/**

 * FreeRDP: A Remote Desktop Protocol Implementation

 * Update Data PDUs

 *

 * Copyright 2011 Marc-Andre Moreau <marcandre.moreau@gmail.com>

 * Copyright 2016 Armin Novak <armin.novak@thincast.com>

 * Copyright 2016 Thincast Technologies GmbH

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

#ifdef HAVE_CONFIG_H

#include "config.h"

#endif

#include <winpr/crt.h>

#include <winpr/print.h>

#include <winpr/synch.h>

#include <winpr/thread.h>

#include <winpr/collections.h>

#include "update.h"

#include "surface.h"

#include "message.h"

#include "info.h"

#include "window.h"

#include <freerdp/log.h>

#include <freerdp/peer.h>

#include <freerdp/codec/bitmap.h>

#include "../cache/pointer.h"

#include "../cache/palette.h"

#include "../cache/bitmap.h"

#define TAG FREERDP_TAG("core.update")

static const char* const UPDATE_TYPE_STRINGS[] = { "Orders", "Bitmap", "Palette", "Synchronize" };

static const char* update_type_to_string(UINT16 updateType)

{

	if (updateType >= ARRAYSIZE(UPDATE_TYPE_STRINGS))

		return "UNKNOWN";

	return UPDATE_TYPE_STRINGS[updateType];

}

static BOOL update_recv_orders(rdpUpdate* update, wStream* s)

{

	UINT16 numberOrders;

	if (Stream_GetRemainingLength(s) < 6)

	{

		WLog_ERR(TAG, "Stream_GetRemainingLength(s) < 6");

		return FALSE;

	}

	Stream_Seek_UINT16(s);               /* pad2OctetsA (2 bytes) */

	Stream_Read_UINT16(s, numberOrders); /* numberOrders (2 bytes) */

	Stream_Seek_UINT16(s);               /* pad2OctetsB (2 bytes) */

	while (numberOrders > 0)

	{

		if (!update_recv_order(update, s))

		{

			WLog_ERR(TAG, "update_recv_order() failed");

			return FALSE;

		}

		numberOrders--;

	}

	return TRUE;

}

static BOOL update_read_bitmap_data(rdpUpdate* update, wStream* s, BITMAP_DATA* bitmapData)

{

	WINPR_UNUSED(update);

	if (Stream_GetRemainingLength(s) < 18)

		return FALSE;

	Stream_Read_UINT16(s, bitmapData->destLeft);

	Stream_Read_UINT16(s, bitmapData->destTop);

	Stream_Read_UINT16(s, bitmapData->destRight);

	Stream_Read_UINT16(s, bitmapData->destBottom);

	Stream_Read_UINT16(s, bitmapData->width);

	Stream_Read_UINT16(s, bitmapData->height);

	Stream_Read_UINT16(s, bitmapData->bitsPerPixel);

	Stream_Read_UINT16(s, bitmapData->flags);

	Stream_Read_UINT16(s, bitmapData->bitmapLength);

	if (bitmapData->flags & BITMAP_COMPRESSION)

	{

		if (!(bitmapData->flags & NO_BITMAP_COMPRESSION_HDR))

		{

			if (Stream_GetRemainingLength(s) < 8)

				return FALSE;

			Stream_Read_UINT16(s,

			                   bitmapData->cbCompFirstRowSize); /* cbCompFirstRowSize (2 bytes) */

			Stream_Read_UINT16(s,

			                   bitmapData->cbCompMainBodySize); /* cbCompMainBodySize (2 bytes) */

			Stream_Read_UINT16(s, bitmapData->cbScanWidth);     /* cbScanWidth (2 bytes) */

			Stream_Read_UINT16(s,

			                   bitmapData->cbUncompressedSize); /* cbUncompressedSize (2 bytes) */

			bitmapData->bitmapLength = bitmapData->cbCompMainBodySize;

		}

		bitmapData->compressed = TRUE;

	}

	else

		bitmapData->compressed = FALSE;

	if (Stream_GetRemainingLength(s) < bitmapData->bitmapLength)

		return FALSE;

	if (bitmapData->bitmapLength > 0)

	{

		bitmapData->bitmapDataStream = malloc(bitmapData->bitmapLength);

		if (!bitmapData->bitmapDataStream)

			return FALSE;

		memcpy(bitmapData->bitmapDataStream, Stream_Pointer(s), bitmapData->bitmapLength);

		Stream_Seek(s, bitmapData->bitmapLength);

	}

	return TRUE;

}

static BOOL update_write_bitmap_data(rdpUpdate* update, wStream* s, BITMAP_DATA* bitmapData)

{

	if (!Stream_EnsureRemainingCapacity(s, 64 + bitmapData->bitmapLength))

		return FALSE;

	if (update->autoCalculateBitmapData)

	{

		bitmapData->flags = 0;

		bitmapData->cbCompFirstRowSize = 0;

		if (bitmapData->compressed)

			bitmapData->flags |= BITMAP_COMPRESSION;

		if (update->context->settings->NoBitmapCompressionHeader)

		{

			bitmapData->flags |= NO_BITMAP_COMPRESSION_HDR;

			bitmapData->cbCompMainBodySize = bitmapData->bitmapLength;

		}

	}

	Stream_Write_UINT16(s, bitmapData->destLeft);

	Stream_Write_UINT16(s, bitmapData->destTop);

	Stream_Write_UINT16(s, bitmapData->destRight);

	Stream_Write_UINT16(s, bitmapData->destBottom);

	Stream_Write_UINT16(s, bitmapData->width);

	Stream_Write_UINT16(s, bitmapData->height);

	Stream_Write_UINT16(s, bitmapData->bitsPerPixel);

	Stream_Write_UINT16(s, bitmapData->flags);

	Stream_Write_UINT16(s, bitmapData->bitmapLength);

	if (bitmapData->flags & BITMAP_COMPRESSION)

	{

		if (!(bitmapData->flags & NO_BITMAP_COMPRESSION_HDR))

		{

			Stream_Write_UINT16(s,

			                    bitmapData->cbCompFirstRowSize); /* cbCompFirstRowSize (2 bytes) */

			Stream_Write_UINT16(s,

			                    bitmapData->cbCompMainBodySize); /* cbCompMainBodySize (2 bytes) */

			Stream_Write_UINT16(s, bitmapData->cbScanWidth);     /* cbScanWidth (2 bytes) */

			Stream_Write_UINT16(s,

			                    bitmapData->cbUncompressedSize); /* cbUncompressedSize (2 bytes) */

		}

		Stream_Write(s, bitmapData->bitmapDataStream, bitmapData->bitmapLength);

	}

	else

	{

		Stream_Write(s, bitmapData->bitmapDataStream, bitmapData->bitmapLength);

	}

	return TRUE;

}

BITMAP_UPDATE* update_read_bitmap_update(rdpUpdate* update, wStream* s)

{

	UINT32 i;

	BITMAP_UPDATE* bitmapUpdate = calloc(1, sizeof(BITMAP_UPDATE));

	if (!bitmapUpdate)

		goto fail;

	if (Stream_GetRemainingLength(s) < 2)

		goto fail;

	Stream_Read_UINT16(s, bitmapUpdate->number); /* numberRectangles (2 bytes) */

	WLog_Print(update->log, WLOG_TRACE, "BitmapUpdate: %" PRIu32 "", bitmapUpdate->number);

	if (bitmapUpdate->number > bitmapUpdate->count)

	{

		UINT32 count = bitmapUpdate->number * 2;

		BITMAP_DATA* newdata =

		    (BITMAP_DATA*)realloc(bitmapUpdate->rectangles, sizeof(BITMAP_DATA) * count);

		if (!newdata)

			goto fail;

		bitmapUpdate->rectangles = newdata;

		ZeroMemory(&bitmapUpdate->rectangles[bitmapUpdate->count],

		           sizeof(BITMAP_DATA) * (count - bitmapUpdate->count));

		bitmapUpdate->count = count;

	}

	/* rectangles */

	for (i = 0; i < bitmapUpdate->number; i++)

	{

		if (!update_read_bitmap_data(update, s, &bitmapUpdate->rectangles[i]))

			goto fail;

	}

	return bitmapUpdate;

fail:

	free_bitmap_update(update->context, bitmapUpdate);

	return NULL;

}

static BOOL update_write_bitmap_update(rdpUpdate* update, wStream* s,

                                       const BITMAP_UPDATE* bitmapUpdate)

{

	int i;

	if (!Stream_EnsureRemainingCapacity(s, 32))

		return FALSE;

	Stream_Write_UINT16(s, UPDATE_TYPE_BITMAP);   /* updateType */

	Stream_Write_UINT16(s, bitmapUpdate->number); /* numberRectangles (2 bytes) */

	/* rectangles */

	for (i = 0; i < (int)bitmapUpdate->number; i++)

	{

		if (!update_write_bitmap_data(update, s, &bitmapUpdate->rectangles[i]))

			return FALSE;

	}

	return TRUE;

}

PALETTE_UPDATE* update_read_palette(rdpUpdate* update, wStream* s)

{

	int i;

	PALETTE_ENTRY* entry;

	PALETTE_UPDATE* palette_update = calloc(1, sizeof(PALETTE_UPDATE));

	if (!palette_update)

		goto fail;

	if (Stream_GetRemainingLength(s) < 6)

		goto fail;

	Stream_Seek_UINT16(s);                         /* pad2Octets (2 bytes) */

	Stream_Read_UINT32(s, palette_update->number); /* numberColors (4 bytes), must be set to 256 */

	if (palette_update->number > 256)

		palette_update->number = 256;

	if (Stream_GetRemainingLength(s) < palette_update->number * 3)

		goto fail;

	/* paletteEntries */

	for (i = 0; i < (int)palette_update->number; i++)

	{

		entry = &palette_update->entries[i];

		Stream_Read_UINT8(s, entry->red);

		Stream_Read_UINT8(s, entry->green);

		Stream_Read_UINT8(s, entry->blue);

	}

	return palette_update;

fail:

	free_palette_update(update->context, palette_update);

	return NULL;

}

static BOOL update_read_synchronize(rdpUpdate* update, wStream* s)

{

	WINPR_UNUSED(update);

	return Stream_SafeSeek(s, 2); /* pad2Octets (2 bytes) */

	                              /**

	                               * The Synchronize Update is an artifact from the

	                               * T.128 protocol and should be ignored.

	                               */

}

static BOOL update_read_play_sound(wStream* s, PLAY_SOUND_UPDATE* play_sound)

{

	if (Stream_GetRemainingLength(s) < 8)

		return FALSE;

	Stream_Read_UINT32(s, play_sound->duration);  /* duration (4 bytes) */

	Stream_Read_UINT32(s, play_sound->frequency); /* frequency (4 bytes) */

	return TRUE;

}

BOOL update_recv_play_sound(rdpUpdate* update, wStream* s)

{

	PLAY_SOUND_UPDATE play_sound;

	if (!update_read_play_sound(s, &play_sound))

		return FALSE;

	return IFCALLRESULT(FALSE, update->PlaySound, update->context, &play_sound);

}

POINTER_POSITION_UPDATE* update_read_pointer_position(rdpUpdate* update, wStream* s)

{

	POINTER_POSITION_UPDATE* pointer_position = calloc(1, sizeof(POINTER_POSITION_UPDATE));

	if (!pointer_position)

		goto fail;

	if (Stream_GetRemainingLength(s) < 4)

		goto fail;

	Stream_Read_UINT16(s, pointer_position->xPos); /* xPos (2 bytes) */

	Stream_Read_UINT16(s, pointer_position->yPos); /* yPos (2 bytes) */

	return pointer_position;

fail:

	free_pointer_position_update(update->context, pointer_position);

	return NULL;

}

POINTER_SYSTEM_UPDATE* update_read_pointer_system(rdpUpdate* update, wStream* s)

{

	POINTER_SYSTEM_UPDATE* pointer_system = calloc(1, sizeof(POINTER_SYSTEM_UPDATE));

	if (!pointer_system)

		goto fail;

	if (Stream_GetRemainingLength(s) < 4)

		goto fail;

	Stream_Read_UINT32(s, pointer_system->type); /* systemPointerType (4 bytes) */

	return pointer_system;

fail:

	free_pointer_system_update(update->context, pointer_system);

	return NULL;

}

static BOOL _update_read_pointer_color(wStream* s, POINTER_COLOR_UPDATE* pointer_color, BYTE xorBpp,

                                       UINT32 flags)

{

	BYTE* newMask;

	UINT32 scanlineSize;

	UINT32 max = 32;

	if (flags & LARGE_POINTER_FLAG_96x96)

		max = 96;

	if (!pointer_color)

		goto fail;

	if (Stream_GetRemainingLength(s) < 14)

		goto fail;

	Stream_Read_UINT16(s, pointer_color->cacheIndex); /* cacheIndex (2 bytes) */

	Stream_Read_UINT16(s, pointer_color->xPos);       /* xPos (2 bytes) */

	Stream_Read_UINT16(s, pointer_color->yPos);       /* yPos (2 bytes) */

	/**

	 *  As stated in 2.2.9.1.1.4.4 Color Pointer Update:

	 *  The maximum allowed pointer width/height is 96 pixels if the client indicated support

	 *  for large pointers by setting the LARGE_POINTER_FLAG (0x00000001) in the Large

	 *  Pointer Capability Set (section 2.2.7.2.7). If the LARGE_POINTER_FLAG was not

	 *  set, the maximum allowed pointer width/height is 32 pixels.

	 *

	 *  So we check for a maximum for CVE-2014-0250.

	 */

	Stream_Read_UINT16(s, pointer_color->width);  /* width (2 bytes) */

	Stream_Read_UINT16(s, pointer_color->height); /* height (2 bytes) */

	if ((pointer_color->width > max) || (pointer_color->height > max))

		goto fail;

	Stream_Read_UINT16(s, pointer_color->lengthAndMask); /* lengthAndMask (2 bytes) */

	Stream_Read_UINT16(s, pointer_color->lengthXorMask); /* lengthXorMask (2 bytes) */

	/**

	 * There does not seem to be any documentation on why

	 * xPos / yPos can be larger than width / height

	 * so it is missing in documentation or a bug in implementation

	 * 2.2.9.1.1.4.4 Color Pointer Update (TS_COLORPOINTERATTRIBUTE)

	 */

	if (pointer_color->xPos >= pointer_color->width)

		pointer_color->xPos = 0;

	if (pointer_color->yPos >= pointer_color->height)

		pointer_color->yPos = 0;

	if (pointer_color->lengthXorMask > 0)

	{

		/**

		 * Spec states that:

		 *

		 * xorMaskData (variable): A variable-length array of bytes. Contains the 24-bpp, bottom-up

		 * XOR mask scan-line data. The XOR mask is padded to a 2-byte boundary for each encoded

		 * scan-line. For example, if a 3x3 pixel cursor is being sent, then each scan-line will

		 * consume 10 bytes (3 pixels per scan-line multiplied by 3 bytes per pixel, rounded up to

		 * the next even number of bytes).

		 *

		 * In fact instead of 24-bpp, the bpp parameter is given by the containing packet.

		 */

		if (Stream_GetRemainingLength(s) < pointer_color->lengthXorMask)

			goto fail;

		scanlineSize = (7 + xorBpp * pointer_color->width) / 8;

		scanlineSize = ((scanlineSize + 1) / 2) * 2;

		if (scanlineSize * pointer_color->height != pointer_color->lengthXorMask)

		{

			WLog_ERR(TAG,

			         "invalid lengthXorMask: width=%" PRIu32 " height=%" PRIu32 ", %" PRIu32

			         " instead of %" PRIu32 "",

			         pointer_color->width, pointer_color->height, pointer_color->lengthXorMask,

			         scanlineSize * pointer_color->height);

			goto fail;

		}

		newMask = realloc(pointer_color->xorMaskData, pointer_color->lengthXorMask);

		if (!newMask)

			goto fail;

		pointer_color->xorMaskData = newMask;

		Stream_Read(s, pointer_color->xorMaskData, pointer_color->lengthXorMask);

	}

	if (pointer_color->lengthAndMask > 0)

	{

		/**

		 * andMaskData (variable): A variable-length array of bytes. Contains the 1-bpp, bottom-up

		 * AND mask scan-line data. The AND mask is padded to a 2-byte boundary for each encoded

		 * scan-line. For example, if a 7x7 pixel cursor is being sent, then each scan-line will

		 * consume 2 bytes (7 pixels per scan-line multiplied by 1 bpp, rounded up to the next even

		 * number of bytes).

		 */

		if (Stream_GetRemainingLength(s) < pointer_color->lengthAndMask)

			goto fail;

		scanlineSize = ((7 + pointer_color->width) / 8);

		scanlineSize = ((1 + scanlineSize) / 2) * 2;

		if (scanlineSize * pointer_color->height != pointer_color->lengthAndMask)

		{

			WLog_ERR(TAG, "invalid lengthAndMask: %" PRIu32 " instead of %" PRIu32 "",

			         pointer_color->lengthAndMask, scanlineSize * pointer_color->height);

			goto fail;

		}

		newMask = realloc(pointer_color->andMaskData, pointer_color->lengthAndMask);

		if (!newMask)

			goto fail;

		pointer_color->andMaskData = newMask;

		Stream_Read(s, pointer_color->andMaskData, pointer_color->lengthAndMask);

	}

	if (Stream_GetRemainingLength(s) > 0)

		Stream_Seek_UINT8(s); /* pad (1 byte) */

	return TRUE;

fail:

	return FALSE;

}

POINTER_COLOR_UPDATE* update_read_pointer_color(rdpUpdate* update, wStream* s, BYTE xorBpp)

{

	POINTER_COLOR_UPDATE* pointer_color = calloc(1, sizeof(POINTER_COLOR_UPDATE));

	if (!pointer_color)

		goto fail;

	if (!_update_read_pointer_color(s, pointer_color, xorBpp,

	                                update->context->settings->LargePointerFlag))

		goto fail;

	return pointer_color;

fail:

	free_pointer_color_update(update->context, pointer_color);

	return NULL;

}

static BOOL _update_read_pointer_large(wStream* s, POINTER_LARGE_UPDATE* pointer)

{

	BYTE* newMask;

	UINT32 scanlineSize;

	if (!pointer)

		goto fail;

	if (Stream_GetRemainingLength(s) < 20)

		goto fail;

	Stream_Read_UINT16(s, pointer->xorBpp);

	Stream_Read_UINT16(s, pointer->cacheIndex); /* cacheIndex (2 bytes) */

	Stream_Read_UINT16(s, pointer->hotSpotX);   /* xPos (2 bytes) */

	Stream_Read_UINT16(s, pointer->hotSpotY);   /* yPos (2 bytes) */

	Stream_Read_UINT16(s, pointer->width);  /* width (2 bytes) */

	Stream_Read_UINT16(s, pointer->height); /* height (2 bytes) */

	if ((pointer->width > 384) || (pointer->height > 384))

		goto fail;

	Stream_Read_UINT32(s, pointer->lengthAndMask); /* lengthAndMask (4 bytes) */

	Stream_Read_UINT32(s, pointer->lengthXorMask); /* lengthXorMask (4 bytes) */

	if (pointer->hotSpotX >= pointer->width)

		pointer->hotSpotX = 0;

	if (pointer->hotSpotY >= pointer->height)

		pointer->hotSpotY = 0;

	if (pointer->lengthXorMask > 0)

	{

		/**

		 * Spec states that:

		 *

		 * xorMaskData (variable): A variable-length array of bytes. Contains the 24-bpp, bottom-up

		 * XOR mask scan-line data. The XOR mask is padded to a 2-byte boundary for each encoded

		 * scan-line. For example, if a 3x3 pixel cursor is being sent, then each scan-line will

		 * consume 10 bytes (3 pixels per scan-line multiplied by 3 bytes per pixel, rounded up to

		 * the next even number of bytes).

		 *

		 * In fact instead of 24-bpp, the bpp parameter is given by the containing packet.

		 */

		if (Stream_GetRemainingLength(s) < pointer->lengthXorMask)

			goto fail;

		scanlineSize = (7 + pointer->xorBpp * pointer->width) / 8;

		scanlineSize = ((scanlineSize + 1) / 2) * 2;

		if (scanlineSize * pointer->height != pointer->lengthXorMask)

		{

			WLog_ERR(TAG,

			         "invalid lengthXorMask: width=%" PRIu32 " height=%" PRIu32 ", %" PRIu32

			         " instead of %" PRIu32 "",

			         pointer->width, pointer->height, pointer->lengthXorMask,

			         scanlineSize * pointer->height);

			goto fail;

		}

		newMask = realloc(pointer->xorMaskData, pointer->lengthXorMask);

		if (!newMask)

			goto fail;

		pointer->xorMaskData = newMask;

		Stream_Read(s, pointer->xorMaskData, pointer->lengthXorMask);

	}

	if (pointer->lengthAndMask > 0)

	{

		/**

		 * andMaskData (variable): A variable-length array of bytes. Contains the 1-bpp, bottom-up

		 * AND mask scan-line data. The AND mask is padded to a 2-byte boundary for each encoded

		 * scan-line. For example, if a 7x7 pixel cursor is being sent, then each scan-line will

		 * consume 2 bytes (7 pixels per scan-line multiplied by 1 bpp, rounded up to the next even

		 * number of bytes).

		 */

		if (Stream_GetRemainingLength(s) < pointer->lengthAndMask)

			goto fail;

		scanlineSize = ((7 + pointer->width) / 8);

		scanlineSize = ((1 + scanlineSize) / 2) * 2;

		if (scanlineSize * pointer->height != pointer->lengthAndMask)

		{

			WLog_ERR(TAG, "invalid lengthAndMask: %" PRIu32 " instead of %" PRIu32 "",

			         pointer->lengthAndMask, scanlineSize * pointer->height);

			goto fail;

		}

		newMask = realloc(pointer->andMaskData, pointer->lengthAndMask);

		if (!newMask)

			goto fail;

		pointer->andMaskData = newMask;

		Stream_Read(s, pointer->andMaskData, pointer->lengthAndMask);

	}

	if (Stream_GetRemainingLength(s) > 0)

		Stream_Seek_UINT8(s); /* pad (1 byte) */

	return TRUE;

fail:

	return FALSE;

}

POINTER_LARGE_UPDATE* update_read_pointer_large(rdpUpdate* update, wStream* s)

{

	POINTER_LARGE_UPDATE* pointer = calloc(1, sizeof(POINTER_LARGE_UPDATE));

	if (!pointer)

		goto fail;

	if (!_update_read_pointer_large(s, pointer))

		goto fail;

	return pointer;

fail:

	free_pointer_large_update(update->context, pointer);

	return NULL;

}

POINTER_NEW_UPDATE* update_read_pointer_new(rdpUpdate* update, wStream* s)

{

	POINTER_NEW_UPDATE* pointer_new = calloc(1, sizeof(POINTER_NEW_UPDATE));

	if (!pointer_new)

		goto fail;

	if (Stream_GetRemainingLength(s) < 2)

		goto fail;

	Stream_Read_UINT16(s, pointer_new->xorBpp); /* xorBpp (2 bytes) */

	if ((pointer_new->xorBpp < 1) || (pointer_new->xorBpp > 32))

	{

		WLog_ERR(TAG, "invalid xorBpp %" PRIu32 "", pointer_new->xorBpp);

		goto fail;

	}

	if (!_update_read_pointer_color(s, &pointer_new->colorPtrAttr, pointer_new->xorBpp,

	                                update->context->settings->LargePointerFlag)) /* colorPtrAttr */

		goto fail;

	return pointer_new;

fail:

	free_pointer_new_update(update->context, pointer_new);

	return NULL;

}

POINTER_CACHED_UPDATE* update_read_pointer_cached(rdpUpdate* update, wStream* s)

{

	POINTER_CACHED_UPDATE* pointer = calloc(1, sizeof(POINTER_CACHED_UPDATE));

	if (!pointer)

		goto fail;

	if (Stream_GetRemainingLength(s) < 2)

		goto fail;

	Stream_Read_UINT16(s, pointer->cacheIndex); /* cacheIndex (2 bytes) */

	return pointer;

fail:

	free_pointer_cached_update(update->context, pointer);

	return NULL;

}

BOOL update_recv_pointer(rdpUpdate* update, wStream* s)

{

	BOOL rc = FALSE;

	UINT16 messageType;

	rdpContext* context = update->context;

	rdpPointerUpdate* pointer = update->pointer;

	if (Stream_GetRemainingLength(s) < 2 + 2)

		return FALSE;

	Stream_Read_UINT16(s, messageType); /* messageType (2 bytes) */

	Stream_Seek_UINT16(s);              /* pad2Octets (2 bytes) */

	switch (messageType)

	{

		case PTR_MSG_TYPE_POSITION:

		{

			POINTER_POSITION_UPDATE* pointer_position = update_read_pointer_position(update, s);

			if (pointer_position)

			{

				rc = IFCALLRESULT(FALSE, pointer->PointerPosition, context, pointer_position);

				free_pointer_position_update(context, pointer_position);

			}

		}

		break;

		case PTR_MSG_TYPE_SYSTEM:

		{

			POINTER_SYSTEM_UPDATE* pointer_system = update_read_pointer_system(update, s);

			if (pointer_system)

			{

				rc = IFCALLRESULT(FALSE, pointer->PointerSystem, context, pointer_system);

				free_pointer_system_update(context, pointer_system);

			}

		}

		break;

		case PTR_MSG_TYPE_COLOR:

		{

			POINTER_COLOR_UPDATE* pointer_color = update_read_pointer_color(update, s, 24);

			if (pointer_color)

			{

				rc = IFCALLRESULT(FALSE, pointer->PointerColor, context, pointer_color);

				free_pointer_color_update(context, pointer_color);

			}

		}

		break;

		case PTR_MSG_TYPE_POINTER_LARGE:

		{

			POINTER_LARGE_UPDATE* pointer_large = update_read_pointer_large(update, s);

			if (pointer_large)

			{

				rc = IFCALLRESULT(FALSE, pointer->PointerLarge, context, pointer_large);

				free_pointer_large_update(context, pointer_large);

			}

		}

		break;

		case PTR_MSG_TYPE_POINTER:

		{

			POINTER_NEW_UPDATE* pointer_new = update_read_pointer_new(update, s);

			if (pointer_new)

			{

				rc = IFCALLRESULT(FALSE, pointer->PointerNew, context, pointer_new);

				free_pointer_new_update(context, pointer_new);

			}

		}

		break;

		case PTR_MSG_TYPE_CACHED:

		{

			POINTER_CACHED_UPDATE* pointer_cached = update_read_pointer_cached(update, s);

			if (pointer_cached)

			{

				rc = IFCALLRESULT(FALSE, pointer->PointerCached, context, pointer_cached);

				free_pointer_cached_update(context, pointer_cached);

			}

		}

		break;

		default:

			break;

	}

	return rc;

}

BOOL update_recv(rdpUpdate* update, wStream* s)

{

	BOOL rc = FALSE;

	UINT16 updateType;

	rdpContext* context = update->context;

	if (Stream_GetRemainingLength(s) < 2)

	{

		WLog_ERR(TAG, "Stream_GetRemainingLength(s) < 2");

		return FALSE;

	}

	Stream_Read_UINT16(s, updateType); /* updateType (2 bytes) */

	WLog_Print(update->log, WLOG_TRACE, "%s Update Data PDU", update_type_to_string(updateType));

	if (!update_begin_paint(update))

		goto fail;

	switch (updateType)

	{

		case UPDATE_TYPE_ORDERS:

			rc = update_recv_orders(update, s);

			break;

		case UPDATE_TYPE_BITMAP:

		{

			BITMAP_UPDATE* bitmap_update = update_read_bitmap_update(update, s);

			if (!bitmap_update)

			{

				WLog_ERR(TAG, "UPDATE_TYPE_BITMAP - update_read_bitmap_update() failed");

				goto fail;

			}

			rc = IFCALLRESULT(FALSE, update->BitmapUpdate, context, bitmap_update);

			free_bitmap_update(update->context, bitmap_update);

		}

		break;

		case UPDATE_TYPE_PALETTE:

		{

			PALETTE_UPDATE* palette_update = update_read_palette(update, s);

			if (!palette_update)

			{

				WLog_ERR(TAG, "UPDATE_TYPE_PALETTE - update_read_palette() failed");

				goto fail;

			}

			rc = IFCALLRESULT(FALSE, update->Palette, context, palette_update);

			free_palette_update(context, palette_update);

		}

		break;

		case UPDATE_TYPE_SYNCHRONIZE:

			if (!update_read_synchronize(update, s))

				goto fail;

			rc = IFCALLRESULT(TRUE, update->Synchronize, context);

			break;

		default:

			break;

	}

fail:

	if (!update_end_paint(update))

		rc = FALSE;

	if (!rc)

	{

		WLog_ERR(TAG, "UPDATE_TYPE %s [%" PRIu16 "] failed", update_type_to_string(updateType),

		         updateType);

		return FALSE;

	}

	return TRUE;

}

void update_reset_state(rdpUpdate* update)

{

	rdpPrimaryUpdate* primary = update->primary;

	rdpAltSecUpdate* altsec = update->altsec;

	if (primary->fast_glyph.glyphData.aj)

	{

		free(primary->fast_glyph.glyphData.aj);

		primary->fast_glyph.glyphData.aj = NULL;

	}

	ZeroMemory(&primary->order_info, sizeof(ORDER_INFO));

	ZeroMemory(&primary->dstblt, sizeof(DSTBLT_ORDER));

	ZeroMemory(&primary->patblt, sizeof(PATBLT_ORDER));

	ZeroMemory(&primary->scrblt, sizeof(SCRBLT_ORDER));

	ZeroMemory(&primary->opaque_rect, sizeof(OPAQUE_RECT_ORDER));

	ZeroMemory(&primary->draw_nine_grid, sizeof(DRAW_NINE_GRID_ORDER));

	ZeroMemory(&primary->multi_dstblt, sizeof(MULTI_DSTBLT_ORDER));

	ZeroMemory(&primary->multi_patblt, sizeof(MULTI_PATBLT_ORDER));

	ZeroMemory(&primary->multi_scrblt, sizeof(MULTI_SCRBLT_ORDER));

	ZeroMemory(&primary->multi_opaque_rect, sizeof(MULTI_OPAQUE_RECT_ORDER));

	ZeroMemory(&primary->multi_draw_nine_grid, sizeof(MULTI_DRAW_NINE_GRID_ORDER));

	ZeroMemory(&primary->line_to, sizeof(LINE_TO_ORDER));

	ZeroMemory(&primary->polyline, sizeof(POLYLINE_ORDER));

	ZeroMemory(&primary->memblt, sizeof(MEMBLT_ORDER));

	ZeroMemory(&primary->mem3blt, sizeof(MEM3BLT_ORDER));

	ZeroMemory(&primary->save_bitmap, sizeof(SAVE_BITMAP_ORDER));

	ZeroMemory(&primary->glyph_index, sizeof(GLYPH_INDEX_ORDER));

	ZeroMemory(&primary->fast_index, sizeof(FAST_INDEX_ORDER));

	ZeroMemory(&primary->fast_glyph, sizeof(FAST_GLYPH_ORDER));

	ZeroMemory(&primary->polygon_sc, sizeof(POLYGON_SC_ORDER));

	ZeroMemory(&primary->polygon_cb, sizeof(POLYGON_CB_ORDER));

	ZeroMemory(&primary->ellipse_sc, sizeof(ELLIPSE_SC_ORDER));

	ZeroMemory(&primary->ellipse_cb, sizeof(ELLIPSE_CB_ORDER));

	primary->order_info.orderType = ORDER_TYPE_PATBLT;

	if (!update->initialState)

	{