mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-27 12:40:19 +00:00
Code Issues Projects Releases Wiki Activity

freerdp3: patch CVE-2026-40254

Browse Source 
Backport commits matching advisory[1] mentioned in the NVD.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-40254

[1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3xpj-m4hx-8vmx

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 10:13:43 +05:30
committed by Anuj Mittal
parent 7ce36bf1cc
commit 6a620760be
3 changed files with 80 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-1.patch
+46
View File
@@ -0,0 +1,46 @@
From 11b850f6181cb607c7fa4ac7a4fa09d203e0aaf6 Mon Sep 17 00:00:00 2001
From: Armin Novak <armin.novak@thincast.com>
Date: Fri, 10 Apr 2026 08:45:55 +0200
Subject: [PATCH] [channels,drive] refine bounds checks
* better logging, fix wrong path component printed
* ensure path does not end with path/..
(cherry picked from commit f502dbb8462597fbe5b97f890359dfdecb525bf7)
CVE: CVE-2026-40254
Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/f502dbb8462597fbe5b97f890359dfdecb525bf7]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
channels/drive/client/drive_file.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/channels/drive/client/drive_file.c b/channels/drive/client/drive_file.c
index 8ea7552a7..3d87d8e6b 100644
--- a/channels/drive/client/drive_file.c
+++ b/channels/drive/client/drive_file.c
@@ -113,6 +113,8 @@ static BOOL contains_dotdot(const WCHAR* path, size_t base_length, size_t path_l
if ((tst[2] == '/') || (tst[2] == '\\'))
return TRUE;
}
+ else
+ return TRUE;
}
tst += 2;
} while (TRUE);
@@ -147,11 +149,10 @@ static WCHAR* drive_file_combine_fullpath(const WCHAR* base_path, const WCHAR* p
/* Ensure the path does not contain sequences like '..' */
if (contains_dotdot(&fullpath[base_path_length], base_path_length, PathWCharLength))
{
- char abuffer[MAX_PATH] = WINPR_C_ARRAY_INIT;
- (void)ConvertWCharToUtf8(&fullpath[base_path_length], abuffer, ARRAYSIZE(abuffer));
-
+ char* abuffer = ConvertWCharToUtf8Alloc(&fullpath[base_path_length], nullptr);
WLog_WARN(TAG, "[rdpdr] received invalid file path '%s' from server, aborting!",
- &abuffer[base_path_length]);
+ abuffer);
+ free(abuffer);
goto fail;
}
}
meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-2.patch
+30
View File
@@ -0,0 +1,30 @@
From 3b1f9e5690d60c6a070e40587c5b23e56b172684 Mon Sep 17 00:00:00 2001
From: Sayed Kaif <metsw24@gmail.com>
Date: Sun, 28 Jun 2026 16:55:01 +0530
Subject: [PATCH] [channels,drive] reject trailing '..' in contains_dotdot
The trailing '..' check never fired because PathLength counts the NUL terminator, leaving path_length one WCHAR longer than the string; treat '\0' as a component terminator so a final '..' is rejected like '../'.
(cherry picked from commit 17543c9ae0a72a5413e19741cf0203ab519fb3fd)
CVE: CVE-2026-40254
Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/17543c9ae0a72a5413e19741cf0203ab519fb3fd]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
channels/drive/client/drive_file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/channels/drive/client/drive_file.c b/channels/drive/client/drive_file.c
index 3d87d8e6b..fa93946e2 100644
--- a/channels/drive/client/drive_file.c
+++ b/channels/drive/client/drive_file.c
@@ -110,7 +110,7 @@ static BOOL contains_dotdot(const WCHAR* path, size_t base_length, size_t path_l
{
if (tst + 2 < path + path_length)
{
- if ((tst[2] == '/') || (tst[2] == '\\'))
+ if ((tst[2] == '/') || (tst[2] == '\\') || (tst[2] == '\0'))
return TRUE;
}
else
meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+4 -1
View File
@@ -10,7 +10,10 @@ inherit pkgconfig cmake ptest
SRCREV = "3028b706908f81767d9b9c744a90778c28f57d61"
SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${PV} \
file://run-ptest"
file://run-ptest \
file://CVE-2026-40254-1.patch \
file://CVE-2026-40254-2.patch \
"
CVE_PRODUCT = "freerdp"