mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-26 00:11:04 +00:00
Code Issues Projects Releases Wiki Activity

freerdp3: patch CVE-2026-55192

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55192

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 10:13:43 +05:30
committed by Anuj Mittal
parent e383fd8d1a
commit e555fd3307
2 changed files with 80 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55192.patch
+79
View File
@@ -0,0 +1,79 @@
From 4a8f7a9109a0a2d7c388102d7ad7816d932841c7 Mon Sep 17 00:00:00 2001
From: Armin Novak <armin.novak@thincast.com>
Date: Thu, 11 Jun 2026 08:47:30 +0200
Subject: [PATCH] [codec,h264] ensure decoded frame size matches expectations
(cherry picked from commit 0cd45b70bb1fe6befd258ff64c46461947e99adb)
CVE: CVE-2026-55192
Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/0cd45b70bb1fe6befd258ff64c46461947e99adb]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libfreerdp/codec/h264_ffmpeg.c | 4 ++++
libfreerdp/codec/h264_mediacodec.c | 5 +++++
libfreerdp/codec/h264_mf.c | 4 ++++
libfreerdp/codec/h264_openh264.c | 4 ++++
4 files changed, 17 insertions(+)
diff --git a/libfreerdp/codec/h264_ffmpeg.c b/libfreerdp/codec/h264_ffmpeg.c
index 98b8b5e66..5f5e534fa 100644
--- a/libfreerdp/codec/h264_ffmpeg.c
+++ b/libfreerdp/codec/h264_ffmpeg.c
@@ -359,6 +359,10 @@ static int libavcodec_decompress(H264_CONTEXT* WINPR_RESTRICT h264,
iStride[1] = (UINT32)MAX(0, sys->videoFrame->linesize[1]);
iStride[2] = (UINT32)MAX(0, sys->videoFrame->linesize[2]);
+ if (sys->videoFrame->width < WINPR_ASSERTING_INT_CAST(int64_t, h264->width))
+ goto fail;
+ if (sys->videoFrame->height < WINPR_ASSERTING_INT_CAST(int64_t, h264->height))
+ goto fail;
rc = 1;
}
else
diff --git a/libfreerdp/codec/h264_mediacodec.c b/libfreerdp/codec/h264_mediacodec.c
index ee84f6b84..9e57969ee 100644
--- a/libfreerdp/codec/h264_mediacodec.c
+++ b/libfreerdp/codec/h264_mediacodec.c
@@ -360,6 +360,11 @@ static int mediacodec_decompress(H264_CONTEXT* h264, const BYTE* pSrcData, UINT3
pYUVData[1] = outputBuffer + iStride[0] * sys->outputHeight;
pYUVData[2] = outputBuffer + iStride[0] * sys->outputHeight +
iStride[1] * ((sys->outputHeight + 1) / 2);
+
+ if (sys->outputWidth < h264->width)
+ goto fail;
+ if (sys->outputHeigth < h264->height)
+ goto fail;
break;
}
else if (outputBufferId == AMEDIACODEC_INFO_OUTPUT_FORMAT_CHANGED)
diff --git a/libfreerdp/codec/h264_mf.c b/libfreerdp/codec/h264_mf.c
index ca2eaca68..446f08d5e 100644
--- a/libfreerdp/codec/h264_mf.c
+++ b/libfreerdp/codec/h264_mf.c
@@ -370,6 +370,10 @@ static int mf_decompress(H264_CONTEXT* h264, const BYTE* pSrcData, UINT32 SrcSiz
}
outputBuffer->lpVtbl->Release(outputBuffer);
+ if (sys->frameWidth < h264->width)
+ goto error;
+ if (sys->frameHeigth < h264->height)
+ goto error;
}
inputSample->lpVtbl->Release(inputSample);
diff --git a/libfreerdp/codec/h264_openh264.c b/libfreerdp/codec/h264_openh264.c
index eb8c71310..f4a7e47f0 100644
--- a/libfreerdp/codec/h264_openh264.c
+++ b/libfreerdp/codec/h264_openh264.c
@@ -177,6 +177,10 @@ static int openh264_decompress(H264_CONTEXT* WINPR_RESTRICT h264,
if (!pYUVData[0] || !pYUVData[1] || !pYUVData[2])
return -2005;
+ if (pSystemBuffer->iWidth < WINPR_ASSERTING_INT_CAST(int64_t, h264->width))
+ return -2006;
+ if (pSystemBuffer->iHeight < WINPR_ASSERTING_INT_CAST(int64_t, h264->height))
+ return -2007;
return 1;
}
meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+1
View File
@@ -14,6 +14,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
file://CVE-2026-40254-1.patch \
file://CVE-2026-40254-2.patch \
file://CVE-2026-55191.patch \
file://CVE-2026-55192.patch \
"