freerdp3: patch CVE-2026-85089

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-85089

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85089-1.patch

@@ -0,0 +1,28 @@
+From 2ccd047f64930ae10518ea14f476b2f311218814 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Thu, 13 Aug 2026 11:23:46 +0200
+Subject: [PATCH] [core,info] write zero to info data padding
+
+(cherry picked from commit 056cede398d71c1f2540baebc26ec3327a249301)
+
+CVE: CVE-2026-85089
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/056cede398d71c1f2540baebc26ec3327a249301]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/core/info.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libfreerdp/core/info.c b/libfreerdp/core/info.c
+index a11cc12ff..003bec52a 100644
+--- a/libfreerdp/core/info.c
++++ b/libfreerdp/core/info.c
+@@ -1495,7 +1495,7 @@ static BOOL rdp_write_logon_info_plain(wStream* s)
+ 	if (!Stream_EnsureRemainingCapacity(s, 576))
+ 		return FALSE;
+ 
+-	Stream_Seek(s, 576);
++	Stream_Zero(s, 576);
+ 	return TRUE;
+ }
+ 

meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85089-2.patch

@@ -0,0 +1,28 @@
+From 1228a148cb3754a78b8c40737e14d0be5030a382 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Thu, 13 Aug 2026 11:24:02 +0200
+Subject: [PATCH] [winpr,utils] initialize wStream buffer with zero
+
+(cherry picked from commit 483c9388119f06bac420d92053cff9ef94e83bea)
+
+CVE: CVE-2026-85089
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/483c9388119f06bac420d92053cff9ef94e83bea]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ winpr/libwinpr/utils/stream.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/winpr/libwinpr/utils/stream.c b/winpr/libwinpr/utils/stream.c
+index c0beba7fc..224459584 100644
+--- a/winpr/libwinpr/utils/stream.c
++++ b/winpr/libwinpr/utils/stream.c
+@@ -98,7 +98,7 @@ wStream* Stream_New(BYTE* buffer, size_t size)
+ 	if (buffer)
+ 		s->buffer = buffer;
+ 	else
+-		s->buffer = (BYTE*)malloc(size);
++		s->buffer = (BYTE*)calloc(size, sizeof(BYTE));
+ 
+ 	if (!s->buffer)
+ 	{

meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb

@@ -25,6 +25,8 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-64621.patch \
            file://CVE-2026-66401.patch \
            file://CVE-2026-67288.patch \
+           file://CVE-2026-85089-1.patch \
+           file://CVE-2026-85089-2.patch \
 "