From 1bab198a2edd0d0e6e1627d21a433151ea190500 Mon Sep 17 00:00:00 2001 From: akallabeth Date: Thu, 15 Jan 2026 12:02:02 +0100 Subject: [PATCH] [codec,planar] fix decoder length checks CVE: CVE-2026-23530 Upstream: https://github.com/FreeRDP/FreeRDP/commit/1bab198a2edd0d0e6e1627d21a433151ea190500 [thomas: backport https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz] Signed-off-by: Thomas Perale --- libfreerdp/codec/planar.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libfreerdp/codec/planar.c b/libfreerdp/codec/planar.c index 1a06e36edb0c..94a640a551d1 100644 --- a/libfreerdp/codec/planar.c +++ b/libfreerdp/codec/planar.c @@ -616,6 +616,11 @@ BOOL freerdp_bitmap_decompress_planar(BITMAP_PLANAR_CONTEXT* WINPR_RESTRICT plan WINPR_ASSERT(planar); WINPR_ASSERT(prims); + if (planar->maxWidth < nSrcWidth) + return FALSE; + if (planar->maxHeight < nSrcHeight) + return FALSE; + if (nDstStep <= 0) nDstStep = nDstWidth * GetBytesPerPixel(DstFormat);