From 145c0c5f048894e4a7d09a4465eab7551f035bb0 Mon Sep 17 00:00:00 2001 From: Armin Novak Date: Tue, 3 Mar 2026 13:58:09 +0100 Subject: [PATCH] [core,orders] improve input validation check length before subtracting. Might underflow and be cought by the next check, but lets be strict. (cherry picked from commit a9e0abf2eac8c2e370fa155bf1abb9d044c0ca8a) CVE: CVE-2026-29776 Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/a9e0abf2eac8c2e370fa155bf1abb9d044c0ca8a] Signed-off-by: Ankur Tyagi --- libfreerdp/core/orders.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libfreerdp/core/orders.c b/libfreerdp/core/orders.c index 855b700ac..a9d779418 100644 --- a/libfreerdp/core/orders.c +++ b/libfreerdp/core/orders.c @@ -2214,6 +2214,8 @@ static CACHE_BITMAP_ORDER* update_read_cache_bitmap_order(rdpUpdate* update, wSt goto fail; Stream_Read(s, bitmapComprHdr, 8); /* bitmapComprHdr (8 bytes) */ + if (cache_bitmap->bitmapLength < 8) + goto fail; cache_bitmap->bitmapLength -= 8; } }