mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-24 11:40:17 +00:00
Code Issues Projects Releases Wiki Activity

freerdp3: patch CVE-2026-66401

Browse Source 
Backport commit matching GitHub advisory[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-66401

[1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jj2-67pg-j6mg

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 10:13:48 +05:30
committed by Anuj Mittal
parent ee9265dada
commit 11f2bab405
2 changed files with 87 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-66401.patch
+86
View File
@@ -0,0 +1,86 @@
From 60d0c34ad36ea163b5937d1c9ce657d23dac0f1e Mon Sep 17 00:00:00 2001
From: Armin Novak <armin.novak@thincast.com>
Date: Sun, 12 Jul 2026 11:45:50 +0200
Subject: [PATCH] [channels,rdpecam] fix reading of config descriptor
(cherry picked from commit 1d35ecb77e2469cbc29da14c180777eb514d70cd)
CVE: CVE-2026-66401
Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/1d35ecb77e2469cbc29da14c180777eb514d70cd]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
channels/rdpecam/client/v4l/uvc_h264.c | 49 +++++++++++++++++---------
1 file changed, 33 insertions(+), 16 deletions(-)
diff --git a/channels/rdpecam/client/v4l/uvc_h264.c b/channels/rdpecam/client/v4l/uvc_h264.c
index 30f0cf4b4..a3c716478 100644
--- a/channels/rdpecam/client/v4l/uvc_h264.c
+++ b/channels/rdpecam/client/v4l/uvc_h264.c
@@ -23,6 +23,8 @@
* limitations under the License.
*/
+#include <winpr/wtypes.h>
+
#include <sys/ioctl.h>
#include <linux/uvcvideo.h>
@@ -347,26 +349,41 @@ static uint8_t get_guid_unit_id_from_config_descriptor(struct libusb_config_desc
if (interface->bInterfaceClass != LIBUSB_CLASS_VIDEO ||
interface->bInterfaceSubClass != USB_VIDEO_CONTROL)
continue;
+ if (interface->extra_length < 0)
+ continue;
- const uint8_t* ptr = interface->extra;
- while (ptr < interface->extra + interface->extra_length)
+ size_t offset = 0;
+ const size_t extraLen = WINPR_ASSERTING_INT_CAST(size_t, interface->extra_length);
+ while (offset < extraLen)
{
- const xu_descriptor* desc = (const xu_descriptor*)ptr;
- if (desc->bDescriptorType == USB_VIDEO_CONTROL_INTERFACE &&
- desc->bDescriptorSubType == USB_VIDEO_CONTROL_XU_TYPE &&
- memcmp(desc->guidExtensionCode, guid, 16) == 0)
+ const size_t remaining = extraLen - offset;
+ if (remaining < 3)
+ break;
+ const xu_descriptor* desc = (const xu_descriptor*)&interface->extra[offset];
+
+ WINPR_STATIC_ASSERT(sizeof(xu_descriptor) == 16 + 4);
+ const size_t bLength = WINPR_ASSERTING_INT_CAST(size_t, desc->bLength);
+ if ((desc->bLength <= 0) || (bLength > remaining))
+ break;
+
+ if ((desc->bDescriptorType == USB_VIDEO_CONTROL_INTERFACE) &&
+ (desc->bDescriptorSubType == USB_VIDEO_CONTROL_XU_TYPE) &&
+ (bLength >= sizeof(xu_descriptor)))
{
- int8_t unit_id = desc->bUnitID;
-
- WLog_DBG(TAG,
- "For camera %04" PRIx16 ":%04" PRIx16
- " found UVCX H264 UnitID %" PRId8,
- ddesc->idVendor, ddesc->idProduct, unit_id);
- if (unit_id < 0)
- return 0;
- return WINPR_CXX_COMPAT_CAST(uint8_t, unit_id);
+ if (memcmp(desc->guidExtensionCode, guid, 16) == 0)
+ {
+ int8_t unit_id = desc->bUnitID;
+
+ WLog_DBG(TAG,
+ "For camera %04" PRIx16 ":%04" PRIx16
+ " found UVCX H264 UnitID %" PRId8,
+ ddesc->idVendor, ddesc->idProduct, unit_id);
+ if (unit_id < 0)
+ return 0;
+ return WINPR_CXX_COMPAT_CAST(uint8_t, unit_id);
+ }
}
- ptr += desc->bLength;
+ offset += bLength;
}
}
}
meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+1
View File
@@ -23,6 +23,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
file://CVE-2026-63652.patch \
file://CVE-2026-64620.patch \
file://CVE-2026-64621.patch \
file://CVE-2026-66401.patch \
"