From e383fd8d1abf9f82c5d3ffd8e7c9a0bf4f8432bf Mon Sep 17 00:00:00 2001
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Date: Wed, 9 Sep 2026 20:31:27 +1200
Subject: [PATCH] freerdp3: patch CVE-2026-55191

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55191

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
---
 .../freerdp/freerdp3/CVE-2026-55191.patch     | 47 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 48 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55191.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55191.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55191.patch
new file mode 100644
index 0000000000..0881d671bf
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55191.patch
@@ -0,0 +1,47 @@
+From 4234cf72c4e9095c163405c4b5c5d41dd4775f81 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Thu, 11 Jun 2026 08:10:58 +0200
+Subject: [PATCH] [codec,h264] fix buffer bounds checks
+
+(cherry picked from commit 97f40b9e766af375f4e41ac6a3f4397d708d249c)
+
+CVE: CVE-2026-55191
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/97f40b9e766af375f4e41ac6a3f4397d708d249c]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/codec/h264.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/libfreerdp/codec/h264.c b/libfreerdp/codec/h264.c
+index 3b837601c..ce7776b40 100644
+--- a/libfreerdp/codec/h264.c
++++ b/libfreerdp/codec/h264.c
+@@ -495,14 +495,24 @@ static BOOL avc444_ensure_buffer(H264_CONTEXT* h264, DWORD nDstHeight)
+ 	if (pad != 0)
+ 		padDstHeight += 16 - pad;
+ 
+-	if ((piMainStride[0] != piDstStride[0]) ||
+-	    (piDstSize[0] != 1ull * piMainStride[0] * padDstHeight))
++	if ((piMainStride[0] == 0) || (padDstHeight == 0))
++		return FALSE;
++
++	const uint64_t dstsize = 1ull * piMainStride[0] * padDstHeight;
++	if (dstsize > UINT32_MAX)
++		return FALSE;
++
++	if ((piMainStride[0] != piDstStride[0]) || (piDstSize[0] != dstsize))
+ 	{
+ 		for (UINT32 x = 0; x < 3; x++)
+ 		{
+ 			piDstStride[x] = piMainStride[0];
+-			piDstSize[x] = piDstStride[x] * padDstHeight;
+ 
++			const uint64_t dstride = 1ull * piDstStride[x] * padDstHeight;
++			if (dstride > UINT32_MAX)
++				return FALSE;
++
++			piDstSize[x] = WINPR_ASSERTING_INT_CAST(UINT32, dstride);
+ 			if (piDstSize[x] == 0)
+ 				return FALSE;
+ 
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index 7164a81e9d..e014196f18 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -13,6 +13,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://run-ptest \
            file://CVE-2026-40254-1.patch \
            file://CVE-2026-40254-2.patch \
+           file://CVE-2026-55191.patch \
 "