12;

		if (rdp->settings->EncryptionMethods == ENCRYPTION_METHOD_FIPS)

			sec_bytes += 4;

	}

	else if (rdp->sec_flags != 0 || sec_flags != 0)

	{

		sec_bytes = 4;

	}

	else

	{

		sec_bytes = 0;

	}

	return sec_bytes;

}

/**

 * Send an RDP packet.

 * @param rdp RDP module

 * @param s stream

 * @param channel_id channel id

 */

BOOL rdp_send(rdpRdp* rdp, wStream* s, UINT16 channel_id)

{

	BOOL rc = FALSE;

	UINT32 pad;

	UINT16 length;

	if (!s)

		return FALSE;

	if (!rdp)

		goto fail;

	length = Stream_GetPosition(s);

	Stream_SetPosition(s, 0);

	rdp_write_header(rdp, s, length, channel_id);

	if (!rdp_security_stream_out(rdp, s, length, 0, &pad))

		goto fail;

	length += pad;

	Stream_SetPosition(s, length);

	Stream_SealLength(s);

	if (transport_write(rdp->transport, s) < 0)

		goto fail;

	rc = TRUE;

fail:

	Stream_Release(s);

	return rc;

}

BOOL rdp_send_pdu(rdpRdp* rdp, wStream* s, UINT16 type, UINT16 channel_id)

{

	UINT16 length;

	UINT32 sec_bytes;

	size_t sec_hold;

	UINT32 pad;

	if (!rdp || !s)

		return FALSE;

	length = Stream_GetPosition(s);

	Stream_SetPosition(s, 0);

	rdp_write_header(rdp, s, length, MCS_GLOBAL_CHANNEL_ID);

	sec_bytes = rdp_get_sec_bytes(rdp, 0);

	sec_hold = Stream_GetPosition(s);

	Stream_Seek(s, sec_bytes);

	rdp_write_share_control_header(s, length - sec_bytes, type, channel_id);

	Stream_SetPosition(s, sec_hold);

	if (!rdp_security_stream_out(rdp, s, length, 0, &pad))

		return FALSE;

	length += pad;

	Stream_SetPosition(s, length);

	Stream_SealLength(s);

	if (transport_write(rdp->transport, s) < 0)

		return FALSE;

	return TRUE;

}

BOOL rdp_send_data_pdu(rdpRdp* rdp, wStream* s, BYTE type, UINT16 channel_id)

{

	BOOL rc = FALSE;

	size_t length;

	UINT32 sec_bytes;

	size_t sec_hold;

	UINT32 pad;

	if (!s)

		return FALSE;

	if (!rdp)

		goto fail;

	length = Stream_GetPosition(s);

	Stream_SetPosition(s, 0);

	rdp_write_header(rdp, s, length, MCS_GLOBAL_CHANNEL_ID);

	sec_bytes = rdp_get_sec_bytes(rdp, 0);

	sec_hold = Stream_GetPosition(s);

	Stream_Seek(s, sec_bytes);

	rdp_write_share_control_header(s, length - sec_bytes, PDU_TYPE_DATA, channel_id);

	rdp_write_share_data_header(s, length - sec_bytes, type, rdp->settings->ShareId);

	Stream_SetPosition(s, sec_hold);

	if (!rdp_security_stream_out(rdp, s, length, 0, &pad))

		goto fail;

	length += pad;

	Stream_SetPosition(s, length);

	Stream_SealLength(s);

	WLog_DBG(TAG, "%s: sending data (type=0x%x size=%"PRIuz" channelId=%"PRIu16")", __FUNCTION__,

	         type, Stream_Length(s), channel_id);

	if (transport_write(rdp->transport, s) < 0)

		goto fail;

	rc = TRUE;

fail:

	Stream_Release(s);

	return rc;

}

BOOL rdp_send_message_channel_pdu(rdpRdp* rdp, wStream* s, UINT16 sec_flags)

{

	BOOL rc = FALSE;

	UINT16 length;

	UINT32 pad;

	if (!s)

		return FALSE;

	if (!rdp)

		goto fail;

	length = Stream_GetPosition(s);

	Stream_SetPosition(s, 0);

	rdp_write_header(rdp, s, length, rdp->mcs->messageChannelId);

	if (!rdp_security_stream_out(rdp, s, length, sec_flags, &pad))

		goto fail;

	length += pad;

	Stream_SetPosition(s, length);

	Stream_SealLength(s);

	if (transport_write(rdp->transport, s) < 0)

		goto fail;

	rc = TRUE;

fail:

	Stream_Release(s);

	return rc;

}

static BOOL rdp_recv_server_shutdown_denied_pdu(rdpRdp* rdp, wStream* s)

{

	return TRUE;

}

static BOOL rdp_recv_server_set_keyboard_indicators_pdu(rdpRdp* rdp, wStream* s)

{

	UINT16 unitId;

	UINT16 ledFlags;

	rdpContext* context = rdp->instance->context;

	if (Stream_GetRemainingLength(s) < 4)

		return FALSE;

	Stream_Read_UINT16(s, unitId); /* unitId (2 bytes) */

	Stream_Read_UINT16(s, ledFlags); /* ledFlags (2 bytes) */

	IFCALL(context->update->SetKeyboardIndicators, context, ledFlags);

	return TRUE;

}

static BOOL rdp_recv_server_set_keyboard_ime_status_pdu(rdpRdp* rdp, wStream* s)

{

	UINT16 unitId;

	UINT32 imeState;

	UINT32 imeConvMode;

	if (!rdp || !rdp->input)

		return FALSE;

	if (Stream_GetRemainingLength(s) < 10)

		return FALSE;

	Stream_Read_UINT16(s, unitId); /* unitId (2 bytes) */

	Stream_Read_UINT32(s, imeState); /* imeState (4 bytes) */

	Stream_Read_UINT32(s, imeConvMode); /* imeConvMode (4 bytes) */

	IFCALL(rdp->update->SetKeyboardImeStatus, rdp->context, unitId, imeState, imeConvMode);

	return TRUE;

}

static BOOL rdp_recv_set_error_info_data_pdu(rdpRdp* rdp, wStream* s)

{

	UINT32 errorInfo;

	if (Stream_GetRemainingLength(s) < 4)

		return FALSE;

	Stream_Read_UINT32(s, errorInfo); /* errorInfo (4 bytes) */

	return rdp_set_error_info(rdp, errorInfo);

}

static BOOL rdp_recv_server_auto_reconnect_status_pdu(rdpRdp* rdp, wStream* s)

{

	UINT32 arcStatus;

	if (Stream_GetRemainingLength(s) < 4)

		return FALSE;

	Stream_Read_UINT32(s, arcStatus); /* arcStatus (4 bytes) */

	WLog_WARN(TAG, "AutoReconnectStatus: 0x%08"PRIX32"", arcStatus);

	return TRUE;

}

static BOOL rdp_recv_server_status_info_pdu(rdpRdp* rdp, wStream* s)

{

	UINT32 statusCode;

	if (Stream_GetRemainingLength(s) < 4)

		return FALSE;

	Stream_Read_UINT32(s, statusCode); /* statusCode (4 bytes) */

	return TRUE;

}

static BOOL rdp_recv_monitor_layout_pdu(rdpRdp* rdp, wStream* s)

{

	UINT32 index;

	UINT32 monitorCount;

	MONITOR_DEF* monitor;

	MONITOR_DEF* monitorDefArray;

	BOOL ret = TRUE;

	if (Stream_GetRemainingLength(s) < 4)

		return FALSE;

	Stream_Read_UINT32(s, monitorCount); /* monitorCount (4 bytes) */

	if ((Stream_GetRemainingLength(s) / 20) < monitorCount)

		return FALSE;

	monitorDefArray = (MONITOR_DEF*) calloc(monitorCount, sizeof(MONITOR_DEF));

	if (!monitorDefArray)

		return FALSE;

	for (monitor = monitorDefArray, index = 0; index < monitorCount; index++, monitor++)

	{

		Stream_Read_UINT32(s, monitor->left); /* left (4 bytes) */

		Stream_Read_UINT32(s, monitor->top); /* top (4 bytes) */

		Stream_Read_UINT32(s, monitor->right); /* right (4 bytes) */

		Stream_Read_UINT32(s, monitor->bottom); /* bottom (4 bytes) */

		Stream_Read_UINT32(s, monitor->flags); /* flags (4 bytes) */

	}

	IFCALLRET(rdp->update->RemoteMonitors, ret, rdp->context, monitorCount, monitorDefArray);

	free(monitorDefArray);

	return ret;

}

BOOL rdp_write_monitor_layout_pdu(wStream* s, UINT32 monitorCount,

                                  const rdpMonitor* monitorDefArray)

{

	UINT32 index;

	const rdpMonitor* monitor;

	if (!Stream_EnsureRemainingCapacity(s, 4 + (monitorCount * 20)))

		return FALSE;

	Stream_Write_UINT32(s, monitorCount); /* monitorCount (4 bytes) */

	for (index = 0, monitor = monitorDefArray; index < monitorCount; index++, monitor++)

	{

		Stream_Write_UINT32(s, monitor->x); /* left (4 bytes) */

		Stream_Write_UINT32(s, monitor->y); /* top (4 bytes) */

		Stream_Write_UINT32(s, monitor->x + monitor->width - 1); /* right (4 bytes) */

		Stream_Write_UINT32(s, monitor->y + monitor->height - 1); /* bottom (4 bytes) */

		Stream_Write_UINT32(s, monitor->is_primary ? 0x01 : 0x00); /* flags (4 bytes) */

	}

	return TRUE;

}

int rdp_recv_data_pdu(rdpRdp* rdp, wStream* s)

{

	BYTE type;

	wStream* cs;

	UINT16 length;

	UINT32 shareId;

	BYTE compressedType;

	UINT16 compressedLength;

	if (!rdp_read_share_data_header(s, &length, &type, &shareId, &compressedType, &compressedLength))

	{

		WLog_ERR(TAG, "rdp_read_share_data_header() failed");

		return -1;

	}

	cs = s;

	if (compressedType & PACKET_COMPRESSED)

	{

		UINT32 DstSize = 0;

		BYTE* pDstData = NULL;

		UINT32 SrcSize = compressedLength - 18;

		if (Stream_GetRemainingLength(s) < (size_t) SrcSize)

		{

			WLog_ERR(TAG, "bulk_decompress: not enough bytes for compressedLength %"PRIu16"", compressedLength);

			return -1;

		}

		if (bulk_decompress(rdp->bulk, Stream_Pointer(s), SrcSize, &pDstData, &DstSize, compressedType))

		{

			if (!(cs = StreamPool_Take(rdp->transport->ReceivePool, DstSize)))

			{

				WLog_ERR(TAG, "Couldn't take stream from pool");

				return -1;

			}

			Stream_SetPosition(cs, 0);

			Stream_Write(cs, pDstData, DstSize);

			Stream_SealLength(cs);

			Stream_SetPosition(cs, 0);

		}

		else

		{

			WLog_ERR(TAG, "bulk_decompress() failed");

			return -1;

		}

		Stream_Seek(s, SrcSize);

	}

	WLog_DBG(TAG, "recv %s Data PDU (0x%02"PRIX8"), length: %"PRIu16"",