From a8c04cf8d2234419e53d99b21ac8bf848ddaf097 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Wed, 9 Sep 2026 20:31:34 +1200 Subject: [PATCH] freerdp3: patch CVE-2026-63652 Details: https://nvd.nist.gov/vuln/detail/cve-2026-63652 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../freerdp/freerdp3/CVE-2026-63652.patch | 53 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch new file mode 100644 index 0000000000..2e77b09d5e --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch @@ -0,0 +1,53 @@ +From d814e663432dcc8fb485ac91f6106c950d003d9b Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 2 Jul 2026 08:02:29 +0200 +Subject: [PATCH] [channels,rdpsnd] fix free of + RdpsndServerContext::client_formats + +(cherry picked from commit caf653c0ba1c75ec8f298d1baa59770102a5d14c) + +CVE: CVE-2026-63652 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/caf653c0ba1c75ec8f298d1baa59770102a5d14c] + +Signed-off-by: Ankur Tyagi +--- + channels/rdpsnd/server/rdpsnd_main.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/channels/rdpsnd/server/rdpsnd_main.c b/channels/rdpsnd/server/rdpsnd_main.c +index 8322704ff..29778bb2f 100644 +--- a/channels/rdpsnd/server/rdpsnd_main.c ++++ b/channels/rdpsnd/server/rdpsnd_main.c +@@ -181,6 +181,14 @@ static UINT rdpsnd_server_recv_quality_mode(RdpsndServerContext* context, wStrea + return CHANNEL_RC_OK; + } + ++static void rdpsnd_server_client_format_free(RdpsndServerContext* context) ++{ ++ WINPR_ASSERT(context); ++ free(context->client_formats); ++ context->client_formats = nullptr; ++ context->num_client_formats = 0; ++} ++ + /** + * Read Client Audio Formats and Version PDU (2.2.2.2) + * +@@ -260,7 +268,7 @@ static UINT rdpsnd_server_recv_formats(RdpsndServerContext* context, wStream* s) + + return CHANNEL_RC_OK; + out_free: +- free(context->client_formats); ++ rdpsnd_server_client_format_free(context); + return error; + } + +@@ -1140,7 +1148,7 @@ void rdpsnd_server_context_free(RdpsndServerContext* context) + } + + free(context->server_formats); +- free(context->client_formats); ++ rdpsnd_server_client_format_free(context); + free(context->priv); + free(context); + } diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index 054d90718e..86999ffe94 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -20,6 +20,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-55564.patch \ file://CVE-2026-55648.patch \ file://CVE-2026-63633.patch \ + file://CVE-2026-63652.patch \ "