mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-26 00:11:04 +00:00
Code Issues Projects Releases Wiki Activity

freerdp3: patch CVE-2026-67288

Browse Source 
Backport commit matching GitHub advisory[1] also identified by Debian[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-67288

[1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3
[2]https://security-tracker.debian.org/tracker/CVE-2026-67288

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 10:13:48 +05:30
committed by Anuj Mittal
parent 11f2bab405
commit 933d86804a
2 changed files with 70 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch
+69
View File
@@ -0,0 +1,69 @@
From 833cb82a82ff59d916c86ae1ac90b84bf8e86c47 Mon Sep 17 00:00:00 2001
From: Armin Novak <armin.novak@thincast.com>
Date: Thu, 9 Jul 2026 08:34:21 +0200
Subject: [PATCH] [scard] handle nullptr for LookupName
(cherry picked from commit efe40e15d508f9754b7a3af851de4d2a0b1128d8)
CVE: CVE-2026-67288
Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/efe40e15d508f9754b7a3af851de4d2a0b1128d8]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libfreerdp/emu/scard/smartcard_emulate.c | 7 ++++---
winpr/libwinpr/smartcard/smartcard_pcsc.c | 9 +++++----
2 files changed, 9 insertions(+), 7 deletions(-)
diff --git a/libfreerdp/emu/scard/smartcard_emulate.c b/libfreerdp/emu/scard/smartcard_emulate.c
index 0be4c4c5d..25e0ee179 100644
--- a/libfreerdp/emu/scard/smartcard_emulate.c
+++ b/libfreerdp/emu/scard/smartcard_emulate.c
@@ -46,8 +46,8 @@ static size_t g_ReaderNameWLen = 0;
static char* card_id_and_name_a(const UUID* CardIdentifier, LPCSTR LookupName)
{
- WINPR_ASSERT(CardIdentifier);
- WINPR_ASSERT(LookupName);
+ if (!CardIdentifier || !LookupName)
+ return nullptr;
size_t len = strlen(LookupName) + 34;
char* id = malloc(len);
@@ -2264,7 +2264,8 @@ LONG WINAPI Emulate_SCardReadCacheA(SmartcardEmulationContext* smartcard, SCARDC
WINPR_ASSERT(value); /* Must be valid after Emulate_SCardIsValidContext */
char* id = card_id_and_name_a(CardIdentifier, LookupName);
- data = HashTable_GetItemValue(value->cache, id);
+ if (id)
+ data = HashTable_GetItemValue(value->cache, id);
free(id);
if (!data)
diff --git a/winpr/libwinpr/smartcard/smartcard_pcsc.c b/winpr/libwinpr/smartcard/smartcard_pcsc.c
index b5cf85e23..58bea94f1 100644
--- a/winpr/libwinpr/smartcard/smartcard_pcsc.c
+++ b/winpr/libwinpr/smartcard/smartcard_pcsc.c
@@ -2951,8 +2951,8 @@ WINPR_ATTR_NODISCARD static LONG WINAPI PCSC_SCardDlgExtendedError(void)
WINPR_ATTR_NODISCARD
static char* card_id_and_name_a(const UUID* CardIdentifier, LPCSTR LookupName)
{
- WINPR_ASSERT(CardIdentifier);
- WINPR_ASSERT(LookupName);
+ if (!CardIdentifier || !LookupName)
+ return nullptr;
size_t len = strlen(LookupName) + 34;
char* id = malloc(len);
@@ -2991,9 +2991,10 @@ WINPR_ATTR_NODISCARD static LONG WINAPI PCSC_SCardReadCacheA(SCARDCONTEXT hConte
return SCARD_E_INVALID_HANDLE;
char* id = card_id_and_name_a(CardIdentifier, LookupName);
-
- data = HashTable_GetItemValue(ctx->cache, id);
+ if (id)
+ data = HashTable_GetItemValue(ctx->cache, id);
free(id);
+
if (!data)
{
*DataLen = 0;
meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+1
View File
@@ -24,6 +24,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
file://CVE-2026-64620.patch \
file://CVE-2026-64621.patch \
file://CVE-2026-66401.patch \
file://CVE-2026-67288.patch \
"