mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-22 11:00:49 +00:00
Code Issues Projects Releases Wiki Activity

freerdp3: patch CVE-2026-55191

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55191

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 10:13:43 +05:30
committed by Anuj Mittal
parent 6a620760be
commit e383fd8d1a
2 changed files with 48 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55191.patch
+47
View File
@@ -0,0 +1,47 @@
From 4234cf72c4e9095c163405c4b5c5d41dd4775f81 Mon Sep 17 00:00:00 2001
From: Armin Novak <armin.novak@thincast.com>
Date: Thu, 11 Jun 2026 08:10:58 +0200
Subject: [PATCH] [codec,h264] fix buffer bounds checks
(cherry picked from commit 97f40b9e766af375f4e41ac6a3f4397d708d249c)
CVE: CVE-2026-55191
Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/97f40b9e766af375f4e41ac6a3f4397d708d249c]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libfreerdp/codec/h264.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/libfreerdp/codec/h264.c b/libfreerdp/codec/h264.c
index 3b837601c..ce7776b40 100644
--- a/libfreerdp/codec/h264.c
+++ b/libfreerdp/codec/h264.c
@@ -495,14 +495,24 @@ static BOOL avc444_ensure_buffer(H264_CONTEXT* h264, DWORD nDstHeight)
if (pad != 0)
padDstHeight += 16 - pad;
- if ((piMainStride[0] != piDstStride[0]) ||
- (piDstSize[0] != 1ull * piMainStride[0] * padDstHeight))
+ if ((piMainStride[0] == 0) || (padDstHeight == 0))
+ return FALSE;
+
+ const uint64_t dstsize = 1ull * piMainStride[0] * padDstHeight;
+ if (dstsize > UINT32_MAX)
+ return FALSE;
+
+ if ((piMainStride[0] != piDstStride[0]) || (piDstSize[0] != dstsize))
{
for (UINT32 x = 0; x < 3; x++)
{
piDstStride[x] = piMainStride[0];
- piDstSize[x] = piDstStride[x] * padDstHeight;
+ const uint64_t dstride = 1ull * piDstStride[x] * padDstHeight;
+ if (dstride > UINT32_MAX)
+ return FALSE;
+
+ piDstSize[x] = WINPR_ASSERTING_INT_CAST(UINT32, dstride);
if (piDstSize[x] == 0)
return FALSE;
meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+1
View File
@@ -13,6 +13,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
file://run-ptest \
file://CVE-2026-40254-1.patch \
file://CVE-2026-40254-2.patch \
file://CVE-2026-55191.patch \
"