From 1dabd5f8fb9f9619229156485cb5c43fb362b0e6 Mon Sep 17 00:00:00 2001 From: pkgagent Date: Tue, 25 Aug 2026 21:55:11 +0800 Subject: [PATCH] =?UTF-8?q?Fix=20CVE-2026-55193=20(TS=20Gateway=20rpc=20ma?= =?UTF-8?q?x=20fragment=20size=20checks),=20CVE-2026-55191=20(h264=20avc44?= =?UTF-8?q?4=20buffer=20bo=E2=80=A6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- freerdp-2.11.6-CVE-2026-55191.patch | 43 +++++++++++++++++++++++++++++ freerdp-2.11.6-CVE-2026-55193.patch | 30 ++++++++++++++++++++ freerdp.spec | 8 +++++- 3 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 freerdp-2.11.6-CVE-2026-55191.patch create mode 100644 freerdp-2.11.6-CVE-2026-55193.patch diff --git a/freerdp-2.11.6-CVE-2026-55191.patch b/freerdp-2.11.6-CVE-2026-55191.patch new file mode 100644 index 0000000..e298cc2 --- /dev/null +++ b/freerdp-2.11.6-CVE-2026-55191.patch @@ -0,0 +1,43 @@ +From 97f40b9e766af375f4e41ac6a3f4397d708d249c Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 11 Jun 2026 08:10:58 +0200 +Subject: [PATCH] [codec,h264] fix buffer bounds checks + +Adapted-by: PkgAgent/deepseek-v4 (modified to adapt to opencloudos-stream) +--- + libfreerdp/codec/h264.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) +diff --git a/libfreerdp/codec/h264.c b/libfreerdp/codec/h264.c +index 3f1ddb3..1df3894 100644 +--- a/libfreerdp/codec/h264.c ++++ b/libfreerdp/codec/h264.c +@@ -299,12 +299,27 @@ static BOOL avc444_ensure_buffer(H264_CONTEXT* h264, DWORD nDstHeight) + if (pad != 0) + padDstHeight += 16 - pad; + +- if ((piMainStride[0] != piDstStride[0]) || (piDstSize[0] != piMainStride[0] * padDstHeight)) ++ if ((piMainStride[0] == 0) || (padDstHeight == 0)) ++ return FALSE; ++ ++ const uint64_t dstsize = 1ull * piMainStride[0] * padDstHeight; ++ if (dstsize > UINT32_MAX) ++ return FALSE; ++ ++ if ((piMainStride[0] != piDstStride[0]) || (piDstSize[0] != dstsize)) + { + for (x = 0; x < 3; x++) + { + piDstStride[x] = piMainStride[0]; +- piDstSize[x] = piDstStride[x] * padDstHeight; ++ ++ const uint64_t dstride = 1ull * piDstStride[x] * padDstHeight; ++ if (dstride > UINT32_MAX) ++ return FALSE; ++ ++ piDstSize[x] = (UINT32)dstride; ++ if (piDstSize[x] == 0) ++ return FALSE; ++ + _aligned_free(ppYUVDstData[x]); + ppYUVDstData[x] = _aligned_malloc(piDstSize[x], 16); + diff --git a/freerdp-2.11.6-CVE-2026-55193.patch b/freerdp-2.11.6-CVE-2026-55193.patch new file mode 100644 index 0000000..9dcd4be --- /dev/null +++ b/freerdp-2.11.6-CVE-2026-55193.patch @@ -0,0 +1,30 @@ +From a863ef1cf1cdabf9019280e5658f806e73bb50e8 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 11 Jun 2026 08:31:09 +0200 +Subject: [PATCH] [core,gateway] rpc header max fragment size checks + +--- + libfreerdp/core/gateway/rpc_bind.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) +diff --git a/libfreerdp/core/gateway/rpc_bind.c b/libfreerdp/core/gateway/rpc_bind.c +index bdf54d5..e4d78b0 100644 +--- a/libfreerdp/core/gateway/rpc_bind.c ++++ b/libfreerdp/core/gateway/rpc_bind.c +@@ -335,6 +335,17 @@ BOOL rpc_recv_bind_ack_pdu(rdpRpc* rpc, wStream* s) + + WLog_DBG(TAG, "Receiving BindAck PDU"); + ++ const UINT16 MAX_VALID_FRAG = 0x0FF8; ++ if ((header.bind_ack.max_xmit_frag > MAX_VALID_FRAG) || ++ (header.bind_ack.max_recv_frag > MAX_VALID_FRAG)) ++ { ++ WLog_ERR(TAG, ++ "bind_ack: invalid fragment size: max_xmit_frag=%" PRIu16 ++ ", max_recv_frag=%" PRIu16 ", maximum=%" PRIu16, ++ header.bind_ack.max_xmit_frag, header.bind_ack.max_recv_frag, MAX_VALID_FRAG); ++ goto fail; ++ } ++ + rpc->max_recv_frag = header.bind_ack.max_xmit_frag; + rpc->max_xmit_frag = header.bind_ack.max_recv_frag; + diff --git a/freerdp.spec b/freerdp.spec index dba4c60..d061e4a 100644 --- a/freerdp.spec +++ b/freerdp.spec @@ -17,7 +17,7 @@ Summary: Free implementation of the Remote Desktop Protocol (RDP) Name: freerdp Version: 2.11.6 -Release: 17%{?dist} +Release: 18%{?dist} License: ASL 2.0 URL: http://www.freerdp.com/ Source0: https://github.com/FreeRDP/FreeRDP/archive/%{version}/%{name}-%{version}.tar.gz @@ -50,6 +50,8 @@ Patch0026: freerdp-2.11.6-CVE-2026-33984.patch Patch0027: freerdp-2.11.6-CVE-2026-33986.patch Patch0028: freerdp-2.11.6-CVE-2026-55827.patch Patch0029: freerdp-2.11.6-CVE-2026-64624.patch +Patch0030: freerdp-2.11.6-CVE-2026-55193.patch +Patch0031: freerdp-2.11.6-CVE-2026-55191.patch BuildRequires: gcc gcc-c++ alsa-lib-devel cmake cups-devel gsm-devel lame-devel libicu-devel libjpeg-turbo-devel BuildRequires: libX11-devel libXcursor-devel libXdamage-devel libXext-devel libXi-devel libXinerama-devel @@ -249,6 +251,10 @@ find %{buildroot} -name "*.a" -delete %{_libdir}/pkgconfig/winpr-tools2.pc %changelog +* Tue Aug 25 2026 PkgAgent Robot - 2.11.6-18 +- [Type] security +- [DESC] Fix CVE-2026-55193 (TS Gateway rpc max fragment size checks), CVE-2026-55191 (h264 avc444 buffer bounds checks) + * Mon Jul 27 2026 Xinlong Chen - 2.11.6-17 - [Type] security - [DESC] Fix CVE-2026-64624: disable embedded CLI parsing in RDP files by default -- Gitee