diff mbox series

[meta-oe,scarthgap,15/22] freerdp3: fix CVE-2026-29775

Message ID 20260409070919.3968586-15-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,scarthgap,1/22] abseil-cpp: ignore CVE-2025-0838 | expand

Commit Message

Ankur Tyagi April 9, 2026, 7:09 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-29775

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-29775.patch     | 30 +++++++++++++++++++
 .../recipes-support/freerdp/freerdp3_3.4.0.bb |  1 +
 2 files changed, 31 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-29775.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-29775.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-29775.patch
new file mode 100644
index 0000000000..584481e330
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-29775.patch
@@ -0,0 +1,30 @@ 
+From e4bfcb3197787e7af4246366b643c16de99f56a2 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Sat, 28 Feb 2026 11:38:55 +0100
+Subject: [PATCH] [cache,bitmap] overallocate bitmap cache
+
+(cherry picked from commit ffad58fd2b329efd81a3239e9d7e3c927b8e503f)
+
+CVE: CVE-2026-29775
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/ffad58fd2b329efd81a3239e9d7e3c927b8e503f]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/cache/bitmap.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/libfreerdp/cache/bitmap.c b/libfreerdp/cache/bitmap.c
+index dd5ae1d71..0d694dd3f 100644
+--- a/libfreerdp/cache/bitmap.c
++++ b/libfreerdp/cache/bitmap.c
+@@ -364,7 +364,10 @@ rdpBitmapCache* bitmap_cache_new(rdpContext* context)
+ 	const UINT32 BitmapCacheV2NumCells =
+ 	    freerdp_settings_get_uint32(settings, FreeRDP_BitmapCacheV2NumCells);
+ 	bitmapCache->context = context;
+-	bitmapCache->cells = (BITMAP_V2_CELL*)calloc(BitmapCacheV2NumCells, sizeof(BITMAP_V2_CELL));
++
++	/* overallocate by 1. older RDP servers do send a off by 1 cache index. */
++	bitmapCache->cells =
++	    (BITMAP_V2_CELL*)calloc(BitmapCacheV2NumCells + 1ull, sizeof(BITMAP_V2_CELL));
+ 
+ 	if (!bitmapCache->cells)
+ 		goto fail;
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb
index f92d824d66..e3d71ee854 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb
@@ -32,6 +32,7 @@  SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;branch=master;protocol=https \
            file://CVE-2026-24682.patch \
            file://CVE-2026-24683.patch \
            file://CVE-2026-29774.patch \
+           file://CVE-2026-29775.patch \
            "
 
 S = "${WORKDIR}/git"