FreeRDP -- Integer overflow in RDPEGFX channel

Bernhard Miklautz reports:

  Integer overflow due to missing input sanitation in rdpegfx channel

All FreeRDP clients are affected

  The input rectangles from the server are not checked against local
  surface coordinates and blindly accepted. A malicious server can send
  data that will crash the client later on (invalid length arguments to
  a memcpy)