Baixingyuu

An out-of-bounds read occurs in the `rdpdr dump packet()` function due to a 32-bit unsigned integer wraparound during buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with the `computerNameLen` variable set to 0xFFFFFFF0 to bypass security checks. This allows memory reads beyond the packet buffer, which can lead to client crashes or the disclosure of heap memory in logs.

An out-of-bounds read occurs in the `func get ep desc()` function within the URBDRC channel. The issue arises because interface arrays are indexed by position rather than by the protocol field `InterfaceNumber`. A malicious RDP server can trigger this by sending a crafted SELECT CONFIGURATION message with permuted `InterfaceNumber` values, allowing the server to read past allocated heap memory and cause the client to crash.