diff
8  if (!rdp_redirection_get_data(s, pLength, &ptr))
9      return FALSE;
---
8  if (!rdp_redirection_get_data(s, pLength, &ptr) || *pLength > Stream_GetRemainingLength(s))
9      return FALSE;
