From d714759fc45ccf9ff179b912dd1714d0b4f2c5bc Mon Sep 17 00:00:00 2001 From: Armin Novak Date: Wed, 25 Mar 2026 09:48:54 +0100 Subject: [PATCH] [codec,clear] update CLEAR_VBAR_ENTRY::size after alloc (cherry picked from commit dc7fdb165095139be779a4000199bc1706b06ad5) CVE: CVE-2026-33984 Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/dc7fdb165095139be779a4000199bc1706b06ad5] Signed-off-by: Ankur Tyagi --- libfreerdp/codec/clear.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c index 512aeae20..d94536986 100644 --- a/libfreerdp/codec/clear.c +++ b/libfreerdp/codec/clear.c @@ -553,7 +553,6 @@ static BOOL resize_vbar_entry(CLEAR_CONTEXT* clear, CLEAR_VBAR_ENTRY* vBarEntry) const UINT32 oldPos = vBarEntry->size * bpp; const UINT32 diffSize = (vBarEntry->count - vBarEntry->size) * bpp; - vBarEntry->size = vBarEntry->count; BYTE* tmp = (BYTE*)winpr_aligned_recalloc(vBarEntry->pixels, vBarEntry->count, 1ull * bpp, 32); @@ -566,6 +565,7 @@ static BOOL resize_vbar_entry(CLEAR_CONTEXT* clear, CLEAR_VBAR_ENTRY* vBarEntry) memset(&tmp[oldPos], 0, diffSize); vBarEntry->pixels = tmp; + vBarEntry->size = vBarEntry->count; } if (!vBarEntry->pixels && vBarEntry->size)