From c96b77ba687966dc429038d9f0337ac073321e0a Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 30 Mar 2026 10:25:23 -0400 Subject: [PATCH] import CS freerdp-2.11.7-3.el9 --- ...screen-invalidate-bitmap-before-free.patch | 46 ++++++++ ...ouble-free-in-case-of-invalid-pointe.patch | 53 +++++++++ ...lear-check-clear_decomress-glyphData.patch | 76 +++++++++++++ ...clear-fix-clear_resize_buffer-checks.patch | 61 +++++++++++ ...ec-clear-fix-off-by-one-length-check.patch | 35 ++++++ ...dec-planar-fix-decoder-length-checks.patch | 31 ++++++ ...core-tcp-Don-t-ignore-connect-errors.patch | 55 ++++++++++ ...ferIPv6OverIPv4-fallback-to-IPv4-add.patch | 102 ++++++++++++++++++ ...ry-next-DNS-entry-on-connect-failure.patch | 76 +++++++++++++ ...fix-double-free-in-get_next_addrinfo.patch | 39 +++++++ ...-retry-all-DNS-entries-until-success.patch | 100 +++++++++++++++++ ...-gfx-properly-clamp-SurfaceToSurface.patch | 50 +++++++++ SPECS/freerdp.spec | 39 ++++++- 13 files changed, 762 insertions(+), 1 deletion(-) create mode 100644 SOURCES/cache-offscreen-invalidate-bitmap-before-free.patch create mode 100644 SOURCES/client-x11-fix-double-free-in-case-of-invalid-pointe.patch create mode 100644 SOURCES/codec-clear-check-clear_decomress-glyphData.patch create mode 100644 SOURCES/codec-clear-fix-clear_resize_buffer-checks.patch create mode 100644 SOURCES/codec-clear-fix-off-by-one-length-check.patch create mode 100644 SOURCES/codec-planar-fix-decoder-length-checks.patch create mode 100644 SOURCES/core-tcp-Don-t-ignore-connect-errors.patch create mode 100644 SOURCES/core-tcp-Fix-PreferIPv6OverIPv4-fallback-to-IPv4-add.patch create mode 100644 SOURCES/core-tcp-Try-next-DNS-entry-on-connect-failure.patch create mode 100644 SOURCES/core-tcp-fix-double-free-in-get_next_addrinfo.patch create mode 100644 SOURCES/core-tcp-retry-all-DNS-entries-until-success.patch create mode 100644 SOURCES/gdi-gfx-properly-clamp-SurfaceToSurface.patch diff --git a/SOURCES/cache-offscreen-invalidate-bitmap-before-free.patch b/SOURCES/cache-offscreen-invalidate-bitmap-before-free.patch new file mode 100644 index 0000000..33e094d --- /dev/null +++ b/SOURCES/cache-offscreen-invalidate-bitmap-before-free.patch @@ -0,0 +1,46 @@ +From 4a4126380430a3517d1015b628475b816705ceb4 Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Thu, 22 Jan 2026 12:52:16 +0100 +Subject: [PATCH] [cache,offscreen] invalidate bitmap before free + +Backport of commit 52106a26726a2aba77aa6d86014d2eb3507f0783. + +Co-Authored-By: Claude +--- + libfreerdp/cache/offscreen.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/libfreerdp/cache/offscreen.c b/libfreerdp/cache/offscreen.c +index cdad56b4d..11e6caf21 100644 +--- a/libfreerdp/cache/offscreen.c ++++ b/libfreerdp/cache/offscreen.c +@@ -160,7 +160,7 @@ void offscreen_cache_put(rdpOffscreenCache* offscreenCache, UINT32 index, rdpBit + + void offscreen_cache_delete(rdpOffscreenCache* offscreenCache, UINT32 index) + { +- rdpBitmap* prevBitmap; ++ WINPR_ASSERT(offscreenCache); + + if (index >= offscreenCache->maxEntries) + { +@@ -168,10 +168,16 @@ void offscreen_cache_delete(rdpOffscreenCache* offscreenCache, UINT32 index) + return; + } + +- prevBitmap = offscreenCache->entries[index]; ++ rdpBitmap* prevBitmap = offscreenCache->entries[index]; + + if (prevBitmap != NULL) ++ { ++ WINPR_ASSERT(offscreenCache->update->context); ++ ++ /* Ensure that the bitmap is no longer used in GDI */ ++ IFCALL(prevBitmap->SetSurface, offscreenCache->update->context, NULL, FALSE); + Bitmap_Free(offscreenCache->update->context, prevBitmap); ++ } + + offscreenCache->entries[index] = NULL; + } +-- +2.52.0 + diff --git a/SOURCES/client-x11-fix-double-free-in-case-of-invalid-pointe.patch b/SOURCES/client-x11-fix-double-free-in-case-of-invalid-pointe.patch new file mode 100644 index 0000000..a3074ec --- /dev/null +++ b/SOURCES/client-x11-fix-double-free-in-case-of-invalid-pointe.patch @@ -0,0 +1,53 @@ +From c0e85d92e45dff6c9a12e6af5be2e9ed10b4990c Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Thu, 22 Jan 2026 12:51:08 +0100 +Subject: [PATCH] [client,x11] fix double free in case of invalid pointer + +Backport of commit 0421b53fcb4a80c95f51342e4a2c40c68a4101d3. + +Co-Authored-By: Claude +--- + client/X11/xf_graphics.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/client/X11/xf_graphics.c b/client/X11/xf_graphics.c +index 5aa1fd48b..d596b23da 100644 +--- a/client/X11/xf_graphics.c ++++ b/client/X11/xf_graphics.c +@@ -406,7 +406,6 @@ static BOOL xf_Pointer_New(rdpContext* context, rdpPointer* pointer) + BOOL rc = FALSE; + #ifdef WITH_XCURSOR + UINT32 CursorFormat; +- size_t size; + xfContext* xfc = (xfContext*)context; + xfPointer* xpointer = (xfPointer*)pointer; + +@@ -421,19 +420,19 @@ static BOOL xf_Pointer_New(rdpContext* context, rdpPointer* pointer) + xpointer->nCursors = 0; + xpointer->mCursors = 0; + +- size = 1ull * pointer->height * pointer->width * GetBytesPerPixel(CursorFormat); ++ const size_t size = ++ 1ull * pointer->height * pointer->width * GetBytesPerPixel(CursorFormat); + +- if (!(xpointer->cursorPixels = (XcursorPixel*)_aligned_malloc(size, 16))) ++ xpointer->cursorPixels = (XcursorPixel*)_aligned_malloc(size, 16); ++ if (!xpointer->cursorPixels) + goto fail; + + if (!freerdp_image_copy_from_pointer_data( + (BYTE*)xpointer->cursorPixels, CursorFormat, 0, 0, 0, pointer->width, pointer->height, + pointer->xorMaskData, pointer->lengthXorMask, pointer->andMaskData, + pointer->lengthAndMask, pointer->xorBpp, &context->gdi->palette)) +- { +- _aligned_free(xpointer->cursorPixels); +- return FALSE; +- } ++ goto fail; ++ + rc = TRUE; + + #endif +-- +2.52.0 + diff --git a/SOURCES/codec-clear-check-clear_decomress-glyphData.patch b/SOURCES/codec-clear-check-clear_decomress-glyphData.patch new file mode 100644 index 0000000..3828919 --- /dev/null +++ b/SOURCES/codec-clear-check-clear_decomress-glyphData.patch @@ -0,0 +1,76 @@ +From 3a4ee3f0020977320066b99da16456b6364c1365 Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Thu, 22 Jan 2026 12:50:22 +0100 +Subject: [PATCH] [codec,clear] check clear_decomress glyphData + +Backport of commit 243ecf804bb122e8e643a5c142ad5a49d7aa19ee. + +Co-Authored-By: Claude +--- + libfreerdp/codec/clear.c | 50 +++++++++++++++++++++++++++++++++++++++- + 1 file changed, 49 insertions(+), 1 deletion(-) + +diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c +index 4f0aead10..fcafb9235 100644 +--- a/libfreerdp/codec/clear.c ++++ b/libfreerdp/codec/clear.c +@@ -1145,7 +1145,55 @@ INT32 clear_decompress(CLEAR_CONTEXT* clear, const BYTE* pSrcData, UINT32 SrcSiz + + if (glyphData) + { +- if (!freerdp_image_copy(glyphData, clear->format, 0, 0, 0, nWidth, nHeight, pDstData, ++ uint32_t w = MIN(nWidth, nDstWidth); ++ if (nXDst > nDstWidth) ++ { ++ WLog_WARN(TAG, "glyphData copy area x exceeds destination: x=%" PRIu32 " > %" PRIu32, ++ nXDst, nDstWidth); ++ w = 0; ++ } ++ else if (nXDst + w > nDstWidth) ++ { ++ WLog_WARN(TAG, ++ "glyphData copy area x + width exceeds destination: x=%" PRIu32 " + %" PRIu32 ++ " > %" PRIu32, ++ nXDst, w, nDstWidth); ++ w = nDstWidth - nXDst; ++ } ++ ++ if (w != nWidth) ++ { ++ WLog_WARN(TAG, ++ "glyphData copy area width truncated: requested=%" PRIu32 ++ ", truncated to %" PRIu32, ++ nWidth, w); ++ } ++ ++ uint32_t h = MIN(nHeight, nDstHeight); ++ if (nYDst > nDstHeight) ++ { ++ WLog_WARN(TAG, "glyphData copy area y exceeds destination: y=%" PRIu32 " > %" PRIu32, ++ nYDst, nDstHeight); ++ h = 0; ++ } ++ else if (nYDst + h > nDstHeight) ++ { ++ WLog_WARN(TAG, ++ "glyphData copy area y + height exceeds destination: x=%" PRIu32 " + %" PRIu32 ++ " > %" PRIu32, ++ nYDst, h, nDstHeight); ++ h = nDstHeight - nYDst; ++ } ++ ++ if (h != nHeight) ++ { ++ WLog_WARN(TAG, ++ "glyphData copy area height truncated: requested=%" PRIu32 ++ ", truncated to %" PRIu32, ++ nHeight, h); ++ } ++ ++ if (!freerdp_image_copy(glyphData, clear->format, 0, 0, 0, w, h, pDstData, + DstFormat, nDstStep, nXDst, nYDst, palette, FREERDP_FLIP_NONE)) + goto fail; + } +-- +2.52.0 + diff --git a/SOURCES/codec-clear-fix-clear_resize_buffer-checks.patch b/SOURCES/codec-clear-fix-clear_resize_buffer-checks.patch new file mode 100644 index 0000000..e79f801 --- /dev/null +++ b/SOURCES/codec-clear-fix-clear_resize_buffer-checks.patch @@ -0,0 +1,61 @@ +From 00a593f9eda67212539e4dcac68ea5a699eb3e93 Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Thu, 22 Jan 2026 12:48:37 +0100 +Subject: [PATCH] [codec,clear] fix clear_resize_buffer checks + +Backport of commit c4391827d7facfc874ca7f61a92afb82232a5748. + +Co-Authored-By: Claude +--- + libfreerdp/codec/clear.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c +index e38fa0dcf..299acef2e 100644 +--- a/libfreerdp/codec/clear.c ++++ b/libfreerdp/codec/clear.c +@@ -62,7 +62,7 @@ struct _CLEAR_CONTEXT + NSC_CONTEXT* nsc; + UINT32 seqNumber; + BYTE* TempBuffer; +- UINT32 TempSize; ++ size_t TempSize; + UINT32 nTempStep; + UINT32 TempFormat; + UINT32 format; +@@ -313,24 +313,25 @@ static BOOL clear_decompress_subcode_rlex(wStream* s, UINT32 bitmapDataByteCount + + static BOOL clear_resize_buffer(CLEAR_CONTEXT* clear, UINT32 width, UINT32 height) + { +- UINT32 size; +- + if (!clear) + return FALSE; + +- size = ((width + 16) * (height + 16) * GetBytesPerPixel(clear->format)); ++ const UINT64 size = 1ull * (width + 16ull) * (height + 16ull); ++ const size_t bpp = GetBytesPerPixel(clear->format); ++ if (size > UINT32_MAX / bpp) ++ return FALSE; + +- if (size > clear->TempSize) ++ if (size > clear->TempSize / bpp) + { +- BYTE* tmp = (BYTE*)realloc(clear->TempBuffer, size); ++ BYTE* tmp = (BYTE*)realloc(clear->TempBuffer, size * bpp); + + if (!tmp) + { +- WLog_ERR(TAG, "clear->TempBuffer realloc failed for %" PRIu32 " bytes", size); ++ WLog_ERR(TAG, "clear->TempBuffer realloc failed for %" PRIu64 " bytes", size); + return FALSE; + } + +- clear->TempSize = size; ++ clear->TempSize = size * bpp; + clear->TempBuffer = tmp; + } + +-- +2.52.0 + diff --git a/SOURCES/codec-clear-fix-off-by-one-length-check.patch b/SOURCES/codec-clear-fix-off-by-one-length-check.patch new file mode 100644 index 0000000..d300c1d --- /dev/null +++ b/SOURCES/codec-clear-fix-off-by-one-length-check.patch @@ -0,0 +1,35 @@ +From 5b03db3926bd7bc1bf5819de068ed71a73b25236 Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Thu, 22 Jan 2026 12:49:28 +0100 +Subject: [PATCH] [codec,clear] fix off by one length check + +Backport of commit f8688b57f6cfad9a0b05475a6afbde355ffab720. + +Co-Authored-By: Claude +--- + libfreerdp/codec/clear.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c +index 09f5dad6d..4f0aead10 100644 +--- a/libfreerdp/codec/clear.c ++++ b/libfreerdp/codec/clear.c +@@ -881,11 +881,14 @@ static BOOL clear_decompress_bands_data(CLEAR_CONTEXT* clear, wStream* s, UINT32 + if (count > nHeight) + count = nHeight; + +- if (nXDstRel + i > nDstWidth) ++ if (nXDstRel + i >= nDstWidth) + return FALSE; + + for (UINT32 y = 0; y < count; y++) + { ++ if (nYDstRel + y >= nDstHeight) ++ return FALSE; ++ + BYTE* pDstPixel8 = &pDstData[((nYDstRel + y) * nDstStep) + + ((nXDstRel + i) * GetBytesPerPixel(DstFormat))]; + UINT32 color = ReadColor(cpSrcPixel, clear->format); +-- +2.52.0 + diff --git a/SOURCES/codec-planar-fix-decoder-length-checks.patch b/SOURCES/codec-planar-fix-decoder-length-checks.patch new file mode 100644 index 0000000..a8d2c99 --- /dev/null +++ b/SOURCES/codec-planar-fix-decoder-length-checks.patch @@ -0,0 +1,31 @@ +From 2d656eb6b29a68de7f19e8a1cce169259e7506b4 Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Tue, 27 Jan 2026 14:35:43 +0100 +Subject: [PATCH] [codec,planar] fix decoder length checks + +Backport of commit 1bab198a2edd0d0e6e1627d21a433151ea190. + +Co-Authored-By: Claude +--- + libfreerdp/codec/planar.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/libfreerdp/codec/planar.c b/libfreerdp/codec/planar.c +index fe27011e1..1cb2e22bc 100644 +--- a/libfreerdp/codec/planar.c ++++ b/libfreerdp/codec/planar.c +@@ -616,6 +616,11 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT + WINPR_ASSERT(planar); + WINPR_ASSERT(prims); + ++ if (planar->maxWidth < nSrcWidth) ++ return FALSE; ++ if (planar->maxHeight < nSrcHeight) ++ return FALSE; ++ + if (nDstStep <= 0) + nDstStep = nDstWidth * GetBytesPerPixel(DstFormat); + +-- +2.52.0 + diff --git a/SOURCES/core-tcp-Don-t-ignore-connect-errors.patch b/SOURCES/core-tcp-Don-t-ignore-connect-errors.patch new file mode 100644 index 0000000..fd09a11 --- /dev/null +++ b/SOURCES/core-tcp-Don-t-ignore-connect-errors.patch @@ -0,0 +1,55 @@ +From c3673aaa5b65e8670c218bdfb5916a4112b628c7 Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Wed, 14 Jan 2026 13:29:34 +0100 +Subject: [PATCH] [core,tcp] Don't ignore connect errors + +Backport of commit 0bdd8da0993231216a7bb4d5e6e33e47d817a944. + +Co-Authored-By: Claude +--- + libfreerdp/core/tcp.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/libfreerdp/core/tcp.c b/libfreerdp/core/tcp.c +index 1d7eda92e..8a731f117 100644 +--- a/libfreerdp/core/tcp.c ++++ b/libfreerdp/core/tcp.c +@@ -26,8 +26,11 @@ + #include + #include + ++#include ++ + #include + #include ++#include + #include + + #if !defined(_WIN32) +@@ -846,12 +849,19 @@ static BOOL freerdp_tcp_connect_timeout(rdpContext* context, int sockfd, struct + if (WAIT_OBJECT_0 != status) + goto fail; + +- status = recv(sockfd, NULL, 0, 0); +- +- if (status == SOCKET_ERROR) + { +- if (WSAGetLastError() == WSAECONNRESET) ++ INT32 optval = 0; ++ socklen_t optlen = sizeof(optval); ++ if (getsockopt(sockfd, SOL_SOCKET, SO_ERROR, &optval, &optlen) < 0) ++ goto fail; ++ ++ if (optval != 0) ++ { ++ char ebuffer[256] = { 0 }; ++ WLog_DBG(TAG, "connect failed with error: %s [%" PRId32 "]", ++ winpr_strerror(optval, ebuffer, sizeof(ebuffer)), optval); + goto fail; ++ } + } + + status = WSAEventSelect(sockfd, handles[0], 0); +-- +2.52.0 + diff --git a/SOURCES/core-tcp-Fix-PreferIPv6OverIPv4-fallback-to-IPv4-add.patch b/SOURCES/core-tcp-Fix-PreferIPv6OverIPv4-fallback-to-IPv4-add.patch new file mode 100644 index 0000000..623108d --- /dev/null +++ b/SOURCES/core-tcp-Fix-PreferIPv6OverIPv4-fallback-to-IPv4-add.patch @@ -0,0 +1,102 @@ +From 462b02de4107845ab235e1668f78a43a31eb11fc Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Wed, 14 Jan 2026 13:38:42 +0100 +Subject: [PATCH] [core,tcp] Fix PreferIPv6OverIPv4 fallback to IPv4 addresses + +Backport of commit 0bdd8da0993231216a7bb4d5e6e33e47d817a944. + +Co-Authored-By: Claude +--- + libfreerdp/core/tcp.c | 61 ++++++++++++++++++++++++++++++++++++------- + 1 file changed, 51 insertions(+), 10 deletions(-) + +diff --git a/libfreerdp/core/tcp.c b/libfreerdp/core/tcp.c +index 8a731f117..3cf24c160 100644 +--- a/libfreerdp/core/tcp.c ++++ b/libfreerdp/core/tcp.c +@@ -1064,6 +1064,53 @@ static BOOL freerdp_tcp_set_keep_alive_mode(const rdpSettings* settings, int soc + return TRUE; + } + ++static struct addrinfo* reorder_addrinfo_by_preference(rdpContext* context, struct addrinfo* addr) ++{ ++ WINPR_ASSERT(context); ++ WINPR_ASSERT(addr); ++ ++ const BOOL preferIPv6 = ++ freerdp_settings_get_bool(context->settings, FreeRDP_PreferIPv6OverIPv4); ++ if (!preferIPv6) ++ return addr; ++ ++ struct addrinfo* ipv6Head = NULL; ++ struct addrinfo* ipv6Tail = NULL; ++ struct addrinfo* otherHead = NULL; ++ struct addrinfo* otherTail = NULL; ++ ++ /* Partition the list into IPv6 and other addresses */ ++ while (addr) ++ { ++ struct addrinfo* next = addr->ai_next; ++ addr->ai_next = NULL; ++ ++ if (addr->ai_family == AF_INET6) ++ { ++ if (!ipv6Head) ++ ipv6Head = addr; ++ else ++ ipv6Tail->ai_next = addr; ++ ipv6Tail = addr; ++ } ++ else ++ { ++ if (!otherHead) ++ otherHead = addr; ++ else ++ otherTail->ai_next = addr; ++ otherTail = addr; ++ } ++ addr = next; ++ } ++ ++ /* Concatenate the lists */ ++ if (ipv6Tail) ++ ipv6Tail->ai_next = otherHead; ++ ++ return ipv6Head ? ipv6Head : otherHead; ++} ++ + static int get_next_addrinfo(rdpContext* context, struct addrinfo* input, struct addrinfo** result, + UINT32 errorCode) + { +@@ -1074,14 +1121,6 @@ static int get_next_addrinfo(rdpContext* context, struct addrinfo* input, struct + if (!addr) + goto fail; + +- if (freerdp_settings_get_bool(context->settings, FreeRDP_PreferIPv6OverIPv4)) +- { +- while (addr && (addr->ai_family != AF_INET6)) +- addr = addr->ai_next; +- if (!addr) +- addr = input; +- } +- + *result = addr; + return 0; + +@@ -1161,9 +1200,11 @@ int freerdp_tcp_connect(rdpContext* context, rdpSettings* settings, const char* + freerdp_set_last_error_log(context, 0); + + /* +- * If PreferIPv6OverIPv4 = TRUE we force to IPv6 if there +- * is such an address available, but fall back to first if not found ++ * If PreferIPv6OverIPv4 = TRUE we reorder addresses by preference: ++ * IPv6 addresses come first, then other addresses. + */ ++ result = reorder_addrinfo_by_preference(context, result); ++ + const int rc = + get_next_addrinfo(context, result, &addr, FREERDP_ERROR_DNS_NAME_NOT_FOUND); + if (rc < 0) +-- +2.52.0 + diff --git a/SOURCES/core-tcp-Try-next-DNS-entry-on-connect-failure.patch b/SOURCES/core-tcp-Try-next-DNS-entry-on-connect-failure.patch new file mode 100644 index 0000000..eedb3ff --- /dev/null +++ b/SOURCES/core-tcp-Try-next-DNS-entry-on-connect-failure.patch @@ -0,0 +1,76 @@ +From 051218feec6c3404e625637c9d812817b7d69c26 Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Wed, 14 Jan 2026 13:28:18 +0100 +Subject: [PATCH] [core,tcp] Try next DNS entry on connect failure + +Backport of commit bd67348eb3380a66b544835346191bd2138a5ba4. + +Co-Authored-By: Claude +--- + libfreerdp/core/tcp.c | 41 ++++++++++++++++++++++------------------- + 1 file changed, 22 insertions(+), 19 deletions(-) + +diff --git a/libfreerdp/core/tcp.c b/libfreerdp/core/tcp.c +index efc2aec36..1d7eda92e 100644 +--- a/libfreerdp/core/tcp.c ++++ b/libfreerdp/core/tcp.c +@@ -1162,34 +1162,37 @@ int freerdp_tcp_connect(rdpContext* context, rdpSettings* settings, const char* + do + { + sockfd = socket(addr->ai_family, addr->ai_socktype, addr->ai_protocol); ++ if (sockfd >= 0) ++ { ++ if ((peerAddress = freerdp_tcp_address_to_string( ++ (const struct sockaddr_storage*)addr->ai_addr, NULL)) != NULL) ++ { ++ WLog_DBG(TAG, "connecting to peer %s", peerAddress); ++ free(peerAddress); ++ } ++ ++ if (!freerdp_tcp_connect_timeout(context, sockfd, addr->ai_addr, ++ addr->ai_addrlen, timeout)) ++ { ++ close(sockfd); ++ sockfd = -1; ++ } ++ } ++ + if (sockfd < 0) + { + const int rc = get_next_addrinfo(context, addr->ai_next, &addr, + FREERDP_ERROR_CONNECT_FAILED); + if (rc < 0) ++ { ++ freeaddrinfo(result); ++ freerdp_set_last_error_if_not(context, FREERDP_ERROR_CONNECT_FAILED); ++ WLog_ERR(TAG, "failed to connect to %s", hostname); + return rc; ++ } + } + } while (sockfd < 0); + +- if ((peerAddress = freerdp_tcp_address_to_string( +- (const struct sockaddr_storage*)addr->ai_addr, NULL)) != NULL) +- { +- WLog_DBG(TAG, "connecting to peer %s", peerAddress); +- free(peerAddress); +- } +- +- if (!freerdp_tcp_connect_timeout(context, sockfd, addr->ai_addr, addr->ai_addrlen, +- timeout)) +- { +- freeaddrinfo(result); +- close(sockfd); +- +- freerdp_set_last_error_if_not(context, FREERDP_ERROR_CONNECT_FAILED); +- +- WLog_ERR(TAG, "failed to connect to %s", hostname); +- return -1; +- } +- + freeaddrinfo(result); + } + } +-- +2.52.0 + diff --git a/SOURCES/core-tcp-fix-double-free-in-get_next_addrinfo.patch b/SOURCES/core-tcp-fix-double-free-in-get_next_addrinfo.patch new file mode 100644 index 0000000..a299191 --- /dev/null +++ b/SOURCES/core-tcp-fix-double-free-in-get_next_addrinfo.patch @@ -0,0 +1,39 @@ +From c13c873fcd3e95dcb21e5a811ac878c21ce38d80 Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Wed, 14 Jan 2026 13:39:04 +0100 +Subject: [PATCH] [core,tcp] fix double free in get_next_addrinfo + +Backport of commit 48197426444b7b3587874b5eae175af1113beab8. + +Co-Authored-By: Claude +--- + libfreerdp/core/tcp.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/libfreerdp/core/tcp.c b/libfreerdp/core/tcp.c +index 3cf24c160..25632f882 100644 +--- a/libfreerdp/core/tcp.c ++++ b/libfreerdp/core/tcp.c +@@ -1126,7 +1126,7 @@ static int get_next_addrinfo(rdpContext* context, struct addrinfo* input, struct + + fail: + freerdp_set_last_error_if_not(context, errorCode); +- freeaddrinfo(input); ++ *result = NULL; + return -1; + } + +@@ -1208,7 +1208,10 @@ int freerdp_tcp_connect(rdpContext* context, rdpSettings* settings, const char* + const int rc = + get_next_addrinfo(context, result, &addr, FREERDP_ERROR_DNS_NAME_NOT_FOUND); + if (rc < 0) ++ { ++ freeaddrinfo(result); + return rc; ++ } + + do + { +-- +2.52.0 + diff --git a/SOURCES/core-tcp-retry-all-DNS-entries-until-success.patch b/SOURCES/core-tcp-retry-all-DNS-entries-until-success.patch new file mode 100644 index 0000000..8942938 --- /dev/null +++ b/SOURCES/core-tcp-retry-all-DNS-entries-until-success.patch @@ -0,0 +1,100 @@ +From 84f0e60c998d7c497d141492f7933bc940f7b239 Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Tue, 6 Jan 2026 12:38:34 +0100 +Subject: [PATCH] [core,tcp] retry all DNS entries until success + +Backport of commit 4286a4c16495916fbfa6b8a6764c35fc82e1c5ba. + +Co-Authored-By: Claude +--- + libfreerdp/core/tcp.c | 63 +++++++++++++++++++++++++++++-------------- + 1 file changed, 43 insertions(+), 20 deletions(-) + +diff --git a/libfreerdp/core/tcp.c b/libfreerdp/core/tcp.c +index 0d0641b82..efc2aec36 100644 +--- a/libfreerdp/core/tcp.c ++++ b/libfreerdp/core/tcp.c +@@ -1054,6 +1054,33 @@ static BOOL freerdp_tcp_set_keep_alive_mode(const rdpSettings* settings, int soc + return TRUE; + } + ++static int get_next_addrinfo(rdpContext* context, struct addrinfo* input, struct addrinfo** result, ++ UINT32 errorCode) ++{ ++ WINPR_ASSERT(context); ++ WINPR_ASSERT(result); ++ ++ struct addrinfo* addr = input; ++ if (!addr) ++ goto fail; ++ ++ if (freerdp_settings_get_bool(context->settings, FreeRDP_PreferIPv6OverIPv4)) ++ { ++ while (addr && (addr->ai_family != AF_INET6)) ++ addr = addr->ai_next; ++ if (!addr) ++ addr = input; ++ } ++ ++ *result = addr; ++ return 0; ++ ++fail: ++ freerdp_set_last_error_if_not(context, errorCode); ++ freeaddrinfo(input); ++ return -1; ++} ++ + int freerdp_tcp_connect(rdpContext* context, rdpSettings* settings, const char* hostname, int port, + DWORD timeout) + { +@@ -1123,30 +1150,26 @@ int freerdp_tcp_connect(rdpContext* context, rdpSettings* settings, const char* + } + freerdp_set_last_error_log(context, 0); + +- addr = result; ++ /* ++ * If PreferIPv6OverIPv4 = TRUE we force to IPv6 if there ++ * is such an address available, but fall back to first if not found ++ */ ++ const int rc = ++ get_next_addrinfo(context, result, &addr, FREERDP_ERROR_DNS_NAME_NOT_FOUND); ++ if (rc < 0) ++ return rc; + +- if ((addr->ai_family == AF_INET6) && (addr->ai_next != 0) && +- !settings->PreferIPv6OverIPv4) ++ do + { +- while ((addr = addr->ai_next)) ++ sockfd = socket(addr->ai_family, addr->ai_socktype, addr->ai_protocol); ++ if (sockfd < 0) + { +- if (addr->ai_family == AF_INET) +- break; ++ const int rc = get_next_addrinfo(context, addr->ai_next, &addr, ++ FREERDP_ERROR_CONNECT_FAILED); ++ if (rc < 0) ++ return rc; + } +- +- if (!addr) +- addr = result; +- } +- +- sockfd = socket(addr->ai_family, addr->ai_socktype, addr->ai_protocol); +- +- if (sockfd < 0) +- { +- freerdp_set_last_error_if_not(context, FREERDP_ERROR_CONNECT_FAILED); +- +- freeaddrinfo(result); +- return -1; +- } ++ } while (sockfd < 0); + + if ((peerAddress = freerdp_tcp_address_to_string( + (const struct sockaddr_storage*)addr->ai_addr, NULL)) != NULL) +-- +2.52.0 + diff --git a/SOURCES/gdi-gfx-properly-clamp-SurfaceToSurface.patch b/SOURCES/gdi-gfx-properly-clamp-SurfaceToSurface.patch new file mode 100644 index 0000000..8002877 --- /dev/null +++ b/SOURCES/gdi-gfx-properly-clamp-SurfaceToSurface.patch @@ -0,0 +1,50 @@ +From ef99da020599a666b7d171eec6ab527b47dd33f3 Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Thu, 22 Jan 2026 12:47:42 +0100 +Subject: [PATCH] [gdi,gfx] properly clamp SurfaceToSurface + +Backport of commit c4a7c371342edf0d307cea728f56d3302f0ab38c. + +Co-Authored-By: Claude +--- + libfreerdp/gdi/gfx.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/libfreerdp/gdi/gfx.c b/libfreerdp/gdi/gfx.c +index 3970715e0..968a5a17c 100644 +--- a/libfreerdp/gdi/gfx.c ++++ b/libfreerdp/gdi/gfx.c +@@ -1175,7 +1175,6 @@ static UINT gdi_SurfaceToSurface(RdpgfxClientContext* context, + UINT status = ERROR_INTERNAL_ERROR; + UINT16 index; + BOOL sameSurface; +- UINT32 nWidth, nHeight; + const RECTANGLE_16* rectSrc; + RECTANGLE_16 invalidRect; + gdiGfxSurface* surfaceSrc; +@@ -1199,8 +1198,8 @@ static UINT gdi_SurfaceToSurface(RdpgfxClientContext* context, + if (!is_rect_valid(rectSrc, surfaceSrc->width, surfaceSrc->height)) + goto fail; + +- nWidth = rectSrc->right - rectSrc->left; +- nHeight = rectSrc->bottom - rectSrc->top; ++ const UINT32 nWidth = rectSrc->right - rectSrc->left; ++ const UINT32 nHeight = rectSrc->bottom - rectSrc->top; + + for (index = 0; index < surfaceToSurface->destPtsCount; index++) + { +@@ -1209,8 +1208,10 @@ static UINT gdi_SurfaceToSurface(RdpgfxClientContext* context, + if (!is_rect_valid(&rect, surfaceDst->width, surfaceDst->height)) + goto fail; + ++ const UINT32 rwidth = rect.right - rect.left; ++ const UINT32 rheight = rect.bottom - rect.top; + if (!freerdp_image_copy(surfaceDst->data, surfaceDst->format, surfaceDst->scanline, +- destPt->x, destPt->y, nWidth, nHeight, surfaceSrc->data, ++ destPt->x, destPt->y, rwidth, rheight, surfaceSrc->data, + surfaceSrc->format, surfaceSrc->scanline, rectSrc->left, + rectSrc->top, NULL, FREERDP_FLIP_NONE)) + goto fail; +-- +2.52.0 + diff --git a/SPECS/freerdp.spec b/SPECS/freerdp.spec index e4f5b58..79fd9dd 100644 --- a/SPECS/freerdp.spec +++ b/SPECS/freerdp.spec @@ -27,7 +27,7 @@ Name: freerdp Version: 2.11.7 -Release: 1%{?dist} +Release: 3%{?dist} Epoch: 2 Summary: Free implementation of the Remote Desktop Protocol (RDP) License: ASL 2.0 @@ -35,6 +35,34 @@ URL: http://www.freerdp.com/ Source0: https://github.com/FreeRDP/FreeRDP/archive/%{version}/FreeRDP-%{version}.tar.gz +# https://issues.redhat.com/browse/RHEL-113722 +Patch: core-tcp-retry-all-DNS-entries-until-success.patch +Patch: core-tcp-Try-next-DNS-entry-on-connect-failure.patch +Patch: core-tcp-Don-t-ignore-connect-errors.patch +Patch: core-tcp-Fix-PreferIPv6OverIPv4-fallback-to-IPv4-add.patch +Patch: core-tcp-fix-double-free-in-get_next_addrinfo.patch + +# https://github.com/FreeRDP/FreeRDP/commit/c4a7c371342edf0d307cea728f56d3302f0ab38c +Patch: gdi-gfx-properly-clamp-SurfaceToSurface.patch + +# https://github.com/FreeRDP/FreeRDP/commit/c4391827d7facfc874ca7f61a92afb82232a5748 +Patch: codec-clear-fix-clear_resize_buffer-checks.patch + +# https://github.com/FreeRDP/FreeRDP/commit/f8688b57f6cfad9a0b05475a6afbde355ffab720 +Patch: codec-clear-fix-off-by-one-length-check.patch + +# https://github.com/FreeRDP/FreeRDP/commit/1bab198a2edd0d0e6e1627d21a433151ea190500 +Patch: codec-planar-fix-decoder-length-checks.patch + +# https://github.com/FreeRDP/FreeRDP/commit/243ecf804bb122e8e643a5c142ad5a49d7aa19ee +Patch: codec-clear-check-clear_decomress-glyphData.patch + +# https://github.com/FreeRDP/FreeRDP/commit/0421b53fcb4a80c95f51342e4a2c40c68a4101d3 +Patch: client-x11-fix-double-free-in-case-of-invalid-pointe.patch + +# https://github.com/FreeRDP/FreeRDP/commit/52106a26726a2aba77aa6d86014d2eb3507f0783 +Patch: cache-offscreen-invalidate-bitmap-before-free.patch + BuildRequires: gcc BuildRequires: gcc-c++ BuildRequires: alsa-lib-devel @@ -292,6 +320,15 @@ find %{buildroot} -name "*.a" -delete %{_libdir}/pkgconfig/winpr-tools2.pc %changelog +* Tue Jan 27 2026 Ondrej Holy - 2:2.11.7-3 +- Backport several CVE fixes + Resolves: RHEL-142427, RHEL-142411, RHEL-142395, RHEL-142379, RHEL-142363 + Resolves: RHEL-142348, RHEL-142332 + +* Fri Jan 16 2026 Ondrej Holy - 2:2.11.7-2 +- Try next DNS entry on connect failure + Resolves: RHEL-113722 + * Thu May 09 2024 Ondrej Holy - 2:2.11.7-1 - Update to 2.11.7 (CVE-2024-32039, CVE-2024-32040, CVE-2024-32041, CVE-2024-32458, CVE-2024-32459, CVE-2024-32460, CVE-2024-32658,