mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-15 18:27:12 +00:00
Code Issues Projects Releases Wiki Activity

freerdp3: patch CVE-2026-85090

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-85090

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and Anuj Mittal committed 2026-10-06 09:51:00 +05:30
1 parent 031ea834e5
commit d1446eb906
2 files changed
+60
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85090.patch
+59
View File
@@ -0,0 +1,59 @@
From 22476c6898945934fb86b1672a372894fb68a111 Mon Sep 17 00:00:00 2001
From: Armin Novak <armin.novak@thincast.com>
Date: Thu, 13 Aug 2026 16:09:28 +0200
Subject: [PATCH] [primitives,yuv444] limit data read to actual height
(cherry picked from commit d0a481cb74ab57bca24791fe11b89464a332d3f1)
CVE: CVE-2026-85090
Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/d0a481cb74ab57bca24791fe11b89464a332d3f1]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libfreerdp/primitives/neon/prim_YUV_neon.c | 3 ++-
libfreerdp/primitives/prim_YUV.c | 3 ++-
libfreerdp/primitives/sse/prim_YUV_sse4.1.c | 3 ++-
3 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/libfreerdp/primitives/neon/prim_YUV_neon.c b/libfreerdp/primitives/neon/prim_YUV_neon.c
index f44016cda..3e74c7ea1 100644
--- a/libfreerdp/primitives/neon/prim_YUV_neon.c
+++ b/libfreerdp/primitives/neon/prim_YUV_neon.c
@@ -668,7 +668,8 @@ static pstatus_t neon_ChromaV1ToYUV444(const BYTE* WINPR_RESTRICT pSrcRaw[3],
pX = pDst[2] + dstStep[2] * pos;
}
- memcpy(pX, Ya, nWidth);
+ if (y < nHeight)
+ memcpy(pX, Ya, nWidth);
}
/* B6 and B7 */
diff --git a/libfreerdp/primitives/prim_YUV.c b/libfreerdp/primitives/prim_YUV.c
index 65a5a8dd6..0db8c0e68 100644
--- a/libfreerdp/primitives/prim_YUV.c
+++ b/libfreerdp/primitives/prim_YUV.c
@@ -146,7 +146,8 @@ static inline pstatus_t general_ChromaV1ToYUV444(const BYTE* WINPR_RESTRICT pSrc
pX = pDst[2] + dstStep[2] * pos;
}
- memcpy(pX, Ya, nWidth);
+ if (y < nHeight)
+ memcpy(pX, Ya, nWidth);
}
/* B6 and B7 */
diff --git a/libfreerdp/primitives/sse/prim_YUV_sse4.1.c b/libfreerdp/primitives/sse/prim_YUV_sse4.1.c
index 6fed9945c..9ab1762a8 100644
--- a/libfreerdp/primitives/sse/prim_YUV_sse4.1.c
+++ b/libfreerdp/primitives/sse/prim_YUV_sse4.1.c
@@ -1534,7 +1534,8 @@ static pstatus_t sse41_ChromaV1ToYUV444(const BYTE* WINPR_RESTRICT pSrcRaw[3],
pX = pDst[2] + 1ULL * dstStep[2] * pos;
}
- memcpy(pX, Ya, nWidth);
+ if (y < nHeight)
+ memcpy(pX, Ya, nWidth);
}
/* B6 and B7 */
meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+1
View File
@@ -27,6 +27,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
file://CVE-2026-67288.patch \
file://CVE-2026-85089-1.patch \
file://CVE-2026-85089-2.patch \
file://CVE-2026-85090.patch \
"