rpms/freerdp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Initialize function pointers after resource allocation

Browse Source 
Fixes CVE-2025-4478
Resolves: RHEL-91583
This commit is contained in:
Marek Kasik 2025-06-16 10:55:42 +02:00
parent b3347205f3
commit 20944102c3
2 changed files with 73 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
Initialize-function-pointers-after-resource-allocation.patch Normal file
View File

@ -0,0 +1,64 @@
From a4bb702aa62e4fad91ca99142de075265555ec18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jonas=20=C3=85dahl?= <jadahl@gmail.com>
Date: Tue, 13 May 2025 10:34:08 +0200
Subject: [PATCH] transport: Initialize function pointers after resource
allocation
The transport instance is freed when an error occurs.
If the TransportDisconnect function pointer is initialized it
causes SIGSEGV during free.
CVE: CVE-2025-4478
---
libfreerdp/core/transport.c | 28 ++++++++++++++--------------
1 file changed, 14 insertions(+), 14 deletions(-)
diff --git a/libfreerdp/core/transport.c b/libfreerdp/core/transport.c
index d199c31be..2ca146f65 100644
--- a/libfreerdp/core/transport.c
+++ b/libfreerdp/core/transport.c
@@ -1646,20 +1646,6 @@ rdpTransport* transport_new(rdpContext* context)
if (!transport->log)
goto fail;
- // transport->io.DataHandler = transport_data_handler;
- transport->io.TCPConnect = freerdp_tcp_default_connect;
- transport->io.TLSConnect = transport_default_connect_tls;
- transport->io.TLSAccept = transport_default_accept_tls;
- transport->io.TransportAttach = transport_default_attach;
- transport->io.TransportDisconnect = transport_default_disconnect;
- transport->io.ReadPdu = transport_default_read_pdu;
- transport->io.WritePdu = transport_default_write;
- transport->io.ReadBytes = transport_read_layer;
- transport->io.GetPublicKey = transport_default_get_public_key;
- transport->io.SetBlockingMode = transport_default_set_blocking_mode;
- transport->io.ConnectLayer = transport_default_connect_layer;
- transport->io.AttachLayer = transport_default_attach_layer;
-
transport->context = context;
transport->ReceivePool = StreamPool_New(TRUE, BUFFER_SIZE);
@@ -1698,6 +1684,20 @@ rdpTransport* transport_new(rdpContext* context)
if (!InitializeCriticalSectionAndSpinCount(&(transport->WriteLock), 4000))
goto fail;
+ // transport->io.DataHandler = transport_data_handler;
+ transport->io.TCPConnect = freerdp_tcp_default_connect;
+ transport->io.TLSConnect = transport_default_connect_tls;
+ transport->io.TLSAccept = transport_default_accept_tls;
+ transport->io.TransportAttach = transport_default_attach;
+ transport->io.TransportDisconnect = transport_default_disconnect;
+ transport->io.ReadPdu = transport_default_read_pdu;
+ transport->io.WritePdu = transport_default_write;
+ transport->io.ReadBytes = transport_read_layer;
+ transport->io.GetPublicKey = transport_default_get_public_key;
+ transport->io.SetBlockingMode = transport_default_set_blocking_mode;
+ transport->io.ConnectLayer = transport_default_connect_layer;
+ transport->io.AttachLayer = transport_default_attach_layer;
+
return transport;
fail:
WINPR_PRAGMA_DIAG_PUSH
--
2.49.0

10
freerdp.spec
View File

@ -30,7 +30,7 @@
Name: freerdp
Epoch: 2
Version: 3.10.3
Release: 2%{?dist}
Release: 3%{?dist}
Summary: Free implementation of the Remote Desktop Protocol (RDP)
# The effective license is Apache-2.0 but:
@ -47,6 +47,9 @@ URL: http://www.freerdp.com/
Source0: FreeRDP-%{version}-repack.tar.gz
Source1: freerdp_download_and_repack.sh
# https://bugzilla.redhat.com/show_bug.cgi?id=2365232
Patch0: Initialize-function-pointers-after-resource-allocation.patch
BuildRequires: gcc
BuildRequires: gcc-c++
BuildRequires: alsa-lib-devel
@ -369,6 +372,11 @@ find %{buildroot} -name "*.a" -delete
%{_libdir}/pkgconfig/winpr-tools3.pc
%changelog
* Mon Jun 16 2025 Marek Kasik <mkasik@redhat.com> - 2:3.10.3-3
- Initialize function pointers after resource allocation
- Fixes CVE-2025-4478
- Resolves: RHEL-91583
* Tue Dec 17 2024 Ondrej Holy <oholy@redhat.com> - 2:3.10.3-1
- Update to 3.10.3