From 8a03413b6b154100076bfedf6388a348189a6791 Mon Sep 17 00:00:00 2001 From: Armin Novak Date: Tue, 10 Mar 2026 09:17:23 +0100 Subject: [PATCH] [codec,planar] add early length check to avoid oob read CVE: CVE-2026-31897 Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/cd27c8faca0eeb0d4309cc5837dfdf3c42eba4e7] Signed-off-by: Ankur Tyagi --- libfreerdp/codec/planar.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libfreerdp/codec/planar.c b/libfreerdp/codec/planar.c index 4b51a023e..f3e00f9e5 100644 --- a/libfreerdp/codec/planar.c +++ b/libfreerdp/codec/planar.c @@ -720,9 +720,9 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT srcp = pSrcData; - if (!pSrcData) + if (!pSrcData || (SrcSize < 1)) { - WLog_ERR(TAG, "Invalid argument pSrcData=NULL"); + WLog_ERR(TAG, "Invalid argument pSrcData=%p [size=%" PRIu32 "]", pSrcData, SrcSize); return FALSE; }