From e555fd3307cb92903cd86aba0900dec21a6a0a80 Mon Sep 17 00:00:00 2001
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Date: Wed, 9 Sep 2026 20:31:28 +1200
Subject: [PATCH] freerdp3: patch CVE-2026-55192

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55192

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
---
 .../freerdp/freerdp3/CVE-2026-55192.patch     | 79 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 80 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55192.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55192.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55192.patch
new file mode 100644
index 0000000000..5cb3fe36d5
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55192.patch
@@ -0,0 +1,79 @@
+From 4a8f7a9109a0a2d7c388102d7ad7816d932841c7 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Thu, 11 Jun 2026 08:47:30 +0200
+Subject: [PATCH] [codec,h264] ensure decoded frame size matches expectations
+
+(cherry picked from commit 0cd45b70bb1fe6befd258ff64c46461947e99adb)
+
+CVE: CVE-2026-55192
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/0cd45b70bb1fe6befd258ff64c46461947e99adb]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/codec/h264_ffmpeg.c     | 4 ++++
+ libfreerdp/codec/h264_mediacodec.c | 5 +++++
+ libfreerdp/codec/h264_mf.c         | 4 ++++
+ libfreerdp/codec/h264_openh264.c   | 4 ++++
+ 4 files changed, 17 insertions(+)
+
+diff --git a/libfreerdp/codec/h264_ffmpeg.c b/libfreerdp/codec/h264_ffmpeg.c
+index 98b8b5e66..5f5e534fa 100644
+--- a/libfreerdp/codec/h264_ffmpeg.c
++++ b/libfreerdp/codec/h264_ffmpeg.c
+@@ -359,6 +359,10 @@ static int libavcodec_decompress(H264_CONTEXT* WINPR_RESTRICT h264,
+ 		iStride[1] = (UINT32)MAX(0, sys->videoFrame->linesize[1]);
+ 		iStride[2] = (UINT32)MAX(0, sys->videoFrame->linesize[2]);
+ 
++		if (sys->videoFrame->width < WINPR_ASSERTING_INT_CAST(int64_t, h264->width))
++			goto fail;
++		if (sys->videoFrame->height < WINPR_ASSERTING_INT_CAST(int64_t, h264->height))
++			goto fail;
+ 		rc = 1;
+ 	}
+ 	else
+diff --git a/libfreerdp/codec/h264_mediacodec.c b/libfreerdp/codec/h264_mediacodec.c
+index ee84f6b84..9e57969ee 100644
+--- a/libfreerdp/codec/h264_mediacodec.c
++++ b/libfreerdp/codec/h264_mediacodec.c
+@@ -360,6 +360,11 @@ static int mediacodec_decompress(H264_CONTEXT* h264, const BYTE* pSrcData, UINT3
+ 				pYUVData[1] = outputBuffer + iStride[0] * sys->outputHeight;
+ 				pYUVData[2] = outputBuffer + iStride[0] * sys->outputHeight +
+ 				              iStride[1] * ((sys->outputHeight + 1) / 2);
++
++				if (sys->outputWidth < h264->width)
++					goto fail;
++				if (sys->outputHeigth < h264->height)
++					goto fail;
+ 				break;
+ 			}
+ 			else if (outputBufferId == AMEDIACODEC_INFO_OUTPUT_FORMAT_CHANGED)
+diff --git a/libfreerdp/codec/h264_mf.c b/libfreerdp/codec/h264_mf.c
+index ca2eaca68..446f08d5e 100644
+--- a/libfreerdp/codec/h264_mf.c
++++ b/libfreerdp/codec/h264_mf.c
+@@ -370,6 +370,10 @@ static int mf_decompress(H264_CONTEXT* h264, const BYTE* pSrcData, UINT32 SrcSiz
+ 		}
+ 
+ 		outputBuffer->lpVtbl->Release(outputBuffer);
++		if (sys->frameWidth < h264->width)
++			goto error;
++		if (sys->frameHeigth < h264->height)
++			goto error;
+ 	}
+ 
+ 	inputSample->lpVtbl->Release(inputSample);
+diff --git a/libfreerdp/codec/h264_openh264.c b/libfreerdp/codec/h264_openh264.c
+index eb8c71310..f4a7e47f0 100644
+--- a/libfreerdp/codec/h264_openh264.c
++++ b/libfreerdp/codec/h264_openh264.c
+@@ -177,6 +177,10 @@ static int openh264_decompress(H264_CONTEXT* WINPR_RESTRICT h264,
+ 	if (!pYUVData[0] || !pYUVData[1] || !pYUVData[2])
+ 		return -2005;
+ 
++	if (pSystemBuffer->iWidth < WINPR_ASSERTING_INT_CAST(int64_t, h264->width))
++		return -2006;
++	if (pSystemBuffer->iHeight < WINPR_ASSERTING_INT_CAST(int64_t, h264->height))
++		return -2007;
+ 	return 1;
+ }
+ 
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index e014196f18..978f950d8d 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -14,6 +14,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-40254-1.patch \
            file://CVE-2026-40254-2.patch \
            file://CVE-2026-55191.patch \
+           file://CVE-2026-55192.patch \
 "