From 9bf461ad116d081134adf37da9d6faa9459d1ad6 Mon Sep 17 00:00:00 2001 From: Armin Novak Date: Mon, 9 Mar 2026 08:11:19 +0100 Subject: [PATCH] [codec,nsc] limit copy area in nsc_process_message the rectangle decoded might not fit into the destination buffer. Limit width and height of the area to copy to the one fitting. CVE: CVE-2026-31806 Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/83d9aedea278a74af3e490ff5eeb889c016dbb2b] Signed-off-by: Ankur Tyagi --- libfreerdp/codec/nsc.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/libfreerdp/codec/nsc.c b/libfreerdp/codec/nsc.c index c2d92e48c..1cee9918d 100644 --- a/libfreerdp/codec/nsc.c +++ b/libfreerdp/codec/nsc.c @@ -494,7 +494,15 @@ BOOL nsc_process_message(NSC_CONTEXT* context, UINT16 bpp, UINT32 width, UINT32 return FALSE; } - if (!freerdp_image_copy(pDstData, DstFormat, nDstStride, nXDst, nYDst, width, height, + uint32_t cwidth = width; + if (1ull * nXDst + width > nWidth) + cwidth = nWidth - nXDst; + + uint32_t cheight = height; + if (1ull * nYDst + height > nHeight) + cheight = nHeight - nYDst; + + if (!freerdp_image_copy(pDstData, DstFormat, nDstStride, nXDst, nYDst, cwidth, cheight, context->BitmapData, PIXEL_FORMAT_BGRA32, 0, 0, 0, NULL, flip)) return FALSE;