From ce7aebd0fe97f1bd047ff5e78aca9b706ddf41df Mon Sep 17 00:00:00 2001
From: yueyaoqiang <yueyaoqiang@kylinos.cn>
Date: Fri, 26 Apr 2024 14:44:55 +0800
Subject: [PATCH] fix CVE-2024-32661

---
 backport-CVE-2024-32661.patch | 16 ++++++++++++++++
 freerdp.spec                  |  6 +++++-
 2 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 backport-CVE-2024-32661.patch

diff --git a/backport-CVE-2024-32661.patch b/backport-CVE-2024-32661.patch
new file mode 100644
index 0000000..71ed6f2
--- /dev/null
+++ b/backport-CVE-2024-32661.patch
@@ -0,0 +1,16 @@
+diff -Naur freerdp-2.11.7/libfreerdp/core/info.c freerdp-2.11.7_cve/libfreerdp/core/info.c
+--- freerdp-2.11.7/libfreerdp/core/info.c	2024-04-22 17:26:59.000000000 +0800
++++ freerdp-2.11.7_cve/libfreerdp/core/info.c	2024-04-26 14:40:26.211931603 +0800
+@@ -1407,7 +1407,11 @@
+ {
+ 	if (!Stream_EnsureRemainingCapacity(s, 576))
+ 		return FALSE;
+-
++        
++        WINPR_ASSERT(info);
++	if (!info->domain || !info->username)
++		return FALSE;
++   
+ 	Stream_Seek(s, 576);
+ 	return TRUE;
+ }
diff --git a/freerdp.spec b/freerdp.spec
index 509b95b..31bd33f 100644
--- a/freerdp.spec
+++ b/freerdp.spec
@@ -1,6 +1,6 @@
 Name:           freerdp
 Version:        2.11.7
-Release:        1
+Release:        2
 Epoch:          2
 Summary:        A Remote Desktop Protocol Implementation
 License:        Apache-2.0
@@ -8,6 +8,7 @@ URL:            http://www.freerdp.com
 
 Source0:        https://github.com/FreeRDP/FreeRDP/releases/download/%{version}/freerdp-%{version}.tar.gz
 Patch0001:	Fix-freerdp-shadow-cli-exit-codes-for-help-and-version.patch
+Patch0002:      backport-CVE-2024-32661.patch
 
 BuildRequires:  gcc gcc-c++ alsa-lib-devel cmake >= 2.8 cups-devel gsm-devel libXrandr-devel libXv-devel
 BuildRequires:  libjpeg-turbo-devel libjpeg-turbo-devel libX11-devel libXcursor-devel libxkbfile-devel
@@ -137,6 +138,9 @@ echo "%{_libdir}/freerdp2" > %{buildroot}%{_sysconfdir}/ld.so.conf.d/%{name}-%{_
 %{_mandir}/*/*
 
 %changelog
+* Fri Apr 26 2024 yueyaoqiang <yueyaoqiang@kylinos.cn> -2:2.11.7-2
+- fix CVE-2024-32661
+
 * Tue Apr 23 2024 wangkai <13474090681@163.com> - 2:2.11.7-1
 - Update to 2.11.7 for fix CVE-2024-32039,CVE-2024-32040,
   CVE-2024-32041,CVE-2024-32458,CVE-2024-32459,CVE-2024-32460,
-- 
Gitee