From 0a2248a4adbee77122270062bebe00143d3ee96a Mon Sep 17 00:00:00 2001 From: akallabeth Date: Mon, 26 Jan 2026 10:20:23 +0100 Subject: [PATCH] [channels,audin] reset audin->format Whenever the underlying structure changes reset the pointer to NULL CVE: CVE-2026-24676 Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/026b81ae5831ac1598d8f7371e0d0996fac7db00] Signed-off-by: Ankur Tyagi --- channels/audin/client/audin_main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/channels/audin/client/audin_main.c b/channels/audin/client/audin_main.c index 1578d26ac..2c91d9f60 100644 --- a/channels/audin/client/audin_main.c +++ b/channels/audin/client/audin_main.c @@ -206,6 +206,7 @@ static UINT audin_process_formats(AUDIN_PLUGIN* audin, AUDIN_CHANNEL_CALLBACK* c } Stream_Seek_UINT32(s); /* cbSizeFormatsPacket */ + audin->format = NULL; callback->formats = audio_formats_new(NumFormats); if (!callback->formats) @@ -280,6 +281,7 @@ out: if (error != CHANNEL_RC_OK) { + audin->format = NULL; audio_formats_free(callback->formats, NumFormats); callback->formats = NULL; }