From df276ba9138607e073a103959c55b5d60b398e74 Mon Sep 17 00:00:00 2001 From: Gyorgy Sarvari Date: Sat, 11 Oct 2025 20:13:32 +0200 Subject: [PATCH] freerdp3: patch CVE-2024-32458 Details: https://nvd.nist.gov/vuln/detail/CVE-2024-32458 Pick the commit that is marked to resolve the related github advisory. Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal --- .../freerdp/freerdp3/CVE-2024-32458.patch | 119 ++++++++++++++++++ .../recipes-support/freerdp/freerdp3_3.4.0.bb | 1 + 2 files changed, 120 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2024-32458.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2024-32458.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2024-32458.patch new file mode 100644 index 0000000000..a9b51221d4 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2024-32458.patch @@ -0,0 +1,119 @@ +From 3033c4d69afbb23f577cf6962314613ef96782fd Mon Sep 17 00:00:00 2001 +From: akallabeth +Date: Tue, 16 Apr 2024 08:42:52 +0200 +Subject: [PATCH] fix missing input length checks + +CVE: CVE-2024-32458 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/9da3f236985207378abe64bc401cecd8566e4542] + +Signed-off-by: Gyorgy Sarvari +--- + libfreerdp/codec/planar.c | 54 +++++++++++++++++++++++++++++---------- + 1 file changed, 40 insertions(+), 14 deletions(-) + +diff --git a/libfreerdp/codec/planar.c b/libfreerdp/codec/planar.c +index 0ec086269..4b51a023e 100644 +--- a/libfreerdp/codec/planar.c ++++ b/libfreerdp/codec/planar.c +@@ -788,18 +788,26 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT + rawHeights[3] = nSrcHeight; + } + ++ const size_t diff = srcp - pSrcData; ++ if (SrcSize < diff) ++ { ++ WLog_ERR(TAG, "Size mismatch %" PRIu32 " < %" PRIuz, SrcSize, diff); ++ return FALSE; ++ } ++ + if (!rle) /* RAW */ + { ++ + UINT32 base = planeSize * 3; + if (cs) + base = planeSize + planeSize / 2; + + if (alpha) + { +- if ((SrcSize - (srcp - pSrcData)) < (planeSize + base)) ++ if ((SrcSize - diff) < (planeSize + base)) + { +- WLog_ERR(TAG, "Alpha plane size mismatch %" PRIu32 " < %" PRIu32, +- SrcSize - (srcp - pSrcData), (planeSize + base)); ++ WLog_ERR(TAG, "Alpha plane size mismatch %" PRIuz " < %" PRIu32, SrcSize - diff, ++ (planeSize + base)); + return FALSE; + } + +@@ -817,10 +825,9 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT + } + else + { +- if ((SrcSize - (srcp - pSrcData)) < base) ++ if ((SrcSize - diff) < base) + { +- WLog_ERR(TAG, "plane size mismatch %" PRIu32 " < %" PRIu32, +- SrcSize - (srcp - pSrcData), base); ++ WLog_ERR(TAG, "plane size mismatch %" PRIu32 " < %" PRIu32, SrcSize - diff, base); + return FALSE; + } + +@@ -841,8 +848,8 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT + if (alpha) + { + planes[3] = srcp; +- rleSizes[3] = planar_skip_plane_rle(planes[3], SrcSize - (planes[3] - pSrcData), +- rawWidths[3], rawHeights[3]); /* AlphaPlane */ ++ rleSizes[3] = planar_skip_plane_rle(planes[3], SrcSize - diff, rawWidths[3], ++ rawHeights[3]); /* AlphaPlane */ + + if (rleSizes[3] < 0) + return FALSE; +@@ -852,22 +859,41 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT + else + planes[0] = srcp; + +- rleSizes[0] = planar_skip_plane_rle(planes[0], SrcSize - (planes[0] - pSrcData), +- rawWidths[0], rawHeights[0]); /* RedPlane */ ++ const size_t diff0 = (planes[0] - pSrcData); ++ if (SrcSize < diff0) ++ { ++ WLog_ERR(TAG, "Size mismatch %" PRIu32 " < %" PRIuz, SrcSize, diff0); ++ return FALSE; ++ } ++ rleSizes[0] = planar_skip_plane_rle(planes[0], SrcSize - diff0, rawWidths[0], ++ rawHeights[0]); /* RedPlane */ + + if (rleSizes[0] < 0) + return FALSE; + + planes[1] = planes[0] + rleSizes[0]; +- rleSizes[1] = planar_skip_plane_rle(planes[1], SrcSize - (planes[1] - pSrcData), +- rawWidths[1], rawHeights[1]); /* GreenPlane */ ++ ++ const size_t diff1 = (planes[1] - pSrcData); ++ if (SrcSize < diff1) ++ { ++ WLog_ERR(TAG, "Size mismatch %" PRIu32 " < %" PRIuz, SrcSize, diff1); ++ return FALSE; ++ } ++ rleSizes[1] = planar_skip_plane_rle(planes[1], SrcSize - diff1, rawWidths[1], ++ rawHeights[1]); /* GreenPlane */ + + if (rleSizes[1] < 1) + return FALSE; + + planes[2] = planes[1] + rleSizes[1]; +- rleSizes[2] = planar_skip_plane_rle(planes[2], SrcSize - (planes[2] - pSrcData), +- rawWidths[2], rawHeights[2]); /* BluePlane */ ++ const size_t diff2 = (planes[2] - pSrcData); ++ if (SrcSize < diff2) ++ { ++ WLog_ERR(TAG, "Size mismatch %" PRIu32 " < %" PRIuz, SrcSize, diff); ++ return FALSE; ++ } ++ rleSizes[2] = planar_skip_plane_rle(planes[2], SrcSize - diff2, rawWidths[2], ++ rawHeights[2]); /* BluePlane */ + + if (rleSizes[2] < 1) + return FALSE; diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb index 19ba893724..8d41063811 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb @@ -11,6 +11,7 @@ SRCREV = "708f3764897e06297469a7b0507b3c9ecc041ad7" SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;branch=master;protocol=https \ file://CVE-2024-32039.patch \ file://CVE-2024-32040.patch \ + file://CVE-2024-32458.patch \ " S = "${WORKDIR}/git"