freerdp3: fix CVE-2026-24682

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-24682

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-04-09 19:09:09 +12:00
committed by Anuj Mittal
parent 799cfe0cfa
commit 2beb2f81e7
2 changed files with 32 additions and 0 deletions
@@ -0,0 +1,31 @@
From 603f5b79dc142626baed8df6b9abb23d390dfc4e Mon Sep 17 00:00:00 2001
From: akallabeth <akallabeth@posteo.net>
Date: Mon, 26 Jan 2026 10:14:08 +0100
Subject: [PATCH] [channels,audin] fix audin_server_recv_formats cleanup
(cherry picked from commit 1c5c74223179d425a1ce6dbbb6a3dd2a958b7aee)
CVE: CVE-2026-24682
Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/1c5c74223179d425a1ce6dbbb6a3dd2a958b7aee]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
channels/audin/server/audin.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/channels/audin/server/audin.c b/channels/audin/server/audin.c
index d67937ab7..f0bf96464 100644
--- a/channels/audin/server/audin.c
+++ b/channels/audin/server/audin.c
@@ -128,11 +128,7 @@ static UINT audin_server_recv_formats(audin_server_context* context, wStream* s,
AUDIO_FORMAT* format = &pdu.SoundFormats[i];
if (!audio_format_read(s, format))
- {
- WLog_Print(audin->log, WLOG_ERROR, "Failed to read audio format");
- audio_formats_free(pdu.SoundFormats, i + i);
- return ERROR_INVALID_DATA;
- }
+ goto fail;
audio_format_print(audin->log, WLOG_DEBUG, format);
}
@@ -29,6 +29,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;branch=master;protocol=https \
file://CVE-2026-24679.patch \
file://CVE-2026-24680_CVE-2026-27950.patch \
file://CVE-2026-24681.patch \
file://CVE-2026-24682.patch \
"
S = "${WORKDIR}/git"