From 7025c461c757336a039408c4635577cc4d724cd5 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Thu, 9 Apr 2026 19:09:13 +1200 Subject: [PATCH] freerdp3: fix CVE-2026-29776 Details: https://nvd.nist.gov/vuln/detail/CVE-2026-29776 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../freerdp/freerdp3/CVE-2026-29776.patch | 30 +++++++++++++++++++ .../recipes-support/freerdp/freerdp3_3.4.0.bb | 1 + 2 files changed, 31 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-29776.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-29776.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-29776.patch new file mode 100644 index 0000000000..0ab2114670 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-29776.patch @@ -0,0 +1,30 @@ +From 145c0c5f048894e4a7d09a4465eab7551f035bb0 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Tue, 3 Mar 2026 13:58:09 +0100 +Subject: [PATCH] [core,orders] improve input validation + +check length before subtracting. Might underflow and be cought by the +next check, but lets be strict. + +(cherry picked from commit a9e0abf2eac8c2e370fa155bf1abb9d044c0ca8a) + +CVE: CVE-2026-29776 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/a9e0abf2eac8c2e370fa155bf1abb9d044c0ca8a] +Signed-off-by: Ankur Tyagi +--- + libfreerdp/core/orders.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/libfreerdp/core/orders.c b/libfreerdp/core/orders.c +index 855b700ac..a9d779418 100644 +--- a/libfreerdp/core/orders.c ++++ b/libfreerdp/core/orders.c +@@ -2214,6 +2214,8 @@ static CACHE_BITMAP_ORDER* update_read_cache_bitmap_order(rdpUpdate* update, wSt + goto fail; + + Stream_Read(s, bitmapComprHdr, 8); /* bitmapComprHdr (8 bytes) */ ++ if (cache_bitmap->bitmapLength < 8) ++ goto fail; + cache_bitmap->bitmapLength -= 8; + } + } diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb index e3d71ee854..74f80ee948 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb @@ -33,6 +33,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;branch=master;protocol=https \ file://CVE-2026-24683.patch \ file://CVE-2026-29774.patch \ file://CVE-2026-29775.patch \ + file://CVE-2026-29776.patch \ " S = "${WORKDIR}/git"