freerdp3: fix CVE-2026-33984

Detaisl: https://nvd.nist.gov/vuln/detail/CVE-2026-33984

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-04-09 19:09:16 +12:00
committed by Anuj Mittal
parent 262e656885
commit 6d5a42a5e0
2 changed files with 35 additions and 0 deletions
@@ -0,0 +1,34 @@
From d714759fc45ccf9ff179b912dd1714d0b4f2c5bc Mon Sep 17 00:00:00 2001
From: Armin Novak <armin.novak@thincast.com>
Date: Wed, 25 Mar 2026 09:48:54 +0100
Subject: [PATCH] [codec,clear] update CLEAR_VBAR_ENTRY::size after alloc
(cherry picked from commit dc7fdb165095139be779a4000199bc1706b06ad5)
CVE: CVE-2026-33984
Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/dc7fdb165095139be779a4000199bc1706b06ad5]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libfreerdp/codec/clear.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
index 512aeae20..d94536986 100644
--- a/libfreerdp/codec/clear.c
+++ b/libfreerdp/codec/clear.c
@@ -553,7 +553,6 @@ static BOOL resize_vbar_entry(CLEAR_CONTEXT* clear, CLEAR_VBAR_ENTRY* vBarEntry)
const UINT32 oldPos = vBarEntry->size * bpp;
const UINT32 diffSize = (vBarEntry->count - vBarEntry->size) * bpp;
- vBarEntry->size = vBarEntry->count;
BYTE* tmp =
(BYTE*)winpr_aligned_recalloc(vBarEntry->pixels, vBarEntry->count, 1ull * bpp, 32);
@@ -566,6 +565,7 @@ static BOOL resize_vbar_entry(CLEAR_CONTEXT* clear, CLEAR_VBAR_ENTRY* vBarEntry)
memset(&tmp[oldPos], 0, diffSize);
vBarEntry->pixels = tmp;
+ vBarEntry->size = vBarEntry->count;
}
if (!vBarEntry->pixels && vBarEntry->size)
@@ -36,6 +36,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;branch=master;protocol=https \
file://CVE-2026-29776.patch \
file://CVE-2026-31806.patch \
file://CVE-2026-31897.patch \
file://CVE-2026-33984.patch \
"
S = "${WORKDIR}/git"