mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-22 23:10:18 +00:00
Code Issues Projects Releases Wiki Activity

freerdp3: patch CVE-2026-55194

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55194

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 10:13:44 +05:30
committed by Anuj Mittal
parent 1d846e479b
commit 3e87904310
2 changed files with 54 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55194.patch
+53
View File
@@ -0,0 +1,53 @@
From 7e828b919a8394abd86a174c4943299618e128eb Mon Sep 17 00:00:00 2001
From: Armin Novak <armin.novak@thincast.com>
Date: Thu, 11 Jun 2026 08:22:26 +0200
Subject: [PATCH] [core,gateway] ensure buffer size for current write
(cherry picked from commit 9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a)
CVE: CVE-2026-55194
Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libfreerdp/core/gateway/rpc_client.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libfreerdp/core/gateway/rpc_client.c b/libfreerdp/core/gateway/rpc_client.c
index 27f3614f1..59e5781f4 100644
--- a/libfreerdp/core/gateway/rpc_client.c
+++ b/libfreerdp/core/gateway/rpc_client.c
@@ -372,7 +372,6 @@ static int rpc_client_recv_pdu(rdpRpc* rpc, RPC_PDU* pdu)
static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment)
{
int rc = -1;
- RPC_PDU* pdu = nullptr;
size_t StubOffset = 0;
size_t StubLength = 0;
RpcClientCall* call = nullptr;
@@ -382,7 +381,7 @@ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment)
WINPR_ASSERT(rpc->client);
WINPR_ASSERT(fragment);
- pdu = rpc->client->pdu;
+ RPC_PDU* pdu = rpc->client->pdu;
WINPR_ASSERT(pdu);
Stream_SealLength(fragment);
@@ -464,7 +463,7 @@ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment)
{
const rpcconn_response_hdr_t* response =
(const rpcconn_response_hdr_t*)&header.response;
- if (!Stream_EnsureCapacity(pdu->s, response->alloc_hint))
+ if (!Stream_EnsureRemainingCapacity(pdu->s, StubLength))
goto fail;
if (Stream_Length(fragment) < StubOffset + StubLength)
@@ -472,6 +471,7 @@ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment)
if (!Stream_SetPosition(fragment, StubOffset))
goto fail;
+
Stream_Write(pdu->s, Stream_ConstPointer(fragment), StubLength);
rpc->StubFragCount++;
meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+1
View File
@@ -16,6 +16,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
file://CVE-2026-55191.patch \
file://CVE-2026-55192.patch \
file://CVE-2026-55193.patch \
file://CVE-2026-55194.patch \
"