francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
31 lines
1.1 KiB
Diff
31 lines
1.1 KiB
Diff
From 145c0c5f048894e4a7d09a4465eab7551f035bb0 Mon Sep 17 00:00:00 2001
|
|
From: Armin Novak <armin.novak@thincast.com>
|
|
Date: Tue, 3 Mar 2026 13:58:09 +0100
|
|
Subject: [PATCH] [core,orders] improve input validation
|
|
|
|
check length before subtracting. Might underflow and be cought by the
|
|
next check, but lets be strict.
|
|
|
|
(cherry picked from commit a9e0abf2eac8c2e370fa155bf1abb9d044c0ca8a)
|
|
|
|
CVE: CVE-2026-29776
|
|
Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/a9e0abf2eac8c2e370fa155bf1abb9d044c0ca8a]
|
|
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
|
---
|
|
libfreerdp/core/orders.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/libfreerdp/core/orders.c b/libfreerdp/core/orders.c
|
|
index 855b700ac..a9d779418 100644
|
|
--- a/libfreerdp/core/orders.c
|
|
+++ b/libfreerdp/core/orders.c
|
|
@@ -2214,6 +2214,8 @@ static CACHE_BITMAP_ORDER* update_read_cache_bitmap_order(rdpUpdate* update, wSt
|
|
goto fail;
|
|
|
|
Stream_Read(s, bitmapComprHdr, 8); /* bitmapComprHdr (8 bytes) */
|
|
+ if (cache_bitmap->bitmapLength < 8)
|
|
+ goto fail;
|
|
cache_bitmap->bitmapLength -= 8;
|
|
}
|
|
}
|