From d6868b566a3bdffa381683627b8192ccb83b4bf4 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Wed, 9 Sep 2026 20:31:32 +1200 Subject: [PATCH] freerdp3: patch CVE-2026-55648 Details: https://nvd.nist.gov/vuln/detail/cve-2026-55648 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../freerdp/freerdp3/CVE-2026-55648.patch | 28 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 29 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55648.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55648.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55648.patch new file mode 100644 index 0000000000..ed62b76a94 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55648.patch @@ -0,0 +1,28 @@ +From dbe40963a661a501a227169690c0b3f413514b07 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Sat, 13 Jun 2026 12:14:26 +0200 +Subject: [PATCH] [codec,color] fix source bounds checks + +(cherry picked from commit e4ae473da2926724d9b6329778797a3bdea79eb3) + +CVE: CVE-2026-55648 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/e4ae473da2926724d9b6329778797a3bdea79eb3] + +Signed-off-by: Ankur Tyagi +--- + libfreerdp/codec/color.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libfreerdp/codec/color.c b/libfreerdp/codec/color.c +index 5271cf939..47ef77ab0 100644 +--- a/libfreerdp/codec/color.c ++++ b/libfreerdp/codec/color.c +@@ -451,7 +451,7 @@ BOOL freerdp_image_copy_from_icon_data(BYTE* WINPR_RESTRICT pDstData, UINT32 Dst + } + + /* Ensure we have enough source data bytes for image copy. */ +- if (cbBitsColor < nWidth * nHeight * FreeRDPGetBytesPerPixel(format)) ++ if (cbBitsColor / nHeight < FreeRDPGetBytesPerPixel(format) * nWidth) + { + WLog_ERR(TAG, + "cbBitsColor{%" PRIu32 "} < nWidth{%" PRIu32 "} * nHeight{%" PRIu32 diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index 3e891f40d6..4ae18651d4 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -18,6 +18,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-55193.patch \ file://CVE-2026-55194.patch \ file://CVE-2026-55564.patch \ + file://CVE-2026-55648.patch \ "