From d128bdb4131634a7f877500da9fee4fee99bf019 Mon Sep 17 00:00:00 2001 From: akallabeth Date: Mon, 26 Jan 2026 10:59:39 +0100 Subject: [PATCH] [channels,urbdrc] ensure InterfaceNumber is within range (cherry picked from commit 2d563a50be17c1b407ca448b1321378c0726dd31) CVE: CVE-2026-24679 Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/2d563a50be17c1b407ca448b1321378c0726dd31] Signed-off-by: Ankur Tyagi --- channels/urbdrc/client/libusb/libusb_udevice.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c index c226eb806..ea12e55e0 100644 --- a/channels/urbdrc/client/libusb/libusb_udevice.c +++ b/channels/urbdrc/client/libusb/libusb_udevice.c @@ -532,19 +532,19 @@ static int libusb_udev_select_interface(IUDEVICE* idev, BYTE InterfaceNumber, BY int error = 0; int diff = 0; UDEVICE* pdev = (UDEVICE*)idev; - URBDRC_PLUGIN* urbdrc = NULL; - MSUSB_CONFIG_DESCRIPTOR* MsConfig = NULL; - MSUSB_INTERFACE_DESCRIPTOR** MsInterfaces = NULL; if (!pdev || !pdev->urbdrc) return -1; - urbdrc = pdev->urbdrc; - MsConfig = pdev->MsConfig; + URBDRC_PLUGIN* urbdrc = pdev->urbdrc; + MSUSB_CONFIG_DESCRIPTOR* MsConfig = pdev->MsConfig; if (MsConfig) { - MsInterfaces = MsConfig->MsInterfaces; + if (InterfaceNumber >= MsConfig->NumInterfaces) + return -2; + + MSUSB_INTERFACE_DESCRIPTOR** MsInterfaces = MsConfig->MsInterfaces; if (MsInterfaces) { WLog_Print(urbdrc->log, WLOG_INFO,