import CS freerdp-3.10.3-5.el10

.freerdp.metadata

@@ -1 +0,0 @@
-14a73f092e227a77f3d483658033d15d4501a753 SOURCES/FreeRDP-2.11.7.tar.gz

.gitignore

@@ -1 +1 @@
-SOURCES/FreeRDP-2.11.7.tar.gz
+FreeRDP-3.10.3-repack.tar.gz

Default-minimum-thread-count.patch

@@ -0,0 +1,52 @@
+From 0e6c921b206259474b1c14bb26b183a8b2089cdb Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Fri, 12 Sep 2025 08:25:16 +0200
+Subject: [PATCH 082/100] [winpr,threadpool] default minimum thread count
+
+Set a default minimum of 4 threads in a pool. Avoids issues with system
+running with a single processor (might lead to deadlocks if the code
+assumes > 1 thread handling stuff)
+---
+ winpr/libwinpr/pool/CMakeLists.txt | 2 ++
+ winpr/libwinpr/pool/pool.c         | 9 +++++++--
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/winpr/libwinpr/pool/CMakeLists.txt b/winpr/libwinpr/pool/CMakeLists.txt
+index cfa9bc891..6b5938fd0 100644
+--- a/winpr/libwinpr/pool/CMakeLists.txt
++++ b/winpr/libwinpr/pool/CMakeLists.txt
+@@ -16,7 +16,9 @@
+ # limitations under the License.
+ 
+ set(WINPR_THREADPOOL_DEFAULT_MAX_COUNT "16" CACHE STRING "The maximum (default) number of threads in a pool")
++set(WINPR_THREADPOOL_DEFAULT_MIN_COUNT "4" CACHE STRING "The minimum (default) number of threads in a pool")
+ winpr_definition_add(WINPR_THREADPOOL_DEFAULT_MAX_COUNT=${WINPR_THREADPOOL_DEFAULT_MAX_COUNT})
++winpr_definition_add(WINPR_THREADPOOL_DEFAULT_MIN_COUNT=${WINPR_THREADPOOL_DEFAULT_MIN_COUNT})
+ winpr_module_add(
+   synch.c
+   work.c
+diff --git a/winpr/libwinpr/pool/pool.c b/winpr/libwinpr/pool/pool.c
+index 96db6b247..cbfc274c5 100644
+--- a/winpr/libwinpr/pool/pool.c
++++ b/winpr/libwinpr/pool/pool.c
+@@ -127,10 +127,15 @@ static BOOL InitializeThreadpool(PTP_POOL pool)
+ 	obj = ArrayList_Object(pool->Threads);
+ 	obj->fnObjectFree = threads_close;
+ 
++#if !defined(WINPR_THREADPOOL_DEFAULT_MIN_COUNT)
++#error "WINPR_THREADPOOL_DEFAULT_MIN_COUNT must be defined"
++#endif
++
+ 	SYSTEM_INFO info = { 0 };
+ 	GetSystemInfo(&info);
+-	if (info.dwNumberOfProcessors < 1)
+-		info.dwNumberOfProcessors = 1;
++	if (info.dwNumberOfProcessors < WINPR_THREADPOOL_DEFAULT_MIN_COUNT)
++		info.dwNumberOfProcessors = WINPR_THREADPOOL_DEFAULT_MIN_COUNT;
++
+ 	if (!SetThreadpoolThreadMinimum(pool, info.dwNumberOfProcessors))
+ 		goto fail;
+ 
+-- 
+2.51.0
+

Initialize-function-pointers-after-resource-allocation.patch

@@ -0,0 +1,64 @@
+From a4bb702aa62e4fad91ca99142de075265555ec18 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jonas=20=C3=85dahl?= <jadahl@gmail.com>
+Date: Tue, 13 May 2025 10:34:08 +0200
+Subject: [PATCH] transport: Initialize function pointers after resource
+ allocation
+
+The transport instance is freed when an error occurs.
+If the TransportDisconnect function pointer is initialized it
+causes SIGSEGV during free.
+
+CVE: CVE-2025-4478
+---
+ libfreerdp/core/transport.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/libfreerdp/core/transport.c b/libfreerdp/core/transport.c
+index d199c31be..2ca146f65 100644
+--- a/libfreerdp/core/transport.c
++++ b/libfreerdp/core/transport.c
+@@ -1646,20 +1646,6 @@ rdpTransport* transport_new(rdpContext* context)
+ 	if (!transport->log)
+ 		goto fail;
+ 
+-	// transport->io.DataHandler = transport_data_handler;
+-	transport->io.TCPConnect = freerdp_tcp_default_connect;
+-	transport->io.TLSConnect = transport_default_connect_tls;
+-	transport->io.TLSAccept = transport_default_accept_tls;
+-	transport->io.TransportAttach = transport_default_attach;
+-	transport->io.TransportDisconnect = transport_default_disconnect;
+-	transport->io.ReadPdu = transport_default_read_pdu;
+-	transport->io.WritePdu = transport_default_write;
+-	transport->io.ReadBytes = transport_read_layer;
+-	transport->io.GetPublicKey = transport_default_get_public_key;
+-	transport->io.SetBlockingMode = transport_default_set_blocking_mode;
+-	transport->io.ConnectLayer = transport_default_connect_layer;
+-	transport->io.AttachLayer = transport_default_attach_layer;
+-
+ 	transport->context = context;
+ 	transport->ReceivePool = StreamPool_New(TRUE, BUFFER_SIZE);
+ 
+@@ -1698,6 +1684,20 @@ rdpTransport* transport_new(rdpContext* context)
+ 	if (!InitializeCriticalSectionAndSpinCount(&(transport->WriteLock), 4000))
+ 		goto fail;
+ 
++	// transport->io.DataHandler = transport_data_handler;
++	transport->io.TCPConnect = freerdp_tcp_default_connect;
++	transport->io.TLSConnect = transport_default_connect_tls;
++	transport->io.TLSAccept = transport_default_accept_tls;
++	transport->io.TransportAttach = transport_default_attach;
++	transport->io.TransportDisconnect = transport_default_disconnect;
++	transport->io.ReadPdu = transport_default_read_pdu;
++	transport->io.WritePdu = transport_default_write;
++	transport->io.ReadBytes = transport_read_layer;
++	transport->io.GetPublicKey = transport_default_get_public_key;
++	transport->io.SetBlockingMode = transport_default_set_blocking_mode;
++	transport->io.ConnectLayer = transport_default_connect_layer;
++	transport->io.AttachLayer = transport_default_attach_layer;
++
+ 	return transport;
+ fail:
+ 	WINPR_PRAGMA_DIAG_PUSH
+-- 
+2.49.0
+

Limit-minimum-threadpool-size.patch

@@ -0,0 +1,51 @@
+From 8fc7acbfd0a1892bc9237ae25e99d32270812dcc Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Mon, 29 Sep 2025 08:37:06 +0200
+Subject: [PATCH] [winpr,pool] limit minimum threadpool size
+
+---
+ winpr/libwinpr/pool/pool.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/winpr/libwinpr/pool/pool.c b/winpr/libwinpr/pool/pool.c
+index cbfc274c5..2cbe9a4fa 100644
+--- a/winpr/libwinpr/pool/pool.c
++++ b/winpr/libwinpr/pool/pool.c
+@@ -129,22 +129,26 @@ static BOOL InitializeThreadpool(PTP_POOL pool)
+ 
+ #if !defined(WINPR_THREADPOOL_DEFAULT_MIN_COUNT)
+ #error "WINPR_THREADPOOL_DEFAULT_MIN_COUNT must be defined"
++#endif
++#if !defined(WINPR_THREADPOOL_DEFAULT_MAX_COUNT)
++#error "WINPR_THREADPOOL_DEFAULT_MAX_COUNT must be defined"
+ #endif
+ 
+ 	SYSTEM_INFO info = { 0 };
+ 	GetSystemInfo(&info);
++
++	DWORD min = info.dwNumberOfProcessors;
++	DWORD max = info.dwNumberOfProcessors;
+ 	if (info.dwNumberOfProcessors < WINPR_THREADPOOL_DEFAULT_MIN_COUNT)
+-		info.dwNumberOfProcessors = WINPR_THREADPOOL_DEFAULT_MIN_COUNT;
++		min = WINPR_THREADPOOL_DEFAULT_MIN_COUNT;
++	if (info.dwNumberOfProcessors > WINPR_THREADPOOL_DEFAULT_MAX_COUNT)
++		max = WINPR_THREADPOOL_DEFAULT_MAX_COUNT;
++	if (min > max)
++		min = max;
+ 
+-	if (!SetThreadpoolThreadMinimum(pool, info.dwNumberOfProcessors))
++	if (!SetThreadpoolThreadMinimum(pool, min))
+ 		goto fail;
+ 
+-#if !defined(WINPR_THREADPOOL_DEFAULT_MAX_COUNT)
+-#error "WINPR_THREADPOOL_DEFAULT_MAX_COUNT must be defined"
+-#endif
+-	DWORD max = info.dwNumberOfProcessors;
+-	if (max > WINPR_THREADPOOL_DEFAULT_MAX_COUNT)
+-		max = WINPR_THREADPOOL_DEFAULT_MAX_COUNT;
+ 	SetThreadpoolThreadMaximum(pool, max);
+ 
+ 	rc = TRUE;
+-- 
+2.51.0
+

Limit-threadpool-to-16-threads.patch

@@ -0,0 +1,60 @@
+From c2fc455d8f2dc60de35ed98cb300b7e6a84fe383 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Wed, 3 Sep 2025 14:03:10 +0200
+Subject: [PATCH 066/100] [winpr,pool] limit threadpool to 16 threads by
+ default
+
+Initialize the threadpool to minimum of number of processors and 16 by
+default.
+---
+ winpr/libwinpr/pool/CMakeLists.txt |  2 ++
+ winpr/libwinpr/pool/pool.c         | 13 +++++++++----
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/winpr/libwinpr/pool/CMakeLists.txt b/winpr/libwinpr/pool/CMakeLists.txt
+index fb2dee58f..cfa9bc891 100644
+--- a/winpr/libwinpr/pool/CMakeLists.txt
++++ b/winpr/libwinpr/pool/CMakeLists.txt
+@@ -15,6 +15,8 @@
+ # See the License for the specific language governing permissions and
+ # limitations under the License.
+ 
++set(WINPR_THREADPOOL_DEFAULT_MAX_COUNT "16" CACHE STRING "The maximum (default) number of threads in a pool")
++winpr_definition_add(WINPR_THREADPOOL_DEFAULT_MAX_COUNT=${WINPR_THREADPOOL_DEFAULT_MAX_COUNT})
+ winpr_module_add(
+   synch.c
+   work.c
+diff --git a/winpr/libwinpr/pool/pool.c b/winpr/libwinpr/pool/pool.c
+index 39bbaaac9..96db6b247 100644
+--- a/winpr/libwinpr/pool/pool.c
++++ b/winpr/libwinpr/pool/pool.c
+@@ -133,7 +133,14 @@ static BOOL InitializeThreadpool(PTP_POOL pool)
+ 		info.dwNumberOfProcessors = 1;
+ 	if (!SetThreadpoolThreadMinimum(pool, info.dwNumberOfProcessors))
+ 		goto fail;
+-	SetThreadpoolThreadMaximum(pool, info.dwNumberOfProcessors);
++
++#if !defined(WINPR_THREADPOOL_DEFAULT_MAX_COUNT)
++#error "WINPR_THREADPOOL_DEFAULT_MAX_COUNT must be defined"
++#endif
++	DWORD max = info.dwNumberOfProcessors;
++	if (max > WINPR_THREADPOOL_DEFAULT_MAX_COUNT)
++		max = WINPR_THREADPOOL_DEFAULT_MAX_COUNT;
++	SetThreadpoolThreadMaximum(pool, max);
+ 
+ 	rc = TRUE;
+ 
+@@ -143,9 +150,7 @@ fail:
+ 
+ PTP_POOL GetDefaultThreadpool(void)
+ {
+-	PTP_POOL pool = NULL;
+-
+-	pool = &DEFAULT_POOL;
++	PTP_POOL pool = &DEFAULT_POOL;
+ 
+ 	if (!InitializeThreadpool(pool))
+ 		return NULL;
+-- 
+2.51.0
+

SOURCES/Revert-Moved-clipboard-utils-to-core-library-fixes-6.patch

@@ -1,560 +0,0 @@
-From a441e68fccc8ef137c9e8e667fed6adaab34ba37 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 1 Oct 2024 15:43:07 +0200
-Subject: [PATCH] Revert "Moved clipboard utils to core library, fixes #6760
- (#7752)"
-
-This reverts commit 26a83e6ccde272c1bbc2b2591325dc7a493811bc.
----
- channels/cliprdr/client/cliprdr_format.c | 195 +++++++++++++++++++
- include/freerdp/channels/cliprdr.h       |  12 +-
- include/freerdp/utils/cliprdr_utils.h    |  48 -----
- libfreerdp/utils/CMakeLists.txt          |   1 -
- libfreerdp/utils/cliprdr_utils.c         | 235 -----------------------
- 5 files changed, 206 insertions(+), 285 deletions(-)
- delete mode 100644 include/freerdp/utils/cliprdr_utils.h
- delete mode 100644 libfreerdp/utils/cliprdr_utils.c
-
-diff --git a/channels/cliprdr/client/cliprdr_format.c b/channels/cliprdr/client/cliprdr_format.c
-index 0b6111b96..4c31a1b08 100644
---- a/channels/cliprdr/client/cliprdr_format.c
-+++ b/channels/cliprdr/client/cliprdr_format.c
-@@ -173,3 +173,198 @@ UINT cliprdr_process_format_data_response(cliprdrPlugin* cliprdr, wStream* s, UI
- 
- 	return error;
- }
-+
-+static UINT64 filetime_to_uint64(FILETIME value)
-+{
-+	UINT64 converted = 0;
-+	converted |= (UINT32)value.dwHighDateTime;
-+	converted <<= 32;
-+	converted |= (UINT32)value.dwLowDateTime;
-+	return converted;
-+}
-+
-+static FILETIME uint64_to_filetime(UINT64 value)
-+{
-+	FILETIME converted;
-+	converted.dwLowDateTime = (UINT32)(value >> 0);
-+	converted.dwHighDateTime = (UINT32)(value >> 32);
-+	return converted;
-+}
-+
-+#define CLIPRDR_FILEDESCRIPTOR_SIZE (4 + 32 + 4 + 16 + 8 + 8 + 520)
-+
-+/**
-+ * Parse a packed file list.
-+ *
-+ * The resulting array must be freed with the `free()` function.
-+ *
-+ * @param [in]  format_data            packed `CLIPRDR_FILELIST` to parse.
-+ * @param [in]  format_data_length     length of `format_data` in bytes.
-+ * @param [out] file_descriptor_array  parsed array of `FILEDESCRIPTOR` structs.
-+ * @param [out] file_descriptor_count  number of elements in `file_descriptor_array`.
-+ *
-+ * @returns 0 on success, otherwise a Win32 error code.
-+ */
-+UINT cliprdr_parse_file_list(const BYTE* format_data, UINT32 format_data_length,
-+                             FILEDESCRIPTORW** file_descriptor_array, UINT32* file_descriptor_count)
-+{
-+	UINT result = NO_ERROR;
-+	UINT32 i;
-+	UINT32 count = 0;
-+	wStream* s = NULL;
-+
-+	if (!format_data || !file_descriptor_array || !file_descriptor_count)
-+		return ERROR_BAD_ARGUMENTS;
-+
-+	s = Stream_New((BYTE*)format_data, format_data_length);
-+	if (!s)
-+		return ERROR_NOT_ENOUGH_MEMORY;
-+
-+	if (Stream_GetRemainingLength(s) < 4)
-+	{
-+		WLog_ERR(TAG, "invalid packed file list");
-+
-+		result = ERROR_INCORRECT_SIZE;
-+		goto out;
-+	}
-+
-+	Stream_Read_UINT32(s, count); /* cItems (4 bytes) */
-+
-+	if (Stream_GetRemainingLength(s) / CLIPRDR_FILEDESCRIPTOR_SIZE < count)
-+	{
-+		WLog_ERR(TAG, "packed file list is too short: expected %" PRIuz ", have %" PRIuz,
-+		         ((size_t)count) * CLIPRDR_FILEDESCRIPTOR_SIZE, Stream_GetRemainingLength(s));
-+
-+		result = ERROR_INCORRECT_SIZE;
-+		goto out;
-+	}
-+
-+	*file_descriptor_count = count;
-+	*file_descriptor_array = calloc(count, sizeof(FILEDESCRIPTORW));
-+	if (!*file_descriptor_array)
-+	{
-+		result = ERROR_NOT_ENOUGH_MEMORY;
-+		goto out;
-+	}
-+
-+	for (i = 0; i < count; i++)
-+	{
-+		int c;
-+		UINT64 lastWriteTime;
-+		FILEDESCRIPTORW* file = &((*file_descriptor_array)[i]);
-+
-+		Stream_Read_UINT32(s, file->dwFlags);          /* flags (4 bytes) */
-+		Stream_Seek(s, 32);                            /* reserved1 (32 bytes) */
-+		Stream_Read_UINT32(s, file->dwFileAttributes); /* fileAttributes (4 bytes) */
-+		Stream_Seek(s, 16);                            /* reserved2 (16 bytes) */
-+		Stream_Read_UINT64(s, lastWriteTime);          /* lastWriteTime (8 bytes) */
-+		file->ftLastWriteTime = uint64_to_filetime(lastWriteTime);
-+		Stream_Read_UINT32(s, file->nFileSizeHigh); /* fileSizeHigh (4 bytes) */
-+		Stream_Read_UINT32(s, file->nFileSizeLow);  /* fileSizeLow (4 bytes) */
-+		for (c = 0; c < 260; c++)                   /* cFileName (520 bytes) */
-+			Stream_Read_UINT16(s, file->cFileName[c]);
-+	}
-+
-+	if (Stream_GetRemainingLength(s) > 0)
-+		WLog_WARN(TAG, "packed file list has %" PRIuz " excess bytes",
-+		          Stream_GetRemainingLength(s));
-+out:
-+	Stream_Free(s, FALSE);
-+
-+	return result;
-+}
-+
-+#define CLIPRDR_MAX_FILE_SIZE (2U * 1024 * 1024 * 1024)
-+
-+/**
-+ * Serialize a packed file list.
-+ *
-+ * The resulting format data must be freed with the `free()` function.
-+ *
-+ * @param [in]  file_descriptor_array  array of `FILEDESCRIPTOR` structs to serialize.
-+ * @param [in]  file_descriptor_count  number of elements in `file_descriptor_array`.
-+ * @param [out] format_data            serialized CLIPRDR_FILELIST.
-+ * @param [out] format_data_length     length of `format_data` in bytes.
-+ *
-+ * @returns 0 on success, otherwise a Win32 error code.
-+ */
-+UINT cliprdr_serialize_file_list(const FILEDESCRIPTORW* file_descriptor_array,
-+                                 UINT32 file_descriptor_count, BYTE** format_data,
-+                                 UINT32* format_data_length)
-+{
-+	return cliprdr_serialize_file_list_ex(CB_STREAM_FILECLIP_ENABLED, file_descriptor_array,
-+	                                      file_descriptor_count, format_data, format_data_length);
-+}
-+
-+UINT cliprdr_serialize_file_list_ex(UINT32 flags, const FILEDESCRIPTORW* file_descriptor_array,
-+                                    UINT32 file_descriptor_count, BYTE** format_data,
-+                                    UINT32* format_data_length)
-+{
-+	UINT result = NO_ERROR;
-+	UINT32 i;
-+	wStream* s = NULL;
-+
-+	if (!file_descriptor_array || !format_data || !format_data_length)
-+		return ERROR_BAD_ARGUMENTS;
-+
-+	if ((flags & CB_STREAM_FILECLIP_ENABLED) == 0)
-+	{
-+		WLog_WARN(TAG, "No file clipboard support annouonced!");
-+		return ERROR_BAD_ARGUMENTS;
-+	}
-+
-+	s = Stream_New(NULL, 4 + file_descriptor_count * CLIPRDR_FILEDESCRIPTOR_SIZE);
-+	if (!s)
-+		return ERROR_NOT_ENOUGH_MEMORY;
-+
-+	Stream_Write_UINT32(s, file_descriptor_count); /* cItems (4 bytes) */
-+
-+	for (i = 0; i < file_descriptor_count; i++)
-+	{
-+		int c;
-+		UINT64 lastWriteTime;
-+		const FILEDESCRIPTORW* file = &file_descriptor_array[i];
-+
-+		/*
-+		 * There is a known issue with Windows server getting stuck in
-+		 * an infinite loop when downloading files that are larger than
-+		 * 2 gigabytes. Do not allow clients to send such file lists.
-+		 *
-+		 * https://support.microsoft.com/en-us/help/2258090
-+		 */
-+		if ((flags & CB_HUGE_FILE_SUPPORT_ENABLED) == 0)
-+		{
-+			if ((file->nFileSizeHigh > 0) || (file->nFileSizeLow >= CLIPRDR_MAX_FILE_SIZE))
-+			{
-+				WLog_ERR(TAG, "cliprdr does not support files over 2 GB");
-+				result = ERROR_FILE_TOO_LARGE;
-+				goto error;
-+			}
-+		}
-+
-+		Stream_Write_UINT32(s, file->dwFlags);          /* flags (4 bytes) */
-+		Stream_Zero(s, 32);                             /* reserved1 (32 bytes) */
-+		Stream_Write_UINT32(s, file->dwFileAttributes); /* fileAttributes (4 bytes) */
-+		Stream_Zero(s, 16);                             /* reserved2 (16 bytes) */
-+		lastWriteTime = filetime_to_uint64(file->ftLastWriteTime);
-+		Stream_Write_UINT64(s, lastWriteTime);       /* lastWriteTime (8 bytes) */
-+		Stream_Write_UINT32(s, file->nFileSizeHigh); /* fileSizeHigh (4 bytes) */
-+		Stream_Write_UINT32(s, file->nFileSizeLow);  /* fileSizeLow (4 bytes) */
-+		for (c = 0; c < 260; c++)                    /* cFileName (520 bytes) */
-+			Stream_Write_UINT16(s, file->cFileName[c]);
-+	}
-+
-+	Stream_SealLength(s);
-+
-+	Stream_GetBuffer(s, *format_data);
-+	Stream_GetLength(s, *format_data_length);
-+
-+	Stream_Free(s, FALSE);
-+
-+	return result;
-+
-+error:
-+	Stream_Free(s, TRUE);
-+
-+	return result;
-+}
-diff --git a/include/freerdp/channels/cliprdr.h b/include/freerdp/channels/cliprdr.h
-index fbf23f6e5..86fc65890 100644
---- a/include/freerdp/channels/cliprdr.h
-+++ b/include/freerdp/channels/cliprdr.h
-@@ -22,7 +22,6 @@
- 
- #include <freerdp/api.h>
- #include <freerdp/types.h>
--#include <freerdp/utils/cliprdr_utils.h>
- 
- #include <winpr/shell.h>
- 
-@@ -94,6 +93,17 @@ extern "C"
- {
- #endif
- 
-+	FREERDP_API UINT cliprdr_parse_file_list(const BYTE* format_data, UINT32 format_data_length,
-+	                                         FILEDESCRIPTORW** file_descriptor_array,
-+	                                         UINT32* file_descriptor_count);
-+	FREERDP_API UINT cliprdr_serialize_file_list(const FILEDESCRIPTORW* file_descriptor_array,
-+	                                             UINT32 file_descriptor_count, BYTE** format_data,
-+	                                             UINT32* format_data_length);
-+	FREERDP_API UINT cliprdr_serialize_file_list_ex(UINT32 flags,
-+	                                                const FILEDESCRIPTORW* file_descriptor_array,
-+	                                                UINT32 file_descriptor_count,
-+	                                                BYTE** format_data, UINT32* format_data_length);
-+
- #ifdef __cplusplus
- }
- #endif
-diff --git a/include/freerdp/utils/cliprdr_utils.h b/include/freerdp/utils/cliprdr_utils.h
-deleted file mode 100644
-index 59ecf848f..000000000
---- a/include/freerdp/utils/cliprdr_utils.h
-+++ /dev/null
-@@ -1,48 +0,0 @@
--/**
-- * FreeRDP: A Remote Desktop Protocol Implementation
-- * RDPDR utility functions
-- *
-- * Copyright 2022 Armin Novak <armin.novak@thincast.com>
-- * Copyright 2022 Thincast Technologies GmbH
-- *
-- * Licensed under the Apache License, Version 2.0 (the "License");
-- * you may not use this file except in compliance with the License.
-- * You may obtain a copy of the License at
-- *
-- *     http://www.apache.org/licenses/LICENSE-2.0
-- *
-- * Unless required by applicable law or agreed to in writing, software
-- * distributed under the License is distributed on an "AS IS" BASIS,
-- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-- * See the License for the specific language governing permissions and
-- * limitations under the License.
-- */
--
--#ifndef FREERDP_UTILS_CLIPRDR_H
--#define FREERDP_UTILS_CLIPRDR_H
--
--#include <winpr/wtypes.h>
--#include <winpr/shell.h>
--#include <freerdp/api.h>
--
--#ifdef __cplusplus
--extern "C"
--{
--#endif
--
--	FREERDP_API UINT cliprdr_parse_file_list(const BYTE* format_data, UINT32 format_data_length,
--	                                         FILEDESCRIPTORW** file_descriptor_array,
--	                                         UINT32* file_descriptor_count);
--	FREERDP_API UINT cliprdr_serialize_file_list(const FILEDESCRIPTORW* file_descriptor_array,
--	                                             UINT32 file_descriptor_count, BYTE** format_data,
--	                                             UINT32* format_data_length);
--	FREERDP_API UINT cliprdr_serialize_file_list_ex(UINT32 flags,
--	                                                const FILEDESCRIPTORW* file_descriptor_array,
--	                                                UINT32 file_descriptor_count,
--	                                                BYTE** format_data, UINT32* format_data_length);
--
--#ifdef __cplusplus
--}
--#endif
--
--#endif
-diff --git a/libfreerdp/utils/CMakeLists.txt b/libfreerdp/utils/CMakeLists.txt
-index 2ec561d33..7bff6736a 100644
---- a/libfreerdp/utils/CMakeLists.txt
-+++ b/libfreerdp/utils/CMakeLists.txt
-@@ -20,7 +20,6 @@ set(MODULE_PREFIX "FREERDP_UTILS")
- 
- set(${MODULE_PREFIX}_SRCS
- 	passphrase.c
--	cliprdr_utils.c
- 	pcap.c
- 	profiler.c
- 	ringbuffer.c
-diff --git a/libfreerdp/utils/cliprdr_utils.c b/libfreerdp/utils/cliprdr_utils.c
-deleted file mode 100644
-index 7fb99d63a..000000000
---- a/libfreerdp/utils/cliprdr_utils.c
-+++ /dev/null
-@@ -1,235 +0,0 @@
--/**
-- * FreeRDP: A Remote Desktop Protocol Implementation
-- * Clipboard Virtual Channel Extension
-- *
-- * Copyright 2013 Marc-Andre Moreau <marcandre.moreau@gmail.com>
-- * Copyright 2022 Armin Novak <anovak@thincast.com
-- * Copyright 2022 Thincast Technologies GmbH
-- *
-- * Licensed under the Apache License, Version 2.0 (the "License");
-- * you may not use this file except in compliance with the License.
-- * You may obtain a copy of the License at
-- *
-- *	 http://www.apache.org/licenses/LICENSE-2.0
-- *
-- * Unless required by applicable law or agreed to in writing, software
-- * distributed under the License is distributed on an "AS IS" BASIS,
-- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-- * See the License for the specific language governing permissions and
-- * limitations under the License.
-- */
--
--#include <winpr/stream.h>
--#include <freerdp/utils/cliprdr_utils.h>
--#include <freerdp/channels/cliprdr.h>
--
--#include <freerdp/log.h>
--#define TAG FREERDP_TAG("utils." CLIPRDR_SVC_CHANNEL_NAME)
--
--#define CLIPRDR_FILEDESCRIPTOR_SIZE (4 + 32 + 4 + 16 + 8 + 8 + 520)
--#define CLIPRDR_MAX_FILE_SIZE (2U * 1024 * 1024 * 1024)
--
--static UINT64 filetime_to_uint64(FILETIME value)
--{
--	UINT64 converted = 0;
--	converted |= (UINT32)value.dwHighDateTime;
--	converted <<= 32;
--	converted |= (UINT32)value.dwLowDateTime;
--	return converted;
--}
--
--static FILETIME uint64_to_filetime(UINT64 value)
--{
--	FILETIME converted;
--	converted.dwLowDateTime = (UINT32)(value >> 0);
--	converted.dwHighDateTime = (UINT32)(value >> 32);
--	return converted;
--}
--
--/**
-- * Parse a packed file list.
-- *
-- * The resulting array must be freed with the `free()` function.
-- *
-- * @param [in]  format_data            packed `CLIPRDR_FILELIST` to parse.
-- * @param [in]  format_data_length     length of `format_data` in bytes.
-- * @param [out] file_descriptor_array  parsed array of `FILEDESCRIPTOR` structs.
-- * @param [out] file_descriptor_count  number of elements in `file_descriptor_array`.
-- *
-- * @returns 0 on success, otherwise a Win32 error code.
-- */
--UINT cliprdr_parse_file_list(const BYTE* format_data, UINT32 format_data_length,
--                             FILEDESCRIPTORW** file_descriptor_array, UINT32* file_descriptor_count)
--{
--	UINT result = NO_ERROR;
--	UINT32 i;
--	UINT32 count = 0;
--	wStream sbuffer;
--	wStream* s = &sbuffer;
--
--	if (!format_data || !file_descriptor_array || !file_descriptor_count)
--		return ERROR_BAD_ARGUMENTS;
--
--	Stream_StaticInit(&sbuffer, format_data, format_data_length);
--	if (!s)
--		return ERROR_NOT_ENOUGH_MEMORY;
--
--	if (Stream_GetRemainingLength(s) < 4)
--	{
--		WLog_ERR(TAG, "invalid packed file list");
--
--		result = ERROR_INCORRECT_SIZE;
--		goto out;
--	}
--
--	Stream_Read_UINT32(s, count); /* cItems (4 bytes) */
--
--	if (Stream_GetRemainingLength(s) / CLIPRDR_FILEDESCRIPTOR_SIZE < count)
--	{
--		WLog_ERR(TAG, "packed file list is too short: expected %" PRIuz ", have %" PRIuz,
--		         ((size_t)count) * CLIPRDR_FILEDESCRIPTOR_SIZE, Stream_GetRemainingLength(s));
--
--		result = ERROR_INCORRECT_SIZE;
--		goto out;
--	}
--
--	*file_descriptor_count = count;
--	*file_descriptor_array = calloc(count, sizeof(FILEDESCRIPTORW));
--	if (!*file_descriptor_array)
--	{
--		result = ERROR_NOT_ENOUGH_MEMORY;
--		goto out;
--	}
--
--	for (i = 0; i < count; i++)
--	{
--		UINT64 tmp;
--		FILEDESCRIPTORW* file = &((*file_descriptor_array)[i]);
--
--		Stream_Read_UINT32(s, file->dwFlags);          /* flags (4 bytes) */
--		Stream_Read_UINT32(s, file->clsid.Data1);
--		Stream_Read_UINT16(s, file->clsid.Data2);
--		Stream_Read_UINT16(s, file->clsid.Data3);
--		Stream_Read(s, &file->clsid.Data4, sizeof(file->clsid.Data4));
--		Stream_Read_INT32(s, file->sizel.cx);
--		Stream_Read_INT32(s, file->sizel.cy);
--		Stream_Read_INT32(s, file->pointl.x);
--		Stream_Read_INT32(s, file->pointl.y);
--		Stream_Read_UINT32(s, file->dwFileAttributes); /* fileAttributes (4 bytes) */
--		Stream_Read_UINT64(s, tmp);                    /* ftCreationTime (8 bytes) */
--		file->ftCreationTime = uint64_to_filetime(tmp);
--		Stream_Read_UINT64(s, tmp); /* ftLastAccessTime (8 bytes) */
--		file->ftLastAccessTime = uint64_to_filetime(tmp);
--		Stream_Read_UINT64(s, tmp); /* lastWriteTime (8 bytes) */
--		file->ftLastWriteTime = uint64_to_filetime(tmp);
--		Stream_Read_UINT32(s, file->nFileSizeHigh); /* fileSizeHigh (4 bytes) */
--		Stream_Read_UINT32(s, file->nFileSizeLow);  /* fileSizeLow (4 bytes) */
--		Stream_Read_UTF16_String(s, file->cFileName,
--		                         ARRAYSIZE(file->cFileName)); /* cFileName (520 bytes) */
--	}
--
--	if (Stream_GetRemainingLength(s) > 0)
--		WLog_WARN(TAG, "packed file list has %" PRIuz " excess bytes",
--		          Stream_GetRemainingLength(s));
--out:
--
--	return result;
--}
--
--/**
-- * Serialize a packed file list.
-- *
-- * The resulting format data must be freed with the `free()` function.
-- *
-- * @param [in]  file_descriptor_array  array of `FILEDESCRIPTOR` structs to serialize.
-- * @param [in]  file_descriptor_count  number of elements in `file_descriptor_array`.
-- * @param [out] format_data            serialized CLIPRDR_FILELIST.
-- * @param [out] format_data_length     length of `format_data` in bytes.
-- *
-- * @returns 0 on success, otherwise a Win32 error code.
-- */
--UINT cliprdr_serialize_file_list(const FILEDESCRIPTORW* file_descriptor_array,
--                                 UINT32 file_descriptor_count, BYTE** format_data,
--                                 UINT32* format_data_length)
--{
--	return cliprdr_serialize_file_list_ex(CB_STREAM_FILECLIP_ENABLED, file_descriptor_array,
--	                                      file_descriptor_count, format_data, format_data_length);
--}
--
--UINT cliprdr_serialize_file_list_ex(UINT32 flags, const FILEDESCRIPTORW* file_descriptor_array,
--                                    UINT32 file_descriptor_count, BYTE** format_data,
--                                    UINT32* format_data_length)
--{
--	UINT result = NO_ERROR;
--	UINT32 i;
--	size_t len;
--	wStream* s = NULL;
--
--	if (!file_descriptor_array || !format_data || !format_data_length)
--		return ERROR_BAD_ARGUMENTS;
--
--	if ((flags & CB_STREAM_FILECLIP_ENABLED) == 0)
--	{
--		WLog_WARN(TAG, "No file clipboard support annouonced!");
--		return ERROR_BAD_ARGUMENTS;
--	}
--
--	s = Stream_New(NULL, 4 + file_descriptor_count * CLIPRDR_FILEDESCRIPTOR_SIZE);
--	if (!s)
--		return ERROR_NOT_ENOUGH_MEMORY;
--
--	Stream_Write_UINT32(s, file_descriptor_count); /* cItems (4 bytes) */
--
--	for (i = 0; i < file_descriptor_count; i++)
--	{
--		int c;
--		UINT64 lastWriteTime;
--		const FILEDESCRIPTORW* file = &file_descriptor_array[i];
--
--		/*
--		 * There is a known issue with Windows server getting stuck in
--		 * an infinite loop when downloading files that are larger than
--		 * 2 gigabytes. Do not allow clients to send such file lists.
--		 *
--		 * https://support.microsoft.com/en-us/help/2258090
--		 */
--		if ((flags & CB_HUGE_FILE_SUPPORT_ENABLED) == 0)
--		{
--			if ((file->nFileSizeHigh > 0) || (file->nFileSizeLow >= CLIPRDR_MAX_FILE_SIZE))
--			{
--				WLog_ERR(TAG, "cliprdr does not support files over 2 GB");
--				result = ERROR_FILE_TOO_LARGE;
--				goto error;
--			}
--		}
--
--		Stream_Write_UINT32(s, file->dwFlags);          /* flags (4 bytes) */
--		Stream_Zero(s, 32);                             /* reserved1 (32 bytes) */
--		Stream_Write_UINT32(s, file->dwFileAttributes); /* fileAttributes (4 bytes) */
--		Stream_Zero(s, 16);                             /* reserved2 (16 bytes) */
--		lastWriteTime = filetime_to_uint64(file->ftLastWriteTime);
--		Stream_Write_UINT64(s, lastWriteTime);       /* lastWriteTime (8 bytes) */
--		Stream_Write_UINT32(s, file->nFileSizeHigh); /* fileSizeHigh (4 bytes) */
--		Stream_Write_UINT32(s, file->nFileSizeLow);  /* fileSizeLow (4 bytes) */
--		for (c = 0; c < 260; c++)                    /* cFileName (520 bytes) */
--			Stream_Write_UINT16(s, file->cFileName[c]);
--	}
--
--	Stream_SealLength(s);
--
--	Stream_GetBuffer(s, *format_data);
--	Stream_GetLength(s, len);
--	if (len > UINT32_MAX)
--		goto error;
--
--	*format_data_length = (UINT32)len;
--
--	Stream_Free(s, FALSE);
--
--	return result;
--
--error:
--	Stream_Free(s, TRUE);
--
--	return result;
--}
--- 
-2.46.1
-

SOURCES/cache-offscreen-invalidate-bitmap-before-free.patch

@@ -1,46 +0,0 @@
-From 4a4126380430a3517d1015b628475b816705ceb4 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 22 Jan 2026 12:52:16 +0100
-Subject: [PATCH] [cache,offscreen] invalidate bitmap before free
-
-Backport of commit 52106a26726a2aba77aa6d86014d2eb3507f0783.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
----
- libfreerdp/cache/offscreen.c | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/libfreerdp/cache/offscreen.c b/libfreerdp/cache/offscreen.c
-index cdad56b4d..11e6caf21 100644
---- a/libfreerdp/cache/offscreen.c
-+++ b/libfreerdp/cache/offscreen.c
-@@ -160,7 +160,7 @@ void offscreen_cache_put(rdpOffscreenCache* offscreenCache, UINT32 index, rdpBit
- 
- void offscreen_cache_delete(rdpOffscreenCache* offscreenCache, UINT32 index)
- {
--	rdpBitmap* prevBitmap;
-+	WINPR_ASSERT(offscreenCache);
- 
- 	if (index >= offscreenCache->maxEntries)
- 	{
-@@ -168,10 +168,16 @@ void offscreen_cache_delete(rdpOffscreenCache* offscreenCache, UINT32 index)
- 		return;
- 	}
- 
--	prevBitmap = offscreenCache->entries[index];
-+	rdpBitmap* prevBitmap = offscreenCache->entries[index];
- 
- 	if (prevBitmap != NULL)
-+	{
-+		WINPR_ASSERT(offscreenCache->update->context);
-+
-+		/* Ensure that the bitmap is no longer used in GDI */
-+		IFCALL(prevBitmap->SetSurface, offscreenCache->update->context, NULL, FALSE);
- 		Bitmap_Free(offscreenCache->update->context, prevBitmap);
-+	}
- 
- 	offscreenCache->entries[index] = NULL;
- }
--- 
-2.52.0
-

SOURCES/channel-rdpsnd-only-clean-up-thread-before-free.patch

@@ -1,117 +0,0 @@
-From b96bfa485a286335bcb4c698fa6490fb4a98b9e6 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Fri, 13 Mar 2026 15:47:11 +0100
-Subject: [PATCH] [channel,rdpsnd] only clean up thread before free
-
-Backport of commit afa6851dc80835d3101e40fcef51b6c5c0f43ea5.
-
-Made-with: Cursor
----
- channels/rdpsnd/client/rdpsnd_main.c | 37 ++++++++++++++++------------
- 1 file changed, 21 insertions(+), 16 deletions(-)
-
-diff --git a/channels/rdpsnd/client/rdpsnd_main.c b/channels/rdpsnd/client/rdpsnd_main.c
-index c7660a857..576e065d2 100644
---- a/channels/rdpsnd/client/rdpsnd_main.c
-+++ b/channels/rdpsnd/client/rdpsnd_main.c
-@@ -133,6 +133,8 @@ struct rdpsnd_plugin
- 	BOOL applyVolume;
- };
- 
-+static DWORD WINAPI play_thread(LPVOID arg);
-+
- static const char* rdpsnd_is_dyn_str(BOOL dynamic)
- {
- 	if (dynamic)
-@@ -1267,7 +1269,6 @@ static void cleanup_internals(rdpsndPlugin* rdpsnd)
- 	if (!rdpsnd)
- 		return;
- 
--	rdpsnd_terminate_thread(rdpsnd);
- 	if (rdpsnd->pool)
- 		StreamPool_Return(rdpsnd->pool, rdpsnd->data_in);
- 
-@@ -1331,6 +1332,7 @@ static void free_internals(rdpsndPlugin* rdpsnd)
- 	if (!rdpsnd)
- 		return;
- 
-+	rdpsnd_terminate_thread(rdpsnd);
- 	freerdp_dsp_context_free(rdpsnd->dsp_context);
- 	StreamPool_Free(rdpsnd->pool);
- 	rdpsnd->pool = NULL;
-@@ -1353,6 +1355,23 @@ static BOOL allocate_internals(rdpsndPlugin* rdpsnd)
- 			return FALSE;
- 	}
- 
-+	if (!rdpsnd->queue)
-+	{
-+		wObject obj = { 0 };
-+
-+		obj.fnObjectFree = _queue_free;
-+		rdpsnd->queue = MessageQueue_New(&obj);
-+		if (!rdpsnd->queue)
-+			return FALSE;
-+	}
-+
-+	if (!rdpsnd->thread)
-+	{
-+		rdpsnd->thread = CreateThread(NULL, 0, play_thread, rdpsnd, 0, NULL);
-+		if (!rdpsnd->thread)
-+			return FALSE;
-+	}
-+
- 	return TRUE;
- }
- 
-@@ -1391,23 +1410,12 @@ static DWORD WINAPI play_thread(LPVOID arg)
- 
- static UINT rdpsnd_virtual_channel_event_initialized(rdpsndPlugin* rdpsnd)
- {
--	wObject obj = { 0 };
--
- 	if (!rdpsnd)
- 		return ERROR_INVALID_PARAMETER;
- 
--	obj.fnObjectFree = _queue_free;
--	rdpsnd->queue = MessageQueue_New(&obj);
--	if (!rdpsnd->queue)
--		return CHANNEL_RC_NO_MEMORY;
--
- 	if (!allocate_internals(rdpsnd))
- 		return CHANNEL_RC_NO_MEMORY;
- 
--	rdpsnd->thread = CreateThread(NULL, 0, play_thread, rdpsnd, 0, NULL);
--	if (!rdpsnd->thread)
--		return CHANNEL_RC_INITIALIZATION_ERROR;
--
- 	return CHANNEL_RC_OK;
- }
- 
-@@ -1415,8 +1423,6 @@ void rdpsnd_virtual_channel_event_terminated(rdpsndPlugin* rdpsnd)
- {
- 	if (rdpsnd)
- 	{
--		rdpsnd_terminate_thread(rdpsnd);
--
- 		free_internals(rdpsnd);
- 		audio_formats_free(rdpsnd->fixed_format, 1);
- 		free(rdpsnd->subsystem);
-@@ -1604,14 +1610,13 @@ static UINT rdpsnd_on_close(IWTSVirtualChannelCallback* pChannelCallback)
- 		IFCALL(rdpsnd->device->Close, rdpsnd->device);
- 
- 	cleanup_internals(rdpsnd);
--
-+	free_internals(rdpsnd);
- 	if (rdpsnd->device)
- 	{
- 		IFCALL(rdpsnd->device->Free, rdpsnd->device);
- 		rdpsnd->device = NULL;
- 	}
- 
--	free_internals(rdpsnd);
- 	free(pChannelCallback);
- 	return CHANNEL_RC_OK;
- }
--- 
-2.53.0
-

SOURCES/channels-ainput-lock-context-when-updating-listener.patch

@@ -1,132 +0,0 @@
-From 6bf4e2558861e06fd68ef8036796ff475a1c23fa Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Fri, 13 Mar 2026 15:24:09 +0100
-Subject: [PATCH] [channels,ainput] lock context when updating listener
-
-Backport of commit d9ca272dce7a776ab475e9b1a8e8c3d2968c8486.
-
-Made-with: Cursor
----
- channels/ainput/client/ainput_main.c | 38 ++++++++++++++++++++--------
- 1 file changed, 27 insertions(+), 11 deletions(-)
-
-diff --git a/channels/ainput/client/ainput_main.c b/channels/ainput/client/ainput_main.c
-index d8eb8ec59..ff901d2a0 100644
---- a/channels/ainput/client/ainput_main.c
-+++ b/channels/ainput/client/ainput_main.c
-@@ -28,6 +28,7 @@
- #include <winpr/crt.h>
- #include <winpr/assert.h>
- #include <winpr/stream.h>
-+#include <winpr/synch.h>
- #include <winpr/sysinfo.h>
- 
- #include "ainput_main.h"
-@@ -69,6 +70,7 @@ struct AINPUT_PLUGIN_
- 	UINT32 MajorVersion;
- 	UINT32 MinorVersion;
- 	BOOL initialized;
-+	CRITICAL_SECTION lock;
- };
- 
- /**
-@@ -109,10 +111,7 @@ static UINT ainput_on_data_received(IWTSVirtualChannelCallback* pChannelCallback
- 
- static UINT ainput_send_input_event(AInputClientContext* context, UINT64 flags, INT32 x, INT32 y)
- {
--	AINPUT_PLUGIN* ainput;
--	AINPUT_CHANNEL_CALLBACK* callback;
- 	BYTE buffer[32] = { 0 };
--	UINT64 time;
- 	wStream sbuffer = { 0 };
- 	wStream* s = &sbuffer;
- 
-@@ -121,8 +120,8 @@ static UINT ainput_send_input_event(AInputClientContext* context, UINT64 flags,
- 	WINPR_ASSERT(s);
- 	WINPR_ASSERT(context);
- 
--	time = GetTickCount64();
--	ainput = (AINPUT_PLUGIN*)context->handle;
-+	const UINT64 time = GetTickCount64();
-+	AINPUT_PLUGIN* ainput = (AINPUT_PLUGIN*)context->handle;
- 	WINPR_ASSERT(ainput);
- 	WINPR_ASSERT(ainput->listener_callback);
- 
-@@ -132,8 +131,6 @@ static UINT ainput_send_input_event(AInputClientContext* context, UINT64 flags,
- 		          ainput->MajorVersion, ainput->MinorVersion);
- 		return CHANNEL_RC_UNSUPPORTED_VERSION;
- 	}
--	callback = ainput->listener_callback->channel_callback;
--	WINPR_ASSERT(callback);
- 
- 	{
- 		char buffer[128] = { 0 };
-@@ -152,10 +149,15 @@ static UINT ainput_send_input_event(AInputClientContext* context, UINT64 flags,
- 	Stream_SealLength(s);
- 
- 	/* ainput back what we have received. AINPUT does not have any message IDs. */
-+	EnterCriticalSection(&ainput->lock);
-+	AINPUT_CHANNEL_CALLBACK* callback = ainput->listener_callback->channel_callback;
-+	WINPR_ASSERT(callback);
- 	WINPR_ASSERT(callback->channel);
- 	WINPR_ASSERT(callback->channel->Write);
--	return callback->channel->Write(callback->channel, (ULONG)Stream_Length(s), Stream_Buffer(s),
--	                                NULL);
-+	const UINT rc = callback->channel->Write(callback->channel, (ULONG)Stream_Length(s),
-+	                                         Stream_Buffer(s), NULL);
-+	LeaveCriticalSection(&ainput->lock);
-+	return rc;
- }
- 
- /**
-@@ -167,8 +169,16 @@ static UINT ainput_on_close(IWTSVirtualChannelCallback* pChannelCallback)
- {
- 	AINPUT_CHANNEL_CALLBACK* callback = (AINPUT_CHANNEL_CALLBACK*)pChannelCallback;
- 
--	free(callback);
-+	if (callback)
-+	{
-+		AINPUT_PLUGIN* ainput = (AINPUT_PLUGIN*)callback->plugin;
-+		WINPR_ASSERT(ainput);
- 
-+		/* Lock here to ensure that no ainput_send_input_event is in progress. */
-+		EnterCriticalSection(&ainput->lock);
-+		free(callback);
-+		LeaveCriticalSection(&ainput->lock);
-+	}
- 	return CHANNEL_RC_OK;
- }
- 
-@@ -255,6 +265,7 @@ static UINT ainput_plugin_initialize(IWTSPlugin* pPlugin, IWTSVirtualChannelMana
- static UINT ainput_plugin_terminated(IWTSPlugin* pPlugin)
- {
- 	AINPUT_PLUGIN* ainput = (AINPUT_PLUGIN*)pPlugin;
-+
- 	if (ainput && ainput->listener_callback)
- 	{
- 		IWTSVirtualChannelManager* mgr = ainput->listener_callback->channel_mgr;
-@@ -263,6 +274,7 @@ static UINT ainput_plugin_terminated(IWTSPlugin* pPlugin)
- 	}
- 	if (ainput)
- 	{
-+		DeleteCriticalSection(&ainput->lock);
- 		free(ainput->listener_callback);
- 		free(ainput->iface.pInterface);
- 	}
-@@ -306,8 +318,12 @@ UINT DVCPluginEntry(IDRDYNVC_ENTRY_POINTS* pEntryPoints)
- 
- 		context->handle = (void*)ainput;
- 		context->AInputSendInputEvent = ainput_send_input_event;
--		ainput->iface.pInterface = (void*)context;
- 
-+		InitializeCriticalSection(&ainput->lock);
-+
-+		EnterCriticalSection(&ainput->lock);
-+		ainput->iface.pInterface = (void*)context;
-+		LeaveCriticalSection(&ainput->lock);
- 		status = pEntryPoints->RegisterPlugin(pEntryPoints, AINPUT_CHANNEL_NAME, &ainput->iface);
- 	}
- 
--- 
-2.53.0
-

SOURCES/channels-audin-free-up-old-audio-formats.patch

@@ -1,27 +0,0 @@
-From cd1ffa112cfbe1b40a9fd57e299a8ea12e23df0d Mon Sep 17 00:00:00 2001
-From: akallabeth <akallabeth@posteo.net>
-Date: Sat, 10 Jan 2026 08:36:38 +0100
-Subject: [PATCH] [channels,audin] free up old audio formats
-
----
- channels/audin/client/audin_main.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/channels/audin/client/audin_main.c b/channels/audin/client/audin_main.c
-index bcaf1a646..b4c8ba580 100644
---- a/channels/audin/client/audin_main.c
-+++ b/channels/audin/client/audin_main.c
-@@ -206,6 +206,10 @@ static UINT audin_process_formats(AUDIN_PLUGIN* audin, AUDIN_CHANNEL_CALLBACK* c
- 	}
- 
- 	Stream_Seek_UINT32(s); /* cbSizeFormatsPacket */
-+
-+	audio_formats_free(callback->formats, callback->formats_count);
-+	callback->formats_count = 0;
-+
- 	callback->formats = audio_formats_new(NumFormats);
- 
- 	if (!callback->formats)
--- 
-2.53.0
-

SOURCES/channels-audin-reset-audin-format.patch

@@ -1,33 +0,0 @@
-From fa33edf53a2087c106b2801745bdff0f4a589425 Mon Sep 17 00:00:00 2001
-From: akallabeth <akallabeth@posteo.net>
-Date: Mon, 26 Jan 2026 10:20:23 +0100
-Subject: [PATCH] [channels,audin] reset audin->format
-
-Whenever the underlying structure changes reset the pointer to NULL
----
- channels/audin/client/audin_main.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/channels/audin/client/audin_main.c b/channels/audin/client/audin_main.c
-index 5ffe09127..332aef9da 100644
---- a/channels/audin/client/audin_main.c
-+++ b/channels/audin/client/audin_main.c
-@@ -220,6 +220,7 @@ static UINT audin_process_formats(AUDIN_PLUGIN* audin, AUDIN_CHANNEL_CALLBACK* c
- 
- 	Stream_Seek_UINT32(s); /* cbSizeFormatsPacket */
- 
-+	audin->format = NULL;
- 	audio_formats_free(callback->formats, callback->formats_count);
- 	callback->formats_count = 0;
- 
-@@ -297,6 +298,7 @@ out:
- 
- 	if (error != CHANNEL_RC_OK)
- 	{
-+		audin->format = NULL;
- 		audio_formats_free(callback->formats, NumFormats);
- 		callback->formats = NULL;
- 	}
--- 
-2.53.0
-

SOURCES/channels-drdynvc-reset-channel_callback-before-close.patch

@@ -1,34 +0,0 @@
-From 7865a2832ebdfd04374c787c917b3ea7f078ba2c Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Wed, 11 Mar 2026 16:55:44 +0100
-Subject: [PATCH] [channels,drdynvc] reset channel_callback before close
-
-Backport of commit e02e052f6692550e539d10f99de9c35a23492db2.
-
-Made-with: Cursor
----
- channels/drdynvc/client/drdynvc_main.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/channels/drdynvc/client/drdynvc_main.c b/channels/drdynvc/client/drdynvc_main.c
-index b2005a903..0a4af7179 100644
---- a/channels/drdynvc/client/drdynvc_main.c
-+++ b/channels/drdynvc/client/drdynvc_main.c
-@@ -346,10 +346,11 @@ static void dvcman_channel_free(void* arg)
- 
- 	if (channel)
- 	{
--		if (channel->channel_callback)
-+		IWTSVirtualChannelCallback* cb = channel->channel_callback;
-+		channel->channel_callback = NULL;
-+		if (cb)
- 		{
--			IFCALL(channel->channel_callback->OnClose, channel->channel_callback);
--			channel->channel_callback = NULL;
-+			IFCALL(cb->OnClose, cb);
- 		}
- 
- 		if (channel->status == CHANNEL_RC_OK)
--- 
-2.53.0
-

SOURCES/channels-drive-fix-constant-type.patch

@@ -1,26 +0,0 @@
-From 3da319570c8a6be0a79b3306f1ed354c4a943259 Mon Sep 17 00:00:00 2001
-From: akallabeth <akallabeth@posteo.net>
-Date: Mon, 12 Jan 2026 03:44:06 +0100
-Subject: [PATCH] [channels,drive] fix constant type
-
-ensure constant is of 64bit integer type
----
- channels/drive/client/drive_main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/channels/drive/client/drive_main.c b/channels/drive/client/drive_main.c
-index 1dce5c348..13188fbc6 100644
---- a/channels/drive/client/drive_main.c
-+++ b/channels/drive/client/drive_main.c
-@@ -302,7 +302,7 @@ static UINT drive_process_irp_read(DRIVE_DEVICE* drive, IRP* irp)
- 		Length = 0;
- 	}
- 
--	if (!Stream_EnsureRemainingCapacity(irp->output, Length + 4))
-+	if (!Stream_EnsureRemainingCapacity(irp->output, 4ull + Length))
- 	{
- 		WLog_ERR(TAG, "Stream_EnsureRemainingCapacity failed!");
- 		return ERROR_INTERNAL_ERROR;
--- 
-2.53.0
-

SOURCES/channels-rdpsnd-terminate-thread-before-free.patch

@@ -1,73 +0,0 @@
-From c9f2b4222cf51a259b77ed4e83c45f6a08884cb8 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Fri, 13 Mar 2026 15:46:17 +0100
-Subject: [PATCH] [channels,rdpsnd] terminate thread before free
-
-Backport of commit 622bb7b4402491ca003f47472d0e478132673696.
-
-Made-with: Cursor
----
- channels/rdpsnd/client/rdpsnd_main.c | 28 ++++++++++++++++++++--------
- 1 file changed, 20 insertions(+), 8 deletions(-)
-
-diff --git a/channels/rdpsnd/client/rdpsnd_main.c b/channels/rdpsnd/client/rdpsnd_main.c
-index 3de4cbc66..c7660a857 100644
---- a/channels/rdpsnd/client/rdpsnd_main.c
-+++ b/channels/rdpsnd/client/rdpsnd_main.c
-@@ -36,6 +36,7 @@
- #include <string.h>
- #include <errno.h>
- 
-+#include <winpr/assert.h>
- #include <winpr/crt.h>
- #include <winpr/wlog.h>
- #include <winpr/stream.h>
-@@ -1244,11 +1245,29 @@ fail:
- 	return CHANNEL_RC_NO_MEMORY;
- }
- 
-+static void rdpsnd_terminate_thread(rdpsndPlugin* rdpsnd)
-+{
-+	WINPR_ASSERT(rdpsnd);
-+	if (rdpsnd->queue)
-+		MessageQueue_PostQuit(rdpsnd->queue, 0);
-+
-+	if (rdpsnd->thread)
-+	{
-+		(void)WaitForSingleObject(rdpsnd->thread, INFINITE);
-+		(void)CloseHandle(rdpsnd->thread);
-+	}
-+
-+	MessageQueue_Free(rdpsnd->queue);
-+	rdpsnd->thread = NULL;
-+	rdpsnd->queue = NULL;
-+}
-+
- static void cleanup_internals(rdpsndPlugin* rdpsnd)
- {
- 	if (!rdpsnd)
- 		return;
- 
-+	rdpsnd_terminate_thread(rdpsnd);
- 	if (rdpsnd->pool)
- 		StreamPool_Return(rdpsnd->pool, rdpsnd->data_in);
- 
-@@ -1396,14 +1415,7 @@ void rdpsnd_virtual_channel_event_terminated(rdpsndPlugin* rdpsnd)
- {
- 	if (rdpsnd)
- 	{
--		if (rdpsnd->queue)
--			MessageQueue_PostQuit(rdpsnd->queue, 0);
--		if (rdpsnd->thread)
--		{
--			WaitForSingleObject(rdpsnd->thread, INFINITE);
--			CloseHandle(rdpsnd->thread);
--		}
--		MessageQueue_Free(rdpsnd->queue);
-+		rdpsnd_terminate_thread(rdpsnd);
- 
- 		free_internals(rdpsnd);
- 		audio_formats_free(rdpsnd->fixed_format, 1);
--- 
-2.53.0
-

SOURCES/channels-serial-explicitly-lock-serial-IrpThreads.patch

@@ -1,55 +0,0 @@
-From c0283812c918c7738facafac52cf51d916536138 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 10 Mar 2026 08:47:57 +0100
-Subject: [PATCH] [channels,serial] explicitly lock serial->IrpThreads
-
-Backport of commit 675c20f08f32ca5ec06297108bdf30147d6e2cd9.
-
-Made-with: Cursor
----
- channels/serial/client/serial_main.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/channels/serial/client/serial_main.c b/channels/serial/client/serial_main.c
-index d76d725f1..c8a27c46c 100644
---- a/channels/serial/client/serial_main.c
-+++ b/channels/serial/client/serial_main.c
-@@ -597,7 +597,10 @@ static void create_irp_thread(SERIAL_DEVICE* serial, IRP* irp)
- 	 * observed with FreeRDP).
- 	 */
- 	key = irp->CompletionId;
-+
-+	ListDictionary_Lock(serial->IrpThreads);
- 	previousIrpThread = ListDictionary_GetItemValue(serial->IrpThreads, (void*)key);
-+	ListDictionary_Unlock(serial->IrpThreads);
- 
- 	if (previousIrpThread)
- 	{
-@@ -678,6 +681,7 @@ static void terminate_pending_irp_threads(SERIAL_DEVICE* serial)
- {
- 	ULONG_PTR* ids;
- 	int i, nbIds;
-+	ListDictionary_Lock(serial->IrpThreads);
- 	nbIds = ListDictionary_GetKeys(serial->IrpThreads, &ids);
- 	WLog_Print(serial->log, WLOG_DEBUG, "Terminating %d IRP thread(s)", nbIds);
- 
-@@ -699,6 +703,7 @@ static void terminate_pending_irp_threads(SERIAL_DEVICE* serial)
- 	}
- 
- 	ListDictionary_Clear(serial->IrpThreads);
-+	ListDictionary_Unlock(serial->IrpThreads);
- 	free(ids);
- }
- 
-@@ -932,7 +937,7 @@ UINT DeviceServiceEntry(PDEVICE_SERVICE_ENTRY_POINTS pEntryPoints)
- 		}
- 
- 		/* IrpThreads content only modified by create_irp_thread() */
--		serial->IrpThreads = ListDictionary_New(TRUE);
-+		serial->IrpThreads = ListDictionary_New(FALSE);
- 
- 		if (!serial->IrpThreads)
- 		{
--- 
-2.53.0
-

SOURCES/channels-serial-lock-list-dictionary.patch

@@ -1,89 +0,0 @@
-From 7cf742159bd2675366c7187c4bc51018b548d228 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 10 Mar 2026 08:47:45 +0100
-Subject: [PATCH] [channels,serial] lock list dictionary
-
-Backport of commit b35aa3614d32bff3fc1272cd7c4617f711fca1a4.
-
-Made-with: Cursor
----
- channels/serial/client/serial_main.c | 35 ++++++++++++++++------------
- 1 file changed, 20 insertions(+), 15 deletions(-)
-
-diff --git a/channels/serial/client/serial_main.c b/channels/serial/client/serial_main.c
-index afe67b4d3..d76d725f1 100644
---- a/channels/serial/client/serial_main.c
-+++ b/channels/serial/client/serial_main.c
-@@ -540,6 +540,7 @@ static void create_irp_thread(SERIAL_DEVICE* serial, IRP* irp)
- 		HANDLE irpThread;
- 		ULONG_PTR* ids;
- 		int i, nbIds;
-+		ListDictionary_Lock(serial->IrpThreads);
- 		nbIds = ListDictionary_GetKeys(serial->IrpThreads, &ids);
- 
- 		for (i = 0; i < nbIds; i++)
-@@ -581,6 +582,7 @@ static void create_irp_thread(SERIAL_DEVICE* serial, IRP* irp)
- 		}
- 
- 		free(ids);
-+		ListDictionary_Unlock(serial->IrpThreads);
- 	}
- 
- 	LeaveCriticalSection(&serial->TerminatingIrpThreadsLock);
-@@ -621,19 +623,6 @@ static void create_irp_thread(SERIAL_DEVICE* serial, IRP* irp)
- 		return;
- 	}
- 
--	if (ListDictionary_Count(serial->IrpThreads) >= MAX_IRP_THREADS)
--	{
--		WLog_Print(serial->log, WLOG_WARN,
--		           "Number of IRP threads threshold reached: %d, keep on anyway",
--		           ListDictionary_Count(serial->IrpThreads));
--		assert(FALSE); /* unimplemented */
--		               /* TODO: MAX_IRP_THREADS has been thought to avoid a
--		                * flooding of pending requests. Use
--		                * WaitForMultipleObjects() when available in winpr
--		                * for threads.
--		                */
--	}
--
- 	/* error_handle to be used ... */
- 	data = (IRP_THREAD_DATA*)calloc(1, sizeof(IRP_THREAD_DATA));
- 
-@@ -656,7 +645,23 @@ static void create_irp_thread(SERIAL_DEVICE* serial, IRP* irp)
- 
- 	key = irp->CompletionId;
- 
--	if (!ListDictionary_Add(serial->IrpThreads, (void*)key, irpThread))
-+	ListDictionary_Lock(serial->IrpThreads);
-+	if (ListDictionary_Count(serial->IrpThreads) >= MAX_IRP_THREADS)
-+	{
-+		WLog_Print(serial->log, WLOG_WARN,
-+		           "Number of IRP threads threshold reached: %d, keep on anyway",
-+		           ListDictionary_Count(serial->IrpThreads));
-+		assert(FALSE); /* unimplemented */
-+		               /* TODO: MAX_IRP_THREADS has been thought to avoid a
-+		                * flooding of pending requests. Use
-+		                * WaitForMultipleObjects() when available in winpr
-+		                * for threads.
-+		                */
-+	}
-+	const BOOL added = ListDictionary_Add(serial->IrpThreads, (void*)key, irpThread);
-+	ListDictionary_Unlock(serial->IrpThreads);
-+
-+	if (!added)
- 	{
- 		WLog_ERR(TAG, "ListDictionary_Add failed!");
- 		goto error_handle;
-@@ -927,7 +932,7 @@ UINT DeviceServiceEntry(PDEVICE_SERVICE_ENTRY_POINTS pEntryPoints)
- 		}
- 
- 		/* IrpThreads content only modified by create_irp_thread() */
--		serial->IrpThreads = ListDictionary_New(FALSE);
-+		serial->IrpThreads = ListDictionary_New(TRUE);
- 
- 		if (!serial->IrpThreads)
- 		{
--- 
-2.53.0
-

SOURCES/channels-urbdrc-cancel-all-usb-transfers-on-channel-.patch

@@ -1,24 +0,0 @@
-From 414f701464929c217f2509bcbd6d2c1f00f7ed73 Mon Sep 17 00:00:00 2001
-From: akallabeth <akallabeth@posteo.net>
-Date: Mon, 26 Jan 2026 11:07:25 +0100
-Subject: [PATCH] [channels,urbdrc] cancel all usb transfers on channel close
-
----
- channels/urbdrc/client/libusb/libusb_udevice.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c
-index 5341248ec..9e2d3ec5a 100644
---- a/channels/urbdrc/client/libusb/libusb_udevice.c
-+++ b/channels/urbdrc/client/libusb/libusb_udevice.c
-@@ -1165,6 +1165,7 @@ static void libusb_udev_mark_channel_closed(IUDEVICE* idev)
- 		const uint8_t devNr = idev->get_dev_number(idev);
- 
- 		pdev->status |= URBDRC_DEVICE_CHANNEL_CLOSED;
-+		pdev->iface.cancel_all_transfer_request(&pdev->iface);
- 		urbdrc->udevman->unregister_udevice(urbdrc->udevman, busNr, devNr);
- 	}
- }
--- 
-2.53.0
-

SOURCES/channels-urbdrc-check-interface-indices-before-use.patch

@@ -1,70 +0,0 @@
-From f8453bda5069314d271973eff69dc2e04f6df980 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 17 Feb 2026 13:01:37 +0100
-Subject: [PATCH] [channels,urbdrc] check interface indices before use
-
-Backport of commit 7b7e6de8fe427a2f01d331056774aec69710590b (functional changes only).
-
-Co-authored-by: Cursor <cursoragent@cursor.com>
----
- .../urbdrc/client/libusb/libusb_udevice.c     | 25 +++++++++++++++++++
- channels/urbdrc/common/msusb.c                |  2 ++
- 2 files changed, 27 insertions(+)
-
-diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c
-index ef87f195f..b2d80243b 100644
---- a/channels/urbdrc/client/libusb/libusb_udevice.c
-+++ b/channels/urbdrc/client/libusb/libusb_udevice.c
-@@ -597,11 +597,36 @@ libusb_udev_complete_msconfig_setup(IUDEVICE* idev, MSUSB_CONFIG_DESCRIPTOR* MsC
- 		           "Select Configuration: Libusb NumberInterfaces(%" PRIu8 ") is different "
- 		           "with MsConfig NumberInterfaces(%" PRIu32 ")",
- 		           LibusbConfig->bNumInterfaces, MsConfig->NumInterfaces);
-+		return NULL;
- 	}
- 
- 	/* replace MsPipes for libusb */
- 	MsInterfaces = MsConfig->MsInterfaces;
- 
-+	/* check interface indices before use */
-+	for (inum = 0; inum < MsConfig->NumInterfaces; inum++)
-+	{
-+		MsInterface = MsInterfaces[inum];
-+		if (MsInterface->InterfaceNumber >= MsConfig->NumInterfaces)
-+		{
-+			WLog_Print(urbdrc->log, WLOG_ERROR,
-+			           "MSUSB_CONFIG_DESCRIPTOR::NumInterfaces (%" PRIu32
-+			           " <= MSUSB_INTERFACE_DESCRIPTOR::InterfaceNumber( %" PRIu8 ")",
-+			           MsConfig->NumInterfaces, MsInterface->InterfaceNumber);
-+			return NULL;
-+		}
-+
-+		LibusbInterface = &LibusbConfig->interface[MsInterface->InterfaceNumber];
-+		if (MsInterface->AlternateSetting >= LibusbInterface->num_altsetting)
-+		{
-+			WLog_Print(urbdrc->log, WLOG_ERROR,
-+			           "LIBUSB_INTERFACE::num_altsetting (%" PRId32
-+			           " <= MSUSB_INTERFACE_DESCRIPTOR::AlternateSetting( %" PRIu8 ")",
-+			           LibusbInterface->num_altsetting, MsInterface->AlternateSetting);
-+			return NULL;
-+		}
-+	}
-+
- 	for (inum = 0; inum < MsConfig->NumInterfaces; inum++)
- 	{
- 		MsInterface = MsInterfaces[inum];
-diff --git a/channels/urbdrc/common/msusb.c b/channels/urbdrc/common/msusb.c
-index bb517ce5d..113b7c96b 100644
---- a/channels/urbdrc/common/msusb.c
-+++ b/channels/urbdrc/common/msusb.c
-@@ -139,6 +139,8 @@ BOOL msusb_msinterface_replace(MSUSB_CONFIG_DESCRIPTOR* MsConfig, BYTE Interface
- {
- 	if (!MsConfig || !MsConfig->MsInterfaces)
- 		return FALSE;
-+	if (MsConfig->NumInterfaces <= InterfaceNumber)
-+		return FALSE;
- 
- 	msusb_msinterface_free(MsConfig->MsInterfaces[InterfaceNumber]);
- 	MsConfig->MsInterfaces[InterfaceNumber] = NewMsInterface;
--- 
-2.52.0
-

SOURCES/channels-urbdrc-do-not-free-MsConfig-on-failure.patch

@@ -1,31 +0,0 @@
-From aaad4718d80b0354fd807d680b12390075fe4fa0 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Wed, 11 Mar 2026 12:27:47 +0100
-Subject: [PATCH] [channels,urbdrc] do not free MsConfig on failure
-
-Backport of commit d676518809c319eec15911c705c13536036af2ae.
-
-Made-with: Cursor
----
- channels/urbdrc/client/data_transfer.c | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
-
-diff --git a/channels/urbdrc/client/data_transfer.c b/channels/urbdrc/client/data_transfer.c
-index ed6ccf32d..c547d52d7 100644
---- a/channels/urbdrc/client/data_transfer.c
-+++ b/channels/urbdrc/client/data_transfer.c
-@@ -570,10 +570,8 @@ static UINT urb_select_interface(IUDEVICE* pdev, URBDRC_CHANNEL_CALLBACK* callba
- 	MsConfig = pdev->get_MsConfig(pdev);
- 	InterfaceNumber = MsInterface->InterfaceNumber;
- 	if (!msusb_msinterface_replace(MsConfig, InterfaceNumber, MsInterface))
--	{
--		msusb_msconfig_free(MsConfig);
- 		return ERROR_BAD_CONFIGURATION;
--	}
-+
- 	/* complete configuration setup */
- 	if (!pdev->complete_msconfig_setup(pdev, MsConfig))
- 	{
--- 
-2.53.0
-

SOURCES/channels-urbdrc-ensure-InterfaceNumber-is-within-ran.patch

@@ -1,45 +0,0 @@
-From ea49391b3463b7df18eb9c358cdec04edf9c4001 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 12 Mar 2026 11:03:20 +0100
-Subject: [PATCH] [channels,urbdrc] ensure InterfaceNumber is within range
-
-Backport of commit 2d563a50be17c1b407ca448b1321378c0726dd31.
-
-Made-with: Cursor
----
- channels/urbdrc/client/libusb/libusb_udevice.c | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c
-index b2d80243b..ae8bbb4c5 100644
---- a/channels/urbdrc/client/libusb/libusb_udevice.c
-+++ b/channels/urbdrc/client/libusb/libusb_udevice.c
-@@ -528,19 +528,19 @@ static int libusb_udev_select_interface(IUDEVICE* idev, BYTE InterfaceNumber, BY
- {
- 	int error = 0, diff = 0;
- 	UDEVICE* pdev = (UDEVICE*)idev;
--	URBDRC_PLUGIN* urbdrc;
--	MSUSB_CONFIG_DESCRIPTOR* MsConfig;
--	MSUSB_INTERFACE_DESCRIPTOR** MsInterfaces;
- 
- 	if (!pdev || !pdev->urbdrc)
- 		return -1;
- 
--	urbdrc = pdev->urbdrc;
--	MsConfig = pdev->MsConfig;
-+	URBDRC_PLUGIN* urbdrc = pdev->urbdrc;
-+	MSUSB_CONFIG_DESCRIPTOR* MsConfig = pdev->MsConfig;
- 
- 	if (MsConfig)
- 	{
--		MsInterfaces = MsConfig->MsInterfaces;
-+		if (InterfaceNumber >= MsConfig->NumInterfaces)
-+			return -2;
-+
-+		MSUSB_INTERFACE_DESCRIPTOR** MsInterfaces = MsConfig->MsInterfaces;
- 		if (MsInterfaces)
- 		{
- 			WLog_Print(urbdrc->log, WLOG_INFO,
--- 
-2.53.0
-

SOURCES/channels-video-fix-wrong-cast.patch

@@ -1,37 +0,0 @@
-From 970ad2311e69589004d6a84961aa9d1e3b33c085 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 26 Mar 2026 15:57:34 +0100
-Subject: [PATCH] [channels,video] fix wrong cast
-
-Backport of commit e01cd85c8003a245ef9778f0eda4b9235514c201.
-
-Made-with: Cursor
----
- channels/video/client/video_main.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/channels/video/client/video_main.c b/channels/video/client/video_main.c
-index 641231b1d..0af78140e 100644
---- a/channels/video/client/video_main.c
-+++ b/channels/video/client/video_main.c
-@@ -959,7 +959,7 @@ static UINT video_control_on_close(IWTSVirtualChannelCallback* pChannelCallback)
- {
- 	if (pChannelCallback)
- 	{
--		VIDEO_LISTENER_CALLBACK* listener_callback = (VIDEO_LISTENER_CALLBACK*)pChannelCallback;
-+		VIDEO_CHANNEL_CALLBACK* listener_callback = (VIDEO_CHANNEL_CALLBACK*)pChannelCallback;
- 		VIDEO_PLUGIN* video = (VIDEO_PLUGIN*)listener_callback->plugin;
- 		if (video && video->control_callback)
- 		{
-@@ -974,7 +974,7 @@ static UINT video_data_on_close(IWTSVirtualChannelCallback* pChannelCallback)
- {
- 	if (pChannelCallback)
- 	{
--		VIDEO_LISTENER_CALLBACK* listener_callback = (VIDEO_LISTENER_CALLBACK*)pChannelCallback;
-+		VIDEO_CHANNEL_CALLBACK* listener_callback = (VIDEO_CHANNEL_CALLBACK*)pChannelCallback;
- 		VIDEO_PLUGIN* video = (VIDEO_PLUGIN*)listener_callback->plugin;
- 		if (video && video->data_callback)
- 		{
--- 
-2.53.0
-

SOURCES/channels-video-unify-error-handling.patch

@@ -1,121 +0,0 @@
-From 2cfdc16faed93a8d5d1ec391788547409df986de Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 26 Mar 2026 15:57:28 +0100
-Subject: [PATCH] [channels,video] unify error handling
-
-Partial backport of commit 635ae3c8193256db01774fab5ff11bcae57aed6b.
-
-Made-with: Cursor
----
- channels/video/client/video_main.c | 45 ++++++++++++++++++++++--------
- 1 file changed, 34 insertions(+), 11 deletions(-)
-
-diff --git a/channels/video/client/video_main.c b/channels/video/client/video_main.c
-index a8031fc86..641231b1d 100644
---- a/channels/video/client/video_main.c
-+++ b/channels/video/client/video_main.c
-@@ -25,7 +25,9 @@
- #include <stdlib.h>
- #include <string.h>
- 
-+#include <winpr/assert.h>
- #include <winpr/crt.h>
-+#include <winpr/error.h>
- #include <winpr/synch.h>
- #include <winpr/print.h>
- #include <winpr/stream.h>
-@@ -351,14 +353,24 @@ static void VideoClientContextPriv_free(VideoClientContextPriv* priv)
- 	free(priv);
- }
- 
-+static UINT video_channel_write(VIDEO_PLUGIN* video, const BYTE* data, UINT32 length)
-+{
-+	WINPR_ASSERT(video);
-+
-+	if (!video->control_callback || !video->control_callback->channel_callback)
-+		return ERROR_BAD_CONFIGURATION;
-+	IWTSVirtualChannel* channel = video->control_callback->channel_callback->channel;
-+	if (!channel || !channel->Write)
-+		return ERROR_BAD_CONFIGURATION;
-+	return channel->Write(channel, length, data, NULL);
-+}
-+
- static UINT video_control_send_presentation_response(VideoClientContext* context,
-                                                      TSMM_PRESENTATION_RESPONSE* resp)
- {
- 	BYTE buf[12];
- 	wStream* s;
- 	VIDEO_PLUGIN* video = (VIDEO_PLUGIN*)context->handle;
--	IWTSVirtualChannel* channel;
--	UINT ret;
- 
- 	s = Stream_New(buf, 12);
- 	if (!s)
-@@ -370,11 +382,9 @@ static UINT video_control_send_presentation_response(VideoClientContext* context
- 	Stream_Zero(s, 3);
- 	Stream_SealLength(s);
- 
--	channel = video->control_callback->channel_callback->channel;
--	ret = channel->Write(channel, 12, buf, NULL);
- 	Stream_Free(s, FALSE);
- 
--	return ret;
-+	return video_channel_write(video, buf, sizeof(buf));
- }
- 
- static BOOL video_onMappedGeometryUpdate(MAPPED_GEOMETRY* geometry)
-@@ -592,8 +602,6 @@ static UINT video_control_send_client_notification(VideoClientContext* context,
- 	BYTE buf[100];
- 	wStream* s;
- 	VIDEO_PLUGIN* video = (VIDEO_PLUGIN*)context->handle;
--	IWTSVirtualChannel* channel;
--	UINT ret;
- 	UINT32 cbSize;
- 
- 	s = Stream_New(buf, 30);
-@@ -627,10 +635,7 @@ static UINT video_control_send_client_notification(VideoClientContext* context,
- 	Stream_Write_UINT32(s, cbSize);
- 	Stream_Free(s, FALSE);
- 
--	channel = video->control_callback->channel_callback->channel;
--	ret = channel->Write(channel, cbSize, buf, NULL);
--
--	return ret;
-+	return video_channel_write(video, buf, cbSize);
- }
- 
- static void video_timer(VideoClientContext* video, UINT64 now)
-@@ -952,12 +957,30 @@ static UINT video_data_on_data_received(IWTSVirtualChannelCallback* pChannelCall
-  */
- static UINT video_control_on_close(IWTSVirtualChannelCallback* pChannelCallback)
- {
-+	if (pChannelCallback)
-+	{
-+		VIDEO_LISTENER_CALLBACK* listener_callback = (VIDEO_LISTENER_CALLBACK*)pChannelCallback;
-+		VIDEO_PLUGIN* video = (VIDEO_PLUGIN*)listener_callback->plugin;
-+		if (video && video->control_callback)
-+		{
-+			video->control_callback->channel_callback = NULL;
-+		}
-+	}
- 	free(pChannelCallback);
- 	return CHANNEL_RC_OK;
- }
- 
- static UINT video_data_on_close(IWTSVirtualChannelCallback* pChannelCallback)
- {
-+	if (pChannelCallback)
-+	{
-+		VIDEO_LISTENER_CALLBACK* listener_callback = (VIDEO_LISTENER_CALLBACK*)pChannelCallback;
-+		VIDEO_PLUGIN* video = (VIDEO_PLUGIN*)listener_callback->plugin;
-+		if (video && video->data_callback)
-+		{
-+			video->data_callback->channel_callback = NULL;
-+		}
-+	}
- 	free(pChannelCallback);
- 	return CHANNEL_RC_OK;
- }
--- 
-2.53.0
-

SOURCES/client-x11-fix-double-free-in-case-of-invalid-pointe.patch

@@ -1,53 +0,0 @@
-From c0e85d92e45dff6c9a12e6af5be2e9ed10b4990c Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 22 Jan 2026 12:51:08 +0100
-Subject: [PATCH] [client,x11] fix double free in case of invalid pointer
-
-Backport of commit 0421b53fcb4a80c95f51342e4a2c40c68a4101d3.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
----
- client/X11/xf_graphics.c | 13 ++++++-------
- 1 file changed, 6 insertions(+), 7 deletions(-)
-
-diff --git a/client/X11/xf_graphics.c b/client/X11/xf_graphics.c
-index 5aa1fd48b..d596b23da 100644
---- a/client/X11/xf_graphics.c
-+++ b/client/X11/xf_graphics.c
-@@ -406,7 +406,6 @@ static BOOL xf_Pointer_New(rdpContext* context, rdpPointer* pointer)
- 	BOOL rc = FALSE;
- #ifdef WITH_XCURSOR
- 	UINT32 CursorFormat;
--	size_t size;
- 	xfContext* xfc = (xfContext*)context;
- 	xfPointer* xpointer = (xfPointer*)pointer;
- 
-@@ -421,19 +420,19 @@ static BOOL xf_Pointer_New(rdpContext* context, rdpPointer* pointer)
- 	xpointer->nCursors = 0;
- 	xpointer->mCursors = 0;
- 
--	size = 1ull * pointer->height * pointer->width * GetBytesPerPixel(CursorFormat);
-+	const size_t size =
-+	    1ull * pointer->height * pointer->width * GetBytesPerPixel(CursorFormat);
- 
--	if (!(xpointer->cursorPixels = (XcursorPixel*)_aligned_malloc(size, 16)))
-+	xpointer->cursorPixels = (XcursorPixel*)_aligned_malloc(size, 16);
-+	if (!xpointer->cursorPixels)
- 		goto fail;
- 
- 	if (!freerdp_image_copy_from_pointer_data(
- 	        (BYTE*)xpointer->cursorPixels, CursorFormat, 0, 0, 0, pointer->width, pointer->height,
- 	        pointer->xorMaskData, pointer->lengthXorMask, pointer->andMaskData,
- 	        pointer->lengthAndMask, pointer->xorBpp, &context->gdi->palette))
--	{
--		_aligned_free(xpointer->cursorPixels);
--		return FALSE;
--	}
-+		goto fail;
-+
- 	rc = TRUE;
- 
- #endif
--- 
-2.52.0
-

SOURCES/codec-clear-check-clear_decomress-glyphData.patch

@@ -1,76 +0,0 @@
-From 3a4ee3f0020977320066b99da16456b6364c1365 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 22 Jan 2026 12:50:22 +0100
-Subject: [PATCH] [codec,clear] check clear_decomress glyphData
-
-Backport of commit 243ecf804bb122e8e643a5c142ad5a49d7aa19ee.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
----
- libfreerdp/codec/clear.c | 50 +++++++++++++++++++++++++++++++++++++++-
- 1 file changed, 49 insertions(+), 1 deletion(-)
-
-diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
-index 4f0aead10..fcafb9235 100644
---- a/libfreerdp/codec/clear.c
-+++ b/libfreerdp/codec/clear.c
-@@ -1145,7 +1145,55 @@ INT32 clear_decompress(CLEAR_CONTEXT* clear, const BYTE* pSrcData, UINT32 SrcSiz
- 
- 	if (glyphData)
- 	{
--		if (!freerdp_image_copy(glyphData, clear->format, 0, 0, 0, nWidth, nHeight, pDstData,
-+		uint32_t w = MIN(nWidth, nDstWidth);
-+		if (nXDst > nDstWidth)
-+		{
-+			WLog_WARN(TAG, "glyphData copy area x exceeds destination: x=%" PRIu32 " > %" PRIu32,
-+			          nXDst, nDstWidth);
-+			w = 0;
-+		}
-+		else if (nXDst + w > nDstWidth)
-+		{
-+			WLog_WARN(TAG,
-+			          "glyphData copy area x + width exceeds destination: x=%" PRIu32 " + %" PRIu32
-+			          " > %" PRIu32,
-+			          nXDst, w, nDstWidth);
-+			w = nDstWidth - nXDst;
-+		}
-+
-+		if (w != nWidth)
-+		{
-+			WLog_WARN(TAG,
-+			          "glyphData copy area width truncated: requested=%" PRIu32
-+			          ", truncated to %" PRIu32,
-+			          nWidth, w);
-+		}
-+
-+		uint32_t h = MIN(nHeight, nDstHeight);
-+		if (nYDst > nDstHeight)
-+		{
-+			WLog_WARN(TAG, "glyphData copy area y exceeds destination: y=%" PRIu32 " > %" PRIu32,
-+			          nYDst, nDstHeight);
-+			h = 0;
-+		}
-+		else if (nYDst + h > nDstHeight)
-+		{
-+			WLog_WARN(TAG,
-+			          "glyphData copy area y + height exceeds destination: x=%" PRIu32 " + %" PRIu32
-+			          " > %" PRIu32,
-+			          nYDst, h, nDstHeight);
-+			h = nDstHeight - nYDst;
-+		}
-+
-+		if (h != nHeight)
-+		{
-+			WLog_WARN(TAG,
-+			          "glyphData copy area height truncated: requested=%" PRIu32
-+			          ", truncated to %" PRIu32,
-+			          nHeight, h);
-+		}
-+
-+		if (!freerdp_image_copy(glyphData, clear->format, 0, 0, 0, w, h, pDstData,
- 		                        DstFormat, nDstStep, nXDst, nYDst, palette, FREERDP_FLIP_NONE))
- 			goto fail;
- 	}
--- 
-2.52.0
-

SOURCES/codec-clear-fix-clear_resize_buffer-checks.patch

@@ -1,61 +0,0 @@
-From 00a593f9eda67212539e4dcac68ea5a699eb3e93 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 22 Jan 2026 12:48:37 +0100
-Subject: [PATCH] [codec,clear] fix clear_resize_buffer checks
-
-Backport of commit c4391827d7facfc874ca7f61a92afb82232a5748.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
----
- libfreerdp/codec/clear.c | 17 +++++++++--------
- 1 file changed, 9 insertions(+), 8 deletions(-)
-
-diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
-index e38fa0dcf..299acef2e 100644
---- a/libfreerdp/codec/clear.c
-+++ b/libfreerdp/codec/clear.c
-@@ -62,7 +62,7 @@ struct _CLEAR_CONTEXT
- 	NSC_CONTEXT* nsc;
- 	UINT32 seqNumber;
- 	BYTE* TempBuffer;
--	UINT32 TempSize;
-+	size_t TempSize;
- 	UINT32 nTempStep;
- 	UINT32 TempFormat;
- 	UINT32 format;
-@@ -313,24 +313,25 @@ static BOOL clear_decompress_subcode_rlex(wStream* s, UINT32 bitmapDataByteCount
- 
- static BOOL clear_resize_buffer(CLEAR_CONTEXT* clear, UINT32 width, UINT32 height)
- {
--	UINT32 size;
--
- 	if (!clear)
- 		return FALSE;
- 
--	size = ((width + 16) * (height + 16) * GetBytesPerPixel(clear->format));
-+	const UINT64 size = 1ull * (width + 16ull) * (height + 16ull);
-+	const size_t bpp = GetBytesPerPixel(clear->format);
-+	if (size > UINT32_MAX / bpp)
-+		return FALSE;
- 
--	if (size > clear->TempSize)
-+	if (size > clear->TempSize / bpp)
- 	{
--		BYTE* tmp = (BYTE*)realloc(clear->TempBuffer, size);
-+		BYTE* tmp = (BYTE*)realloc(clear->TempBuffer, size * bpp);
- 
- 		if (!tmp)
- 		{
--			WLog_ERR(TAG, "clear->TempBuffer realloc failed for %" PRIu32 " bytes", size);
-+			WLog_ERR(TAG, "clear->TempBuffer realloc failed for %" PRIu64 " bytes", size);
- 			return FALSE;
- 		}
- 
--		clear->TempSize = size;
-+		clear->TempSize = size * bpp;
- 		clear->TempBuffer = tmp;
- 	}
- 
--- 
-2.52.0
-

SOURCES/codec-clear-fix-destination-checks.patch

@@ -1,41 +0,0 @@
-From 7178a5554d7147a47fb7a85bba8c681f59e2a714 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 9 Mar 2026 13:55:29 +0100
-Subject: [PATCH] [codec,clear] fix destination checks
-
-Backport of commit 7d8fdce2d0ef337cb86cb37fc0c436c905e04d77.
-
-Made-with: Cursor
----
- libfreerdp/codec/clear.c | 11 ++++++-----
- 1 file changed, 6 insertions(+), 5 deletions(-)
-
-diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
-index a989a9bff..4dbe72376 100644
---- a/libfreerdp/codec/clear.c
-+++ b/libfreerdp/codec/clear.c
-@@ -494,15 +494,16 @@ static BOOL clear_decompress_subcodecs_data(CLEAR_CONTEXT* clear, wStream* s,
- 		nXDstRel = nXDst + xStart;
- 		nYDstRel = nYDst + yStart;
- 
--		if (width > nWidth)
-+		if (1ull * nXDstRel + width > nDstWidth)
- 		{
--			WLog_ERR(TAG, "width %" PRIu16 " > nWidth %" PRIu32 "", width, nWidth);
-+			WLog_ERR(TAG, "nXDstRel %" PRIu32 " + width %" PRIu16 " > nDstWidth %" PRIu32 "",
-+			         nXDstRel, width, nDstWidth);
- 			return FALSE;
- 		}
--
--		if (height > nHeight)
-+		if (1ull * nYDstRel + height > nDstHeight)
- 		{
--			WLog_ERR(TAG, "height %" PRIu16 " > nHeight %" PRIu32 "", height, nHeight);
-+			WLog_ERR(TAG, "nYDstRel %" PRIu32 " + height %" PRIu16 " > nDstHeight %" PRIu32 "",
-+			         nYDstRel, height, nDstHeight);
- 			return FALSE;
- 		}
- 
--- 
-2.53.0
-

SOURCES/codec-clear-fix-off-by-one-length-check.patch

@@ -1,35 +0,0 @@
-From 5b03db3926bd7bc1bf5819de068ed71a73b25236 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 22 Jan 2026 12:49:28 +0100
-Subject: [PATCH] [codec,clear] fix off by one length check
-
-Backport of commit f8688b57f6cfad9a0b05475a6afbde355ffab720.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
----
- libfreerdp/codec/clear.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
-index 09f5dad6d..4f0aead10 100644
---- a/libfreerdp/codec/clear.c
-+++ b/libfreerdp/codec/clear.c
-@@ -881,11 +881,14 @@ static BOOL clear_decompress_bands_data(CLEAR_CONTEXT* clear, wStream* s, UINT32
- 				if (count > nHeight)
- 					count = nHeight;
- 
--				if (nXDstRel + i > nDstWidth)
-+				if (nXDstRel + i >= nDstWidth)
- 					return FALSE;
- 
- 				for (UINT32 y = 0; y < count; y++)
- 				{
-+					if (nYDstRel + y >= nDstHeight)
-+						return FALSE;
-+
- 					BYTE* pDstPixel8 = &pDstData[((nYDstRel + y) * nDstStep) +
- 					                             ((nXDstRel + i) * GetBytesPerPixel(DstFormat))];
- 					UINT32 color = ReadColor(cpSrcPixel, clear->format);
--- 
-2.52.0
-

SOURCES/codec-clear-update-CLEAR_VBAR_ENTRY-size-after-alloc.patch

@@ -1,35 +0,0 @@
-From a2dde6d9832cb032e8cf12cab3da84dafbab9006 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Fri, 10 Apr 2026 11:32:09 +0200
-Subject: [PATCH] [codec,clear] update CLEAR_VBAR_ENTRY::size after alloc
-
-Backport of commit a2dde6d9832cb032e8cf12cab3da84dafbab9006.
-
-Made-with: Cursor
----
- libfreerdp/codec/clear.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
-index e38fa0d..eda30ad 100644
---- a/libfreerdp/codec/clear.c
-+++ b/libfreerdp/codec/clear.c
-@@ -565,7 +565,6 @@ static BOOL resize_vbar_entry(CLEAR_CONTEXT* clear, CLEAR_VBAR_ENTRY* vBarEntry)
- 		const UINT32 oldPos = vBarEntry->size * bpp;
- 		const UINT32 diffSize = (vBarEntry->count - vBarEntry->size) * bpp;
- 		BYTE* tmp;
--		vBarEntry->size = vBarEntry->count;
- 		tmp = (BYTE*)realloc(vBarEntry->pixels, 1ull * vBarEntry->count * bpp);
- 
- 		if (!tmp)
-@@ -576,6 +575,7 @@ static BOOL resize_vbar_entry(CLEAR_CONTEXT* clear, CLEAR_VBAR_ENTRY* vBarEntry)
- 
- 		memset(&tmp[oldPos], 0, diffSize);
- 		vBarEntry->pixels = tmp;
-+		vBarEntry->size = vBarEntry->count;
- 	}
- 
- 	if (!vBarEntry->pixels && vBarEntry->size)
--- 
-2.49.0
-

SOURCES/codec-color-add-freerdp_glyph_convert_ex.patch

@@ -1,114 +0,0 @@
-From b54003ad2dcb69b3c7836ae1445c48af8b39cd4c Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Sat, 28 Mar 2026 12:13:04 +0100
-Subject: [PATCH] [codec,color] add freerdp_glyph_convert_ex
-
-Backport of commit 3bc1eeb4f63ceec9a696af194e4c1ea0e67ff60c.
-
-Made-with: Cursor
----
- libfreerdp/codec/color.c  | 12 +++++++++--
- libfreerdp/gdi/graphics.c | 45 +++++++++++++++++++++++++++++++++++++++
- 2 files changed, 55 insertions(+), 2 deletions(-)
-
-diff --git a/libfreerdp/codec/color.c b/libfreerdp/codec/color.c
-index f8467c295..4c72ee3e6 100644
---- a/libfreerdp/codec/color.c
-+++ b/libfreerdp/codec/color.c
-@@ -28,6 +28,7 @@
- #include <stdlib.h>
- 
- #include <winpr/crt.h>
-+#include <winpr/assert.h>
- 
- #include <freerdp/log.h>
- #include <freerdp/freerdp.h>
-@@ -49,13 +50,20 @@ BYTE* freerdp_glyph_convert(UINT32 width, UINT32 height, const BYTE* data)
- 	const BYTE* srcp;
- 	BYTE* dstp;
- 	BYTE* dstData;
--	UINT32 scanline;
-+	size_t scanline;
-+
- 	/*
- 	 * converts a 1-bit-per-pixel glyph to a one-byte-per-pixel glyph:
- 	 * this approach uses a little more memory, but provides faster
- 	 * means of accessing individual pixels in blitting operations
- 	 */
--	scanline = (width + 7) / 8;
-+	scanline = (width + 7ull) / 8ull;
-+
-+	if ((width == 0) || (height == 0))
-+		return NULL;
-+
-+	WINPR_ASSERT(data);
-+
- 	dstData = (BYTE*)_aligned_malloc(1ull * width * height, 16);
- 
- 	if (!dstData)
-diff --git a/libfreerdp/gdi/graphics.c b/libfreerdp/gdi/graphics.c
-index 479eac9b8..dab159c43 100644
---- a/libfreerdp/gdi/graphics.c
-+++ b/libfreerdp/gdi/graphics.c
-@@ -23,6 +23,7 @@
- #include "config.h"
- #endif
- 
-+#include <winpr/assert.h>
- #include <winpr/crt.h>
- 
- #include <freerdp/log.h>
-@@ -215,6 +216,50 @@ static BOOL gdi_Bitmap_SetSurface(rdpContext* context, rdpBitmap* bitmap, BOOL p
- }
- 
- /* Glyph Class */
-+static BYTE* freerdp_glyph_convert_ex(UINT32 width, UINT32 height, const BYTE* data, size_t len)
-+{
-+	/*
-+	 * converts a 1-bit-per-pixel glyph to a one-byte-per-pixel glyph:
-+	 * this approach uses a little more memory, but provides faster
-+	 * means of accessing individual pixels in blitting operations
-+	 */
-+	const size_t scanline = (width + 7ull) / 8ull;
-+	const size_t required = scanline * height;
-+	if (len < required)
-+		return NULL;
-+
-+	if ((len == 0) || (width == 0) || (height == 0))
-+		return NULL;
-+
-+	WINPR_ASSERT(data);
-+
-+	BYTE* dstData = (BYTE*)_aligned_malloc(1ull * width * height, 16);
-+
-+	if (!dstData)
-+		return NULL;
-+
-+	ZeroMemory(dstData, 1ULL * width * height);
-+	BYTE* dstp = dstData;
-+
-+	for (UINT32 y = 0; y < height; y++)
-+	{
-+		const BYTE* srcp = &data[1ull * y * scanline];
-+
-+		for (UINT32 x = 0; x < width; x++)
-+		{
-+			if ((*srcp & (0x80 >> (x % 8))) != 0)
-+				*dstp = 0xFF;
-+
-+			dstp++;
-+
-+			if (((x + 1) % 8 == 0) && x != 0)
-+				srcp++;
-+		}
-+	}
-+
-+	return dstData;
-+}
-+
- static BOOL gdi_Glyph_New(rdpContext* context, const rdpGlyph* glyph)
- {
- 	BYTE* data;
--- 
-2.53.0
-

SOURCES/codec-nsc-fix-use-of-nsc_process_message.patch

@@ -1,90 +0,0 @@
-From 21cb0e2b96e4e86b4ed8b7a76d819808b898e93e Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 31 Mar 2026 07:08:04 +0200
-Subject: [PATCH] [codec,nsc] fix use of nsc_process_message
-
-Backport of commit 169971607cece48384cb94632b829bd57336af0f.
-
-Made-with: Cursor
----
- libfreerdp/codec/clear.c | 10 ++++++----
- libfreerdp/codec/nsc.c   |  9 ++++++++-
- libfreerdp/gdi/gdi.c     |  4 ++--
- 3 files changed, 16 insertions(+), 7 deletions(-)
-
-diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
-index 4dbe72376..6627b21d6 100644
---- a/libfreerdp/codec/clear.c
-+++ b/libfreerdp/codec/clear.c
-@@ -103,7 +103,8 @@ static BOOL convert_color(BYTE* dst, UINT32 nDstStep, UINT32 DstFormat, UINT32 n
- 
- static BOOL clear_decompress_nscodec(NSC_CONTEXT* nsc, UINT32 width, UINT32 height, wStream* s,
-                                      UINT32 bitmapDataByteCount, BYTE* pDstData, UINT32 DstFormat,
--                                     UINT32 nDstStep, UINT32 nXDstRel, UINT32 nYDstRel)
-+                                     UINT32 nDstStep, UINT32 nXDstRel, UINT32 nYDstRel,
-+                                     UINT32 nDstWidth, UINT32 nDstHeight)
- {
- 	BOOL rc;
- 
-@@ -115,8 +116,8 @@ static BOOL clear_decompress_nscodec(NSC_CONTEXT* nsc, UINT32 width, UINT32 heig
- 	}
- 
- 	rc = nsc_process_message(nsc, 32, width, height, Stream_Pointer(s), bitmapDataByteCount,
--	                         pDstData, DstFormat, nDstStep, nXDstRel, nYDstRel, width, height,
--	                         FREERDP_FLIP_NONE);
-+	                         pDstData, DstFormat, nDstStep, nXDstRel, nYDstRel, nDstWidth,
-+	                         nDstHeight, FREERDP_FLIP_NONE);
- 	Stream_Seek(s, bitmapDataByteCount);
- 	return rc;
- }
-@@ -535,7 +536,8 @@ static BOOL clear_decompress_subcodecs_data(CLEAR_CONTEXT* clear, wStream* s,
- 
- 			case 1: /* NSCodec */
- 				if (!clear_decompress_nscodec(clear->nsc, width, height, s, bitmapDataByteCount,
--				                              pDstData, DstFormat, nDstStep, nXDstRel, nYDstRel))
-+				                              pDstData, DstFormat, nDstStep, nXDstRel, nYDstRel,
-+				                              nDstWidth, nDstHeight))
- 					return FALSE;
- 
- 				break;
-diff --git a/libfreerdp/codec/nsc.c b/libfreerdp/codec/nsc.c
-index a257ae24a..f50a1ae89 100644
---- a/libfreerdp/codec/nsc.c
-+++ b/libfreerdp/codec/nsc.c
-@@ -447,10 +447,17 @@ BOOL nsc_process_message(NSC_CONTEXT* context, UINT16 bpp, UINT32 width, UINT32
-                          UINT32 nDstStride, UINT32 nXDst, UINT32 nYDst, UINT32 nWidth,
-                          UINT32 nHeight, UINT32 flip)
- {
-+	WINPR_ASSERT(context);
-+	WINPR_ASSERT(context->priv);
-+
- 	wStream* s;
- 	BOOL ret;
--	if (!context || !data || !pDstData)
-+	if (!data || !pDstData)
-+	{
-+		WLog_Print(context->priv->log, WLOG_ERROR, "Invalid argument: data=%p, pDstData=%p",
-+		           (const void*)data, (void*)pDstData);
- 		return FALSE;
-+	}
- 
- 	s = Stream_New((BYTE*)data, length);
- 
-diff --git a/libfreerdp/gdi/gdi.c b/libfreerdp/gdi/gdi.c
-index 37a010431..8c5e4bf34 100644
---- a/libfreerdp/gdi/gdi.c
-+++ b/libfreerdp/gdi/gdi.c
-@@ -1074,8 +1074,8 @@ static BOOL gdi_surface_bits(rdpContext* context, const SURFACE_BITS_COMMAND* cm
- 			if (!nsc_process_message(
- 			        context->codecs->nsc, cmd->bmp.bpp, cmd->bmp.width, cmd->bmp.height,
- 			        cmd->bmp.bitmapData, cmd->bmp.bitmapDataLength, gdi->primary_buffer, format,
--			        gdi->stride, cmdRect.left, cmdRect.top, cmdRect.right - cmdRect.left,
--			        cmdRect.bottom - cmdRect.top, FREERDP_FLIP_VERTICAL))
-+			        gdi->stride, cmdRect.left, cmdRect.top, (UINT32)gdi->width, (UINT32)gdi->height,
-+			        FREERDP_FLIP_VERTICAL))
- 			{
- 				WLog_ERR(TAG, "Failed to process NSCodec message");
- 				goto out;
--- 
-2.53.0
-

SOURCES/codec-nsc-limit-copy-area-in-nsc_process_message.patch

@@ -1,44 +0,0 @@
-From 9a9e00529b1b04718370a1d8e2d8b6768c9ee913 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 16 Mar 2026 14:59:12 +0100
-Subject: [PATCH] [codec,nsc] limit copy area in nsc_process_message
-
-Backport of commit 83d9aedea278a74af3e490ff5eeb889c016dbb2b.
-
-Made-with: Cursor
----
- libfreerdp/codec/nsc.c | 11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/libfreerdp/codec/nsc.c b/libfreerdp/codec/nsc.c
-index 5dd2646ea..a257ae24a 100644
---- a/libfreerdp/codec/nsc.c
-+++ b/libfreerdp/codec/nsc.c
-@@ -24,6 +24,7 @@
- #include "config.h"
- #endif
- 
-+#include <stdint.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <string.h>
-@@ -515,7 +516,15 @@ BOOL nsc_process_message(NSC_CONTEXT* context, UINT16 bpp, UINT32 width, UINT32
- 			return FALSE;
- 	}
- 
--	if (!freerdp_image_copy(pDstData, DstFormat, nDstStride, nXDst, nYDst, width, height,
-+	uint32_t cwidth = width;
-+	if (1ull * nXDst + width > nWidth)
-+		cwidth = nWidth - nXDst;
-+
-+	uint32_t cheight = height;
-+	if (1ull * nYDst + height > nHeight)
-+		cheight = nHeight - nYDst;
-+
-+	if (!freerdp_image_copy(pDstData, DstFormat, nDstStride, nXDst, nYDst, cwidth, cheight,
- 	                        context->BitmapData, PIXEL_FORMAT_BGRA32, 0, 0, 0, NULL, flip))
- 		return FALSE;
- 
--- 
-2.53.0
-

SOURCES/codec-planar-fix-decoder-length-checks.patch

@@ -1,31 +0,0 @@
-From 2d656eb6b29a68de7f19e8a1cce169259e7506b4 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 27 Jan 2026 14:35:43 +0100
-Subject: [PATCH] [codec,planar] fix decoder length checks
-
-Backport of commit 1bab198a2edd0d0e6e1627d21a433151ea190.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
----
- libfreerdp/codec/planar.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/libfreerdp/codec/planar.c b/libfreerdp/codec/planar.c
-index fe27011e1..1cb2e22bc 100644
---- a/libfreerdp/codec/planar.c
-+++ b/libfreerdp/codec/planar.c
-@@ -616,6 +616,11 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
- 	WINPR_ASSERT(planar);
- 	WINPR_ASSERT(prims);
- 
-+	if (planar->maxWidth < nSrcWidth)
-+		return FALSE;
-+	if (planar->maxHeight < nSrcHeight)
-+		return FALSE;
-+
- 	if (nDstStep <= 0)
- 		nDstStep = nDstWidth * GetBytesPerPixel(DstFormat);
- 
--- 
-2.52.0
-

SOURCES/codec-planar-fix-missing-destination-bounds-checks.patch

@@ -1,55 +0,0 @@
-From eca8a1a876b77de5da60b18793e35e5c0714ef97 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 9 Mar 2026 12:56:11 +0100
-Subject: [PATCH] [codec,planar]: fix missing destination bounds checks
-
-Backport of commit a0be5cb87d760bb1c803ad1bb835aa1e73e62abc.
-
-Made-with: Cursor
----
- libfreerdp/codec/planar.c | 21 ++++++++++++++++++++-
- 1 file changed, 20 insertions(+), 1 deletion(-)
-
-diff --git a/libfreerdp/codec/planar.c b/libfreerdp/codec/planar.c
-index 1cb2e22bc..9b4d13057 100644
---- a/libfreerdp/codec/planar.c
-+++ b/libfreerdp/codec/planar.c
-@@ -621,8 +621,9 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
- 	if (planar->maxHeight < nSrcHeight)
- 		return FALSE;
- 
-+	const UINT32 bpp = GetBytesPerPixel(DstFormat);
- 	if (nDstStep <= 0)
--		nDstStep = nDstWidth * GetBytesPerPixel(DstFormat);
-+		nDstStep = nDstWidth * bpp;
- 
- 	srcp = pSrcData;
- 
-@@ -831,6 +832,24 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
- 		}
- 		else /* RLE */
- 		{
-+			if (nYDst + nSrcHeight > nTotalHeight)
-+			{
-+				WLog_ERR(TAG,
-+				         "planar plane destination Y %" PRIu32 " + height %" PRIu32
-+				         " exceeds totalHeight %" PRIu32,
-+				         nYDst, nSrcHeight, nTotalHeight);
-+				return FALSE;
-+			}
-+
-+			if ((nXDst + nSrcWidth) * bpp > nDstStep)
-+			{
-+				WLog_ERR(TAG,
-+				         "planar plane destination (X %" PRIu32 " + width %" PRIu32
-+				         ") * bpp %" PRIu32 " exceeds stride %" PRIu32,
-+				         nXDst, nSrcWidth, bpp, nDstStep);
-+				return FALSE;
-+			}
-+
- 			status =
- 			    planar_decompress_plane_rle(planes[0], rleSizes[0], pTempData, nTempStep, nXDst,
- 			                                nYDst, nSrcWidth, nSrcHeight, 2, vFlip); /* RedPlane */
--- 
-2.53.0
-

SOURCES/codec-progressive-fail-progressive_rfx_quant_sub-on-invalid-values.patch

@@ -1,89 +0,0 @@
-From 78188ab479c8e6eb9ba2475b3732c76b4bbe5425 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 13 Apr 2026 14:00:00 +0200
-Subject: [PATCH] [codec,progressive] Fail progressive_rfx_quant_sub on invalid
- values
-
-Backport of commit 78188ab479c8e6eb9ba2475b3732c76b4bbe5425.
-
-Made-with: Cursor
----
- libfreerdp/codec/progressive.c | 42 ++++++++++++++++++++++++++++++----
- 1 file changed, 38 insertions(+), 4 deletions(-)
-
-diff --git a/libfreerdp/codec/progressive.c b/libfreerdp/codec/progressive.c
-index 8894b35..bbcc921 100644
---- a/libfreerdp/codec/progressive.c
-+++ b/libfreerdp/codec/progressive.c
-@@ -155,20 +155,51 @@ static INLINE void progressive_rfx_quant_lsub(RFX_COMPONENT_CODEC_QUANT* q, int
- 	q->LL3 -= val; /* LL3 */
- }
- 
--static INLINE void progressive_rfx_quant_sub(const RFX_COMPONENT_CODEC_QUANT* q1,
-+static INLINE BOOL progressive_rfx_quant_sub(const RFX_COMPONENT_CODEC_QUANT* q1,
-                                              const RFX_COMPONENT_CODEC_QUANT* q2,
-                                              RFX_COMPONENT_CODEC_QUANT* dst)
- {
-+	if (q1->HH1 < q2->HL1)
-+		return FALSE;
- 	dst->HL1 = q1->HL1 - q2->HL1; /* HL1 */
-+
-+	if (q1->LH1 < q2->LH1)
-+		return FALSE;
- 	dst->LH1 = q1->LH1 - q2->LH1; /* LH1 */
-+
-+	if (q1->HH1 < q2->HH1)
-+		return FALSE;
- 	dst->HH1 = q1->HH1 - q2->HH1; /* HH1 */
-+
-+	if (q1->HL2 < q2->HL2)
-+		return FALSE;
- 	dst->HL2 = q1->HL2 - q2->HL2; /* HL2 */
-+
-+	if (q1->LH2 < q2->LH2)
-+		return FALSE;
- 	dst->LH2 = q1->LH2 - q2->LH2; /* LH2 */
-+
-+	if (q1->HH2 < q2->HH2)
-+		return FALSE;
- 	dst->HH2 = q1->HH2 - q2->HH2; /* HH2 */
-+
-+	if (q1->HL3 < q2->HL3)
-+		return FALSE;
- 	dst->HL3 = q1->HL3 - q2->HL3; /* HL3 */
-+
-+	if (q1->LH3 < q2->LH3)
-+		return FALSE;
- 	dst->LH3 = q1->LH3 - q2->LH3; /* LH3 */
-+
-+	if (q1->HH3 < q2->HH3)
-+		return FALSE;
- 	dst->HH3 = q1->HH3 - q2->HH3; /* HH3 */
-+
-+	if (q1->LL3 < q2->LL3)
-+		return FALSE;
- 	dst->LL3 = q1->LL3 - q2->LL3; /* LL3 */
-+
-+	return TRUE;
- }
- 
- static INLINE BOOL progressive_rfx_quant_lcmp_less_equal(const RFX_COMPONENT_CODEC_QUANT* q,
-@@ -1433,9 +1464,12 @@ static INLINE int progressive_decompress_tile_upgrade(PROGRESSIVE_CONTEXT* progr
- 	progressive_rfx_quant_add(quantY, quantProgY, &yBitPos);
- 	progressive_rfx_quant_add(quantCb, quantProgCb, &cbBitPos);
- 	progressive_rfx_quant_add(quantCr, quantProgCr, &crBitPos);
--	progressive_rfx_quant_sub(&(tile->yBitPos), &yBitPos, &yNumBits);
--	progressive_rfx_quant_sub(&(tile->cbBitPos), &cbBitPos, &cbNumBits);
--	progressive_rfx_quant_sub(&(tile->crBitPos), &crBitPos, &crNumBits);
-+	if (!progressive_rfx_quant_sub(&(tile->yBitPos), &yBitPos, &yNumBits))
-+		goto fail;
-+	if (!progressive_rfx_quant_sub(&(tile->cbBitPos), &cbBitPos, &cbNumBits))
-+		goto fail;
-+	if (!progressive_rfx_quant_sub(&(tile->crBitPos), &crBitPos, &crNumBits))
-+		goto fail;
- 	progressive_rfx_quant_add(quantY, quantProgY, &shiftY);
- 	progressive_rfx_quant_lsub(&shiftY, 1); /* -6 + 5 = -1 */
- 	progressive_rfx_quant_add(quantCb, quantProgCb, &shiftCb);
--- 
-2.49.0
-

SOURCES/codec-progressive-fix-underflow-guard-in-progressive_rfx_quant_sub.patch

@@ -1,29 +0,0 @@
-From 78677dc6e262f46937d00c3aa52381e4bb198fa5 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 13 Apr 2026 14:00:00 +0200
-Subject: [PATCH] [codec,progressive] fix underflow guard in
- progressive_rfx_quant_sub
-
-Backport of commit 78677dc6e262f46937d00c3aa52381e4bb198fa5.
-
-Made-with: Cursor
----
- libfreerdp/codec/progressive.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libfreerdp/codec/progressive.c b/libfreerdp/codec/progressive.c
-index bbcc921..1234567 100644
---- a/libfreerdp/codec/progressive.c
-+++ b/libfreerdp/codec/progressive.c
-@@ -158,7 +158,7 @@ static INLINE BOOL progressive_rfx_quant_sub(const RFX_COMPONENT_CODEC_QUANT* q1
-                                              const RFX_COMPONENT_CODEC_QUANT* q2,
-                                              RFX_COMPONENT_CODEC_QUANT* dst)
- {
--	if (q1->HH1 < q2->HL1)
-+	if (q1->HL1 < q2->HL1)
- 		return FALSE;
- 	dst->HL1 = q1->HL1 - q2->HL1; /* HL1 */
- 
--- 
-2.49.0
-

SOURCES/core-info-fix-missing-NULL-check.patch

@@ -1,71 +0,0 @@
-From 6a329a9a1352c9461a3a85e55d84230106b19500 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 10 Mar 2026 14:53:29 +0100
-Subject: [PATCH] [core,info] fix missing NULL check
-
-Backport of commit 4d44e3c097656a8b9ec696353647b0888ca45860.
-
-Made-with: Cursor
----
- libfreerdp/core/info.c | 17 +++++++++++------
- 1 file changed, 11 insertions(+), 6 deletions(-)
-
-diff --git a/libfreerdp/core/info.c b/libfreerdp/core/info.c
-index 9aaa6cff6..56676f0fb 100644
---- a/libfreerdp/core/info.c
-+++ b/libfreerdp/core/info.c
-@@ -24,6 +24,7 @@
- #endif
- 
- #include <winpr/crt.h>
-+#include <winpr/assert.h>
- #include <freerdp/crypto/crypto.h>
- #include <freerdp/log.h>
- #include <freerdp/session.h>
-@@ -1363,10 +1364,11 @@ static BOOL rdp_write_logon_info_v1(wStream* s, logon_info* info)
- 	return TRUE;
- }
- 
--static BOOL rdp_write_logon_info_v2(wStream* s, logon_info* info)
-+static BOOL rdp_write_logon_info_v2(wStream* s, const logon_info* info)
- {
- 	UINT32 Size = 2 + 4 + 4 + 4 + 4 + 558;
--	size_t domainLen, usernameLen;
-+	size_t domainLen = 0;
-+	size_t usernameLen = 0;
- 	int len;
- 	WCHAR* wString = NULL;
- 
-@@ -1376,11 +1378,13 @@ static BOOL rdp_write_logon_info_v2(wStream* s, logon_info* info)
- 	Stream_Write_UINT16(s, SAVE_SESSION_PDU_VERSION_ONE);
- 	Stream_Write_UINT32(s, Size);
- 	Stream_Write_UINT32(s, info->sessionId);
--	domainLen = strlen(info->domain);
-+	if (info->domain)
-+		domainLen = strlen(info->domain);
- 	if (domainLen > UINT32_MAX)
- 		return FALSE;
- 	Stream_Write_UINT32(s, (UINT32)(domainLen + 1) * 2);
--	usernameLen = strlen(info->username);
-+	if (info->username)
-+		usernameLen = strlen(info->username);
- 	if (usernameLen > UINT32_MAX)
- 		return FALSE;
- 	Stream_Write_UINT32(s, (UINT32)(usernameLen + 1) * 2);
-@@ -1457,10 +1461,11 @@ static BOOL rdp_write_logon_info_ex(wStream* s, logon_info_ex* info)
- 
- BOOL rdp_send_save_session_info(rdpContext* context, UINT32 type, void* data)
- {
--	wStream* s;
- 	BOOL status;
-+
-+	WINPR_ASSERT(context);
- 	rdpRdp* rdp = context->rdp;
--	s = rdp_data_pdu_init(rdp);
-+	wStream* s = rdp_data_pdu_init(rdp);
- 
- 	if (!s)
- 		return FALSE;
--- 
-2.53.0
-

SOURCES/crypto-base64-ensure-char-is-singend.patch

@@ -1,30 +0,0 @@
-From 7e1759c739002dc95d8f15672d0f700ca8dcce0e Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 17 Feb 2026 14:23:29 +0100
-Subject: [PATCH] [crypto,base64] ensure char is singend
-
-Backport of commit 62a9e787edb2cfce9858fa4ceda5461680efc590.
-
-Co-Authored-By: Cursor <cursoragent@cursor.com>
----
- libfreerdp/crypto/base64.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/libfreerdp/crypto/base64.c b/libfreerdp/crypto/base64.c
-index 5a5da89a4..c084de38e 100644
---- a/libfreerdp/crypto/base64.c
-+++ b/libfreerdp/crypto/base64.c
-@@ -93,6 +93,10 @@ char* crypto_base64_encode(const BYTE* data, int length)
- 
- static int base64_decode_char(char c)
- {
-+	/* ensure char is signed for this check */
-+	if ((int)c <= '\0')
-+		return -1;
-+
- 	if (c >= 'A' && c <= 'Z')
- 		return c - 'A';
- 
--- 
-2.52.0
-

SOURCES/gdi-gfx-properly-clamp-SurfaceToSurface.patch

@@ -1,50 +0,0 @@
-From ef99da020599a666b7d171eec6ab527b47dd33f3 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 22 Jan 2026 12:47:42 +0100
-Subject: [PATCH] [gdi,gfx] properly clamp SurfaceToSurface
-
-Backport of commit c4a7c371342edf0d307cea728f56d3302f0ab38c.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
----
- libfreerdp/gdi/gfx.c | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/libfreerdp/gdi/gfx.c b/libfreerdp/gdi/gfx.c
-index 3970715e0..968a5a17c 100644
---- a/libfreerdp/gdi/gfx.c
-+++ b/libfreerdp/gdi/gfx.c
-@@ -1175,7 +1175,6 @@ static UINT gdi_SurfaceToSurface(RdpgfxClientContext* context,
- 	UINT status = ERROR_INTERNAL_ERROR;
- 	UINT16 index;
- 	BOOL sameSurface;
--	UINT32 nWidth, nHeight;
- 	const RECTANGLE_16* rectSrc;
- 	RECTANGLE_16 invalidRect;
- 	gdiGfxSurface* surfaceSrc;
-@@ -1199,8 +1198,8 @@ static UINT gdi_SurfaceToSurface(RdpgfxClientContext* context,
- 	if (!is_rect_valid(rectSrc, surfaceSrc->width, surfaceSrc->height))
- 		goto fail;
- 
--	nWidth = rectSrc->right - rectSrc->left;
--	nHeight = rectSrc->bottom - rectSrc->top;
-+	const UINT32 nWidth = rectSrc->right - rectSrc->left;
-+	const UINT32 nHeight = rectSrc->bottom - rectSrc->top;
- 
- 	for (index = 0; index < surfaceToSurface->destPtsCount; index++)
- 	{
-@@ -1209,8 +1208,10 @@ static UINT gdi_SurfaceToSurface(RdpgfxClientContext* context,
- 		if (!is_rect_valid(&rect, surfaceDst->width, surfaceDst->height))
- 			goto fail;
- 
-+		const UINT32 rwidth = rect.right - rect.left;
-+		const UINT32 rheight = rect.bottom - rect.top;
- 		if (!freerdp_image_copy(surfaceDst->data, surfaceDst->format, surfaceDst->scanline,
--		                        destPt->x, destPt->y, nWidth, nHeight, surfaceSrc->data,
-+		                        destPt->x, destPt->y, rwidth, rheight, surfaceSrc->data,
- 		                        surfaceSrc->format, surfaceSrc->scanline, rectSrc->left,
- 		                        rectSrc->top, NULL, FREERDP_FLIP_NONE))
- 			goto fail;
--- 
-2.52.0
-

SOURCES/gdi-graphics-Use-freerdp_glyph_convert_ex.patch

@@ -1,36 +0,0 @@
-From d25ffd608bf2bd38022a3930d0b3fc1b7c873c1a Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Sat, 28 Mar 2026 12:13:06 +0100
-Subject: [PATCH] [gdi,graphics] Use freerdp_glyph_convert_ex
-
-Backport of commit 9f0eb3b7d43069a1e973464bcb43d1ef965ae65e.
-
-Made-with: Cursor
----
- libfreerdp/gdi/graphics.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/libfreerdp/gdi/graphics.c b/libfreerdp/gdi/graphics.c
-index dab159c43..b1129fb7c 100644
---- a/libfreerdp/gdi/graphics.c
-+++ b/libfreerdp/gdi/graphics.c
-@@ -262,7 +262,6 @@ static BYTE* freerdp_glyph_convert_ex(UINT32 width, UINT32 height, const BYTE* d
- 
- static BOOL gdi_Glyph_New(rdpContext* context, const rdpGlyph* glyph)
- {
--	BYTE* data;
- 	gdiGlyph* gdi_glyph;
- 
- 	if (!context || !glyph)
-@@ -275,7 +274,7 @@ static BOOL gdi_Glyph_New(rdpContext* context, const rdpGlyph* glyph)
- 		return FALSE;
- 
- 	gdi_glyph->hdc->format = PIXEL_FORMAT_MONO;
--	data = freerdp_glyph_convert(glyph->cx, glyph->cy, glyph->aj);
-+	BYTE* data = freerdp_glyph_convert_ex(glyph->cx, glyph->cy, glyph->aj, glyph->cb);
- 
- 	if (!data)
- 	{
--- 
-2.53.0
-

SOURCES/utils-smartcard-add-length-validity-checks.patch

@@ -1,79 +0,0 @@
-From 070f9e070c59a121cd93541835dc0086084bb6ad Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 17 Feb 2026 11:05:59 +0100
-Subject: [PATCH] [utils,smartcard] add length validity checks
-
-Backport of commit 57c5647d98c2a026de8b681159cb188ca0439ef8.
-
-Co-Authored-By: Cursor <cursoragent@cursor.com>
----
- channels/smartcard/client/smartcard_pack.c | 27 +++++++++++++++++-----
- 1 file changed, 21 insertions(+), 6 deletions(-)
-
-diff --git a/channels/smartcard/client/smartcard_pack.c b/channels/smartcard/client/smartcard_pack.c
-index f70eb4e5d..687f1110b 100644
---- a/channels/smartcard/client/smartcard_pack.c
-+++ b/channels/smartcard/client/smartcard_pack.c
-@@ -98,13 +98,16 @@ static BOOL smartcard_ndr_pointer_read_(wStream* s, UINT32* index, UINT32* ptr,
- 	return TRUE;
- }
- 
--static LONG smartcard_ndr_read(wStream* s, BYTE** data, size_t min, size_t elementSize,
--                               ndr_ptr_t type)
-+static LONG smartcard_ndr_read_ex(wStream* s, BYTE** data, size_t min,
-+                                  size_t elementSize, ndr_ptr_t type, size_t* plen)
- {
- 	size_t len, offset, len2;
- 	void* r;
- 	size_t required;
- 
-+	if (plen)
-+		*plen = 0;
-+
- 	switch (type)
- 	{
- 		case NDR_PTR_FULL:
-@@ -181,11 +184,20 @@ static LONG smartcard_ndr_read(wStream* s, BYTE** data, size_t min, size_t eleme
- 	if (!r)
- 		return SCARD_E_NO_MEMORY;
- 	Stream_Read(s, r, len);
--	smartcard_unpack_read_size_align(NULL, s, len, 4);
-+	const LONG pad = smartcard_unpack_read_size_align(NULL, s, len, 4);
-+	len += (size_t)pad;
- 	*data = r;
-+	if (plen)
-+		*plen = len;
- 	return STATUS_SUCCESS;
- }
- 
-+static LONG smartcard_ndr_read(wStream* s, BYTE** data, size_t min, size_t elementSize,
-+                               ndr_ptr_t type)
-+{
-+	return smartcard_ndr_read_ex(s, data, min, elementSize, type, NULL);
-+}
-+
- static BOOL smartcard_ndr_pointer_write(wStream* s, UINT32* index, DWORD length)
- {
- 	const UINT32 ndrPtr = 0x20000 + (*index) * 4;
-@@ -3427,12 +3439,15 @@ LONG smartcard_unpack_set_attrib_call(SMARTCARD_DEVICE* smartcard, wStream* s, S
- 
- 	if (ndrPtr)
- 	{
--		// TODO: call->cbAttrLen was larger than the pointer value.
--		// TODO: Maybe need to refine the checks?
--		status = smartcard_ndr_read(s, &call->pbAttr, 0, 1, NDR_PTR_SIMPLE);
-+		size_t len = 0;
-+		status = smartcard_ndr_read_ex(s, &call->pbAttr, 0, 1, NDR_PTR_SIMPLE, &len);
- 		if (status != SCARD_S_SUCCESS)
- 			return status;
-+		if (call->cbAttrLen > len)
-+			call->cbAttrLen = (DWORD)len;
- 	}
-+	else
-+		call->cbAttrLen = 0;
- 	smartcard_trace_set_attrib_call(smartcard, call);
- 	return SCARD_S_SUCCESS;
- }
--- 
-2.52.0
-

SPECS/freerdp.spec

@@ -1,570 +0,0 @@
-# Can be rebuilt with FFmpeg/OpenH264 support enabled by passing
-# "--with=ffmpeg", or "--with=openh264" to mock/rpmbuild; or by globally
-# setting these variables:
-# https://bugzilla.redhat.com/show_bug.cgi?id=2242028
-#global _with_ffmpeg 1
-#global _with_openh264 1
-
-# Can be rebuilt with OpenCL support enabled by passing # "--with=opencl"
-# or by globally setting:
-#global _opencl 1
-
-# Momentarily disable GSS support
-# https://github.com/FreeRDP/FreeRDP/issues/4348
-#global _with_gss 1
-
-# Disable server support in RHEL
-# https://bugzilla.redhat.com/show_bug.cgi?id=1639165
-%if 0%{?fedora} || 0%{?rhel} >= 10
-%global _with_server 1
-%endif
-
-# Disable support for missing codecs in RHEL
-%{!?rhel:%global _with_soxr 1}
-%if 0%{?fedora} || 0%{?rhel} >= 8
-%global _with_lame 1
-%endif
-
-Name:           freerdp
-Version:        2.11.7
-Release:        7%{?dist}
-Epoch:          2
-Summary:        Free implementation of the Remote Desktop Protocol (RDP)
-License:        ASL 2.0
-URL:            http://www.freerdp.com/
-
-Source0:        https://github.com/FreeRDP/FreeRDP/archive/%{version}/FreeRDP-%{version}.tar.gz
-
-# Revert changes that break API
-# https://issues.redhat.com/browse/RHEL-53081
-Patch0:	        Revert-Moved-clipboard-utils-to-core-library-fixes-6.patch
-
-# https://github.com/FreeRDP/FreeRDP/commit/c4a7c371342edf0d307cea728f56d3302f0ab38c
-Patch1:         gdi-gfx-properly-clamp-SurfaceToSurface.patch
-
-# https://github.com/FreeRDP/FreeRDP/commit/c4391827d7facfc874ca7f61a92afb82232a5748
-Patch2:         codec-clear-fix-clear_resize_buffer-checks.patch
-
-# https://github.com/FreeRDP/FreeRDP/commit/f8688b57f6cfad9a0b05475a6afbde355ffab720
-Patch3:         codec-clear-fix-off-by-one-length-check.patch
-
-# https://github.com/FreeRDP/FreeRDP/commit/1bab198a2edd0d0e6e1627d21a433151ea190500
-Patch4:         codec-planar-fix-decoder-length-checks.patch
-
-# https://github.com/FreeRDP/FreeRDP/commit/243ecf804bb122e8e643a5c142ad5a49d7aa19ee
-Patch5:         codec-clear-check-clear_decomress-glyphData.patch
-
-# https://github.com/FreeRDP/FreeRDP/commit/0421b53fcb4a80c95f51342e4a2c40c68a4101d3
-Patch6:         client-x11-fix-double-free-in-case-of-invalid-pointe.patch
-
-# https://github.com/FreeRDP/FreeRDP/commit/52106a26726a2aba77aa6d86014d2eb3507f0783
-Patch7:         cache-offscreen-invalidate-bitmap-before-free.patch
-
-# CVE-2026-22855
-# https://github.com/FreeRDP/FreeRDP/commit/57c5647d98c2a026de8b681159cb188ca0439ef8
-Patch8:         utils-smartcard-add-length-validity-checks.patch
-
-# CVE-2026-22858
-# https://github.com/FreeRDP/FreeRDP/commit/62a9e787edb2cfce9858fa4ceda5461680efc590
-Patch9:         crypto-base64-ensure-char-is-singend.patch
-
-# CVE-2026-22859
-# https://github.com/FreeRDP/FreeRDP/commit/7b7e6de8fe427a2f01d331056774aec69710590b
-Patch10:        channels-urbdrc-check-interface-indices-before-use.patch
-
-# CVE-2026-26955
-# https://github.com/FreeRDP/FreeRDP/commit/7d8fdce2d0ef337cb86cb37fc0c436c905e04d77
-Patch11:        codec-clear-fix-destination-checks.patch
-
-# CVE-2026-26965
-# https://github.com/FreeRDP/FreeRDP/commit/a0be5cb87d760bb1c803ad1bb835aa1e73e62abc
-Patch12:        codec-planar-fix-missing-destination-bounds-checks.patch
-
-# CVE-2026-22852
-# https://github.com/FreeRDP/FreeRDP/commit/cd1ffa112cfbe1b40a9fd57e299a8ea12e23df0d
-Patch13:        channels-audin-free-up-old-audio-formats.patch
-
-# CVE-2026-22854
-# https://github.com/FreeRDP/FreeRDP/commit/3da319570c8a6be0a79b3306f1ed354c4a943259
-Patch14:        channels-drive-fix-constant-type.patch
-
-# CVE-2026-22856
-# https://github.com/FreeRDP/FreeRDP/commit/b35aa3614d32bff3fc1272cd7c4617f711fca1a4
-# https://github.com/FreeRDP/FreeRDP/commit/675c20f08f32ca5ec06297108bdf30147d6e2cd9
-Patch15:        channels-serial-lock-list-dictionary.patch
-Patch16:        channels-serial-explicitly-lock-serial-IrpThreads.patch
-
-# CVE-2026-23732
-# https://github.com/FreeRDP/FreeRDP/commit/3bc1eeb4f63ceec9a696af194e4c1ea0e67ff60c
-# https://github.com/FreeRDP/FreeRDP/commit/9f0eb3b7d43069a1e973464bcb43d1ef965ae65e
-Patch17:        codec-color-add-freerdp_glyph_convert_ex.patch
-Patch18:        gdi-graphics-Use-freerdp_glyph_convert_ex.patch
-
-# CVE-2026-23948
-# https://github.com/FreeRDP/FreeRDP/commit/4d44e3c097656a8b9ec696353647b0888ca45860
-Patch19:        core-info-fix-missing-NULL-check.patch
-
-# CVE-2026-24491
-# https://github.com/FreeRDP/FreeRDP/commit/e02e052f6692550e539d10f99de9c35a23492db2
-# https://github.com/FreeRDP/FreeRDP/commit/635ae3c8193256db01774fab5ff11bcae57aed6b
-# https://github.com/FreeRDP/FreeRDP/commit/e01cd85c8003a245ef9778f0eda4b9235514c201
-Patch20:        channels-drdynvc-reset-channel_callback-before-close.patch
-Patch21:        channels-video-unify-error-handling.patch
-Patch22:        channels-video-fix-wrong-cast.patch
-
-# CVE-2026-24675
-# https://github.com/FreeRDP/FreeRDP/commit/d676518809c319eec15911c705c13536036af2ae
-Patch23:        channels-urbdrc-do-not-free-MsConfig-on-failure.patch
-
-# CVE-2026-24676
-# https://github.com/FreeRDP/FreeRDP/commit/026b81ae5831ac1598d8f7371e0d0996fac7db00
-Patch24:        channels-audin-reset-audin-format.patch
-
-# CVE-2026-24679
-# https://github.com/FreeRDP/FreeRDP/commit/2d563a50be17c1b407ca448b1321378c0726dd31
-Patch25:        channels-urbdrc-ensure-InterfaceNumber-is-within-ran.patch
-
-# CVE-2026-24681
-# https://github.com/FreeRDP/FreeRDP/commit/414f701464929c217f2509bcbd6d2c1f00f7ed73
-Patch26:        channels-urbdrc-cancel-all-usb-transfers-on-channel-.patch
-
-# CVE-2026-24683
-# https://github.com/FreeRDP/FreeRDP/commit/d9ca272dce7a776ab475e9b1a8e8c3d2968c8486
-Patch27:        channels-ainput-lock-context-when-updating-listener.patch
-
-# CVE-2026-24684
-# https://github.com/FreeRDP/FreeRDP/commit/622bb7b4402491ca003f47472d0e478132673696
-# https://github.com/FreeRDP/FreeRDP/commit/afa6851dc80835d3101e40fcef51b6c5c0f43ea5
-Patch28:        channels-rdpsnd-terminate-thread-before-free.patch
-Patch29:        channel-rdpsnd-only-clean-up-thread-before-free.patch
-
-# CVE-2026-31806
-# https://github.com/FreeRDP/FreeRDP/commit/83d9aedea278a74af3e490ff5eeb889c016dbb2b
-# https://github.com/FreeRDP/FreeRDP/commit/169971607cece48384cb94632b829bd57336af0f
-Patch30:        codec-nsc-limit-copy-area-in-nsc_process_message.patch
-Patch31:        codec-nsc-fix-use-of-nsc_process_message.patch
-
-# CVE-2026-33984
-# https://github.com/FreeRDP/FreeRDP/commit/a2dde6d9832cb032e8cf12cab3da84dafbab9006
-Patch32:        codec-clear-update-CLEAR_VBAR_ENTRY-size-after-alloc.patch
-
-# CVE-2026-33983
-# https://github.com/FreeRDP/FreeRDP/commit/78188ab479c8e6eb9ba2475b3732c76b4bbe5425
-# https://github.com/FreeRDP/FreeRDP/commit/78677dc6e262f46937d00c3aa52381e4bb198fa5
-Patch33:        codec-progressive-fail-progressive_rfx_quant_sub-on-invalid-values.patch
-Patch34:        codec-progressive-fix-underflow-guard-in-progressive_rfx_quant_sub.patch
-
-BuildRequires:  gcc
-BuildRequires:  gcc-c++
-BuildRequires:  alsa-lib-devel
-BuildRequires:  cmake >= 2.8
-BuildRequires:  cups-devel
-BuildRequires:  gsm-devel
-%{?_with_lame:BuildRequires:  lame-devel}
-BuildRequires:  libicu-devel
-BuildRequires:  libjpeg-turbo-devel
-BuildRequires:  libX11-devel
-BuildRequires:  libXcursor-devel
-BuildRequires:  libXdamage-devel
-BuildRequires:  libXext-devel
-BuildRequires:  libXi-devel
-BuildRequires:  libXinerama-devel
-BuildRequires:  libxkbfile-devel
-BuildRequires:  libXrandr-devel
-%{?_with_server:BuildRequires:  libXtst-devel}
-BuildRequires:  libXv-devel
-%{?_with_opencl:BuildRequires: opencl-headers >= 3.0}
-%{?_with_opencl:BuildRequires: ocl-icd-devel}
-%{?_with_openh264:BuildRequires:  openh264-devel}
-%{?_with_x264:BuildRequires:  x264-devel}
-%{?_with_server:BuildRequires:  pam-devel}
-BuildRequires:  xmlto
-BuildRequires:  zlib-devel
-BuildRequires:  multilib-rpm-config
-
-BuildRequires:  pkgconfig(cairo)
-%{?_with_gss:BuildRequires:  pkgconfig(krb5) >= 1.13}
-BuildRequires:  pkgconfig(libpcsclite)
-BuildRequires:  pkgconfig(libpulse)
-BuildRequires:  pkgconfig(libsystemd)
-BuildRequires:  pkgconfig(libusb-1.0)
-BuildRequires:  pkgconfig(openssl)
-%{?_with_soxr:BuildRequires:  pkgconfig(soxr)}
-BuildRequires:  pkgconfig(wayland-client)
-BuildRequires:  pkgconfig(wayland-scanner)
-BuildRequires:  pkgconfig(xkbcommon)
-
-%{?_with_ffmpeg:
-BuildRequires:  pkgconfig(libavcodec) >= 57.48.101
-BuildRequires:  pkgconfig(libavutil)
-}
-
-Provides:       xfreerdp = %{?epoch}:%{version}-%{release}
-Requires:       %{name}-libs%{?_isa} = %{?epoch}:%{version}-%{release}
-Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
-
-%description
-The xfreerdp & wlfreerdp Remote Desktop Protocol (RDP) clients from the FreeRDP
-project.
-
-xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows
-machines, xrdp and VirtualBox.
-
-%package        libs
-Summary:        Core libraries implementing the RDP protocol
-Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
-Obsoletes:      %{name}-plugins < 1:1.1.0
-Provides:       %{name}-plugins = %{?epoch}:%{version}-%{release}
-%description    libs
-libfreerdp-core can be embedded in applications.
-
-libfreerdp-channels and libfreerdp-kbd might be convenient to use in X
-applications together with libfreerdp-core.
-
-libfreerdp-core can be extended with plugins handling RDP channels.
-
-%package        devel
-Summary:        Development files for %{name}
-Requires:       %{name}-libs%{?_isa} = %{?epoch}:%{version}-%{release}
-Requires:       pkgconfig
-Requires:       cmake >= 2.8
-
-%description    devel
-The %{name}-devel package contains libraries and header files for developing
-applications that use %{name}-libs.
-
-%{?_with_server:
-%package        server
-Summary:        Server support for %{name}
-Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
-Requires:       %{name}-libs%{?_isa} = %{?epoch}:%{version}-%{release}
-
-%description    server
-The %{name}-server package contains servers which can export a desktop via
-the RDP protocol.
-}
-
-%package -n     libwinpr
-Summary:        Windows Portable Runtime
-Provides:       %{name}-libwinpr = %{?epoch}:%{version}-%{release}
-Obsoletes:      %{name}-libwinpr < 1:1.2.0
-
-%description -n libwinpr
-WinPR provides API compatibility for applications targeting non-Windows
-environments. When on Windows, the original native API is being used instead of
-the equivalent WinPR implementation, without having to modify the code using it.
-
-%package -n     libwinpr-devel
-Summary:        Windows Portable Runtime development files
-Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
-Requires:       pkgconfig
-Requires:       cmake >= 2.8
-
-%description -n libwinpr-devel
-The %{name}-libwinpr-devel package contains libraries and header files for
-developing applications that use %{name}-libwinpr.
-
-%prep
-%autosetup -p1 -n FreeRDP-%{version}
-
-# Rpmlint fixes
-find . -name "*.h" -exec chmod 664 {} \;
-find . -name "*.c" -exec chmod 664 {} \;
-
-%build
-%cmake %{?_cmake_skip_rpath} \
-    -DCMAKE_INSTALL_LIBDIR:PATH=%{_lib} \
-    -DWITH_ALSA=ON \
-    -DWITH_CAIRO=ON \
-    -DWITH_CUPS=ON \
-    -DWITH_CHANNELS=ON -DBUILTIN_CHANNELS=OFF \
-    -DWITH_CLIENT=ON \
-    -DWITH_DIRECTFB=OFF \
-    -DWITH_DSP_FFMPEG=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
-    -DWITH_FFMPEG=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
-    -DWITH_GSM=ON \
-    -DWITH_GSSAPI=%{?_with_gss:ON}%{?!_with_gss:OFF} \
-    -DWITH_ICU=ON \
-    -DWITH_IPP=OFF \
-    -DWITH_JPEG=ON \
-    -DWITH_LAME=%{?_with_lame:ON}%{?!_with_lame:OFF} \
-    -DWITH_MANPAGES=ON \
-    -DWITH_OPENCL=%{?_with_opencl:ON}%{?!_with_opencl:OFF} \
-    -DWITH_OPENH264=%{?_with_openh264:ON}%{?!_with_openh264:OFF} \
-    -DWITH_OPENSSL=ON \
-    -DWITH_PCSC=ON \
-    -DWITH_PULSE=ON \
-    -DWITH_SERVER=%{?_with_server:ON}%{?!_with_server:OFF} \
-    -DWITH_SERVER_INTERFACE=%{?_with_server:ON}%{?!_with_server:OFF} \
-    -DWITH_SHADOW_X11=%{?_with_server:ON}%{?!_with_server:OFF} \
-    -DWITH_SHADOW_MAC=%{?_with_server:ON}%{?!_with_server:OFF} \
-    -DWITH_SOXR=%{?_with_soxr:ON}%{?!_with_soxr:OFF} \
-    -DWITH_WAYLAND=ON \
-    -DWITH_X11=ON \
-    -DWITH_XCURSOR=ON \
-    -DWITH_XEXT=ON \
-    -DWITH_XKBFILE=ON \
-    -DWITH_XI=ON \
-    -DWITH_XINERAMA=ON \
-    -DWITH_XRENDER=ON \
-    -DWITH_XTEST=%{?_with_server:ON}%{?!_with_server:OFF} \
-    -DWITH_XV=ON \
-    -DWITH_ZLIB=ON \
-%ifarch x86_64
-    -DWITH_SSE2=ON \
-    -DWITH_VAAPI=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
-%else
-    -DWITH_SSE2=OFF \
-%endif
-%ifarch armv7hl
-    -DARM_FP_ABI=hard \
-    -DWITH_NEON=OFF \
-%endif
-%ifarch armv7hnl
-    -DARM_FP_ABI=hard \
-    -DWITH_NEON=ON \
-%endif
-%ifarch armv5tel armv6l armv7l
-    -DARM_FP_ABI=soft \
-    -DWITH_NEON=OFF \
-%endif
-    %{nil}
-
-%cmake_build
-
-%install
-%cmake_install
-
-find %{buildroot} -name "*.a" -delete
-
-%multilib_fix_c_header --file %{_includedir}/freerdp2/freerdp/build-config.h
-
-%files
-%{_bindir}/winpr-hash
-%{_bindir}/winpr-makecert
-%{_bindir}/wlfreerdp
-%{_bindir}/xfreerdp
-%{_mandir}/man1/winpr-hash.1*
-%{_mandir}/man1/winpr-makecert.1*
-%{_mandir}/man1/wlfreerdp.1*
-%{_mandir}/man1/xfreerdp.1*
-
-%files libs
-%license LICENSE
-%doc README.md ChangeLog
-%{_libdir}/freerdp2/
-%{_libdir}/libfreerdp-client2.so.*
-%{?_with_server:
-%{_libdir}/libfreerdp-server2.so.*
-%{_libdir}/libfreerdp-shadow2.so.*
-%{_libdir}/libfreerdp-shadow-subsystem2.so.*
-}
-%{_libdir}/libfreerdp2.so.*
-%{_libdir}/libuwac0.so.*
-%{_mandir}/man7/wlog.*
-
-%files devel
-%{_includedir}/freerdp2
-%{_includedir}/uwac0
-%{_libdir}/cmake/FreeRDP2
-%{_libdir}/cmake/FreeRDP-Client2
-%{?_with_server:
-%{_libdir}/cmake/FreeRDP-Server2
-%{_libdir}/cmake/FreeRDP-Shadow2
-}
-%{_libdir}/cmake/uwac0
-%{_libdir}/libfreerdp-client2.so
-%{?_with_server:
-%{_libdir}/libfreerdp-server2.so
-%{_libdir}/libfreerdp-shadow2.so
-%{_libdir}/libfreerdp-shadow-subsystem2.so
-}
-%{_libdir}/libfreerdp2.so
-%{_libdir}/libuwac0.so
-%{_libdir}/pkgconfig/freerdp2.pc
-%{_libdir}/pkgconfig/freerdp-client2.pc
-%{?_with_server:
-%{_libdir}/pkgconfig/freerdp-server2.pc
-%{_libdir}/pkgconfig/freerdp-shadow2.pc
-}
-%{_libdir}/pkgconfig/uwac0.pc
-
-%{?_with_server:
-%files server
-%{_bindir}/freerdp-proxy
-%{_bindir}/freerdp-shadow-cli
-%{_mandir}/man1/freerdp-shadow-cli.1*
-}
-
-%files -n libwinpr
-%license LICENSE
-%doc README.md ChangeLog
-%{_libdir}/libwinpr2.so.*
-%{_libdir}/libwinpr-tools2.so.*
-
-%files -n libwinpr-devel
-%{_libdir}/cmake/WinPR2
-%{_includedir}/winpr2
-%{_libdir}/libwinpr2.so
-%{_libdir}/libwinpr-tools2.so
-%{_libdir}/pkgconfig/winpr2.pc
-%{_libdir}/pkgconfig/winpr-tools2.pc
-
-%changelog
-* Fri Apr 10 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-7
-- Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
-- Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)
-  Resolves: RHEL-162949, RHEL-162965
-
-* Tue Mar 31 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-6
-- Fix use of nsc_process_message
-  Resolves: RHEL-155984
-
-* Fri Mar 27 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-5
-- Backport several CVE fixes
-  Resolves: RHEL-147954, RHEL-147955, RHEL-147970, RHEL-147977, RHEL-147980
-  Resolves: RHEL-148002, RHEL-148014, RHEL-148031, RHEL-148906, RHEL-148996
-  Resolves: RHEL-149007, RHEL-149056, RHEL-155984
-
-* Wed Mar 25 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-4
-- Backport several CVE fixes
-  Resolves: RHEL-151979, RHEL-152206
-
-* Tue Feb 17 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-3
-- Backport several CVE fixes
-  Resolves: RHEL-148825, RHEL-148865, RHEL-148982
-
-* Tue Jan 27 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-2
-- Backport several CVE fixes
-  Resolves: RHEL-142417, RHEL-142401, RHEL-142385, RHEL-142369, RHEL-142353
-  Resolves: RHEL-142337, RHEL-142321
-
-* Tue Oct 01 2024 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1
-- Update to 2.11.7 (RHEL-53081)
-
-* Tue Dec 13 2022 Ondrej Holy <oholy@redhat.com> - 2:2.2.0-10
-- Fix "implicit declaration of function" errors (#2136153, #2145139)
-
-* Thu Dec 08 2022 Ondrej Holy <oholy@redhat.com> - - 2:2.2.0-9
-- CVE-2022-39282: Fix length checks in parallel driver (#2136151)
-- CVE-2022-39283: Add missing length check in video channel (#2136153)
-- CVE-2022-39316, CVE-2022-39317: Add missing length checks in zgfx (#2145139)
-- CVE-2022-39318: Fix division by zero in urbdrc channel (#2145139)
-- CVE-2022-39319: Add missing length checks in urbdrc channel (#2145139)
-- CVE-2022-39320: Ensure urb_create_iocompletion uses size_t (#2145139)
-- CVE-2022-39347: Fix path validation in drive channel (#2145139)
-- CVE-2022-41877: Add missing length check in drive channel (#2145139)
-
-* Thu Aug 11 2022 Ondrej Holy <oholy@redhat.com> - 2:2.2.0-8
-- Fix /monitor-list output (rhbz#2108866)
-
-* Wed Nov 10 2021 Ondrej Holy <oholy@redhat.com> - 2:2.2.0-4
-- Refactored RPC gateway parser (rhbz#2017949)
-
-* Fri Nov 05 2021 Felipe Borges <feborges@redhat.com> - 2:2.2.0-3
-- Add checks for bitmap and glyph width and heigth values (rhbz#2017956)
-
-* Wed Apr 28 2021 Ondrej Holy <oholy@redhat.com> - 2:2.2.0-2
-- Fix exit codes for /help and similar options (rhbz#1910029)
-
-* Fri Nov 20 2020 Ondrej Holy <oholy@redhat.com> - 2:2.2.0-1
-- Update to 2.2.0 (rhbz#1881971)
-
-* Mon May 25 2020 Ondrej Holy <oholy@redhat.com> - 2:2.1.1-1
-- Update to 2.1.1 (rhbz#1834287).
-
-* Fri Apr 17 2020 Ondrej Holy <oholy@redhat.com> - 2:2.0.0-47.rc4
-- Fix SCARD_INSUFFICIENT_BUFFER error (rhbz#1803054)
-- Do not advertise /usb in help output (rhbz#1761144)
-
-* Wed Nov 28 2018 Ondrej Holy <oholy@redhat.com> - 2:2.0.0-46.rc4
-- Update to 2.0.0-rc4 (#1624340)
-
-* Mon Oct 15 2018 Ondrej Holy <oholy@redhat.com> - 2:2.0.0-45.rc3
-- Disable server support in RHEL (#1639165)
-
-* Wed Oct 10 2018 Ondrej Holy <oholy@redhat.com> - 2:2.0.0-44.rc3
-- Fix packaging issues found by rpmdiff (#1637487)
-
-* Tue Sep 25 2018 Ondrej Holy <oholy@redhat.com> - 2:2.0.0-43.rc3
-- Fix important defects found by covscan (#1602500)
-
-* Thu Sep 06 2018 Ondrej Holy <oholy@redhat.com> - 2:2.0.0-42.rc3
-- Update to 2.0.0-rc3 (#1624340)
-
-* Mon Apr 09 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-41.20180405gita9ecd6a
-- Update to latest snapshot.
-
-* Wed Mar 21 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-40.20180320gitde83f4d
-- Add PAM support (fixes freerdp-shadow-cli). Thanks Paolo Zeppegno.
-- Update to latest snapshot.
-
-* Thu Mar 15 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-39.20180314gitf8baeb7
-- Update to latest snapshot.
-- Fixes connection to RDP servers with the latest Microsoft patches:
-  https://github.com/FreeRDP/FreeRDP/issues/4449
-
-* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-38.20180115git8f52c7e
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
-
-* Thu Jan 18 2018 Karsten Hopp <karsten@redhat.com> - 2.0.0-37git}
-- use versioned build requirement on pkgconfig(openssl) to prevent using
-  compat-openssl10-devel instead of openssl-devel
-
-* Tue Jan 16 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-36.20180115git8f52c7e
-- Update to latest snapshot.
-- Make GSS support optional and disable it for now (#1534094 and FreeRDP #4348,
-  #1435, #4363).
-
-* Wed Dec 20 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-35.20171220gitbfe8359
-- Update to latest snapshot post 2.0.0rc1.
-
-* Mon Sep 11 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-34.20170831git3b83526
-- Update to latest snapshot.
-- Trim changelog.
-
-* Mon Aug 07 2017 Björn Esser <besser82@fedoraproject.org> - 2:2.0.0-33.20170724gitf8c9f43
-- Rebuilt for AutoReq cmake-filesystem
-
-* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-32.20170724gitf8c9f43
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
-
-* Thu Jul 27 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-31.20170724gitf8c9f43
-- Update to latest snapshot, Talos security fixes.
-
-* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-30.20170710gitf580bea
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Wed Jul 12 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-29.20170710gitf580bea
-- Update to latest snapshot.
-
-* Mon Jun 26 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-28.20170623git9904c32
-- Update to latest snapshot.
-
-* Mon May 15 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-27.20170512gitb1df835
-- Update to latest snapshot.
-
-* Thu Apr 20 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-26.20170419gitbfcf8e7
-- Update to latest 2.0 snapshot.
-
-* Thu Apr 13 2017 Orion Poplawski <orion@cora.nwra.com> - 2:2.0.0-25.20170317git8c68761
-- Install tools via make install
-
-* Wed Mar 22 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-24.20170317git8c68761
-- Update to latest snapshot.
-
-* Mon Mar 06 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-23.20170302git210de68
-- Remove shared libxfreerdp-client shared library.
-
-* Thu Mar 02 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-22.20170302git210de68
-- Move libxfreerdp-client shared object into devel subpackage.
-
-* Thu Mar 02 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-21.20170302git210de68
-- Update to latest snapshot.
-- Update build requirements, tune build options.
-
-* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-20.20161228git90877f5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
-
-* Mon Jan 09 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-19.20161228git90877f5
-- Update to latest snapshot.

Use-default-threadpool.patch

@@ -0,0 +1,321 @@
+From 00968fd6e647af286e67bbd616168c4de7a39208 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Wed, 3 Sep 2025 14:40:47 +0200
+Subject: [PATCH 067/100] [codec] use default threadpool
+
+Backported together with these commits to be applicable:
+  [codec,yuv] fix thread count calculation
+   - 17315c593655d476cccfb9a1b56e41f37030f8e1
+  [codec,yuv] fix worker object handling
+   - 1cc64eb58b2f5ce9e4ad8aa8610e085f696e578c
+  Fix YUV conversion for systems with lots of CPUs
+   - 774ee652a9c73c0bc3cdba26eba0c112f079cee4
+
+---
+ libfreerdp/codec/progressive.c |  5 ++-
+ libfreerdp/codec/rfx.c         | 56 +++++++---------------------------
+ libfreerdp/codec/rfx_types.h   |  6 ----
+ libfreerdp/codec/yuv.c         | 32 ++-----------------
+ 4 files changed, 16 insertions(+), 83 deletions(-)
+
+diff --git a/libfreerdp/codec/progressive.c b/libfreerdp/codec/progressive.c
+index 6396e0f2a..8b5200546 100644
+--- a/libfreerdp/codec/progressive.c
++++ b/libfreerdp/codec/progressive.c
+@@ -1698,9 +1698,8 @@ static INLINE SSIZE_T progressive_process_tiles(
+ 
+ 		if (progressive->rfx_context->priv->UseThreads)
+ 		{
+-			progressive->work_objects[idx] =
+-			    CreateThreadpoolWork(progressive_process_tiles_tile_work_callback, (void*)param,
+-			                         &progressive->rfx_context->priv->ThreadPoolEnv);
++			progressive->work_objects[idx] = CreateThreadpoolWork(
++			    progressive_process_tiles_tile_work_callback, (void*)param, NULL);
+ 			if (!progressive->work_objects[idx])
+ 			{
+ 				WLog_Print(progressive->log, WLOG_ERROR,
+diff --git a/libfreerdp/codec/rfx.c b/libfreerdp/codec/rfx.c
+index 8832cd740..2ec4eb521 100644
+--- a/libfreerdp/codec/rfx.c
++++ b/libfreerdp/codec/rfx.c
+@@ -205,16 +205,8 @@ RFX_CONTEXT* rfx_context_new(BOOL encoder)
+ 
+ RFX_CONTEXT* rfx_context_new_ex(BOOL encoder, UINT32 ThreadingFlags)
+ {
+-	HKEY hKey = NULL;
+-	LONG status = 0;
+-	DWORD dwType = 0;
+-	DWORD dwSize = 0;
+-	DWORD dwValue = 0;
+-	SYSTEM_INFO sysinfo;
+-	RFX_CONTEXT* context = NULL;
+-	wObject* pool = NULL;
+ 	RFX_CONTEXT_PRIV* priv = NULL;
+-	context = (RFX_CONTEXT*)winpr_aligned_calloc(1, sizeof(RFX_CONTEXT), 32);
++	RFX_CONTEXT* context = (RFX_CONTEXT*)winpr_aligned_calloc(1, sizeof(RFX_CONTEXT), 32);
+ 
+ 	if (!context)
+ 		return NULL;
+@@ -233,7 +225,7 @@ RFX_CONTEXT* rfx_context_new_ex(BOOL encoder, UINT32 ThreadingFlags)
+ 	if (!priv->TilePool)
+ 		goto fail;
+ 
+-	pool = ObjectPool_Object(priv->TilePool);
++	wObject* pool = ObjectPool_Object(priv->TilePool);
+ 	pool->fnObjectInit = rfx_tile_init;
+ 
+ 	if (context->encoder)
+@@ -267,29 +259,22 @@ RFX_CONTEXT* rfx_context_new_ex(BOOL encoder, UINT32 ThreadingFlags)
+ 
+ 	if (!(ThreadingFlags & THREADING_FLAGS_DISABLE_THREADS))
+ 	{
++		HKEY hKey = NULL;
+ 		priv->UseThreads = TRUE;
+ 
+-		GetNativeSystemInfo(&sysinfo);
+-		priv->MinThreadCount = sysinfo.dwNumberOfProcessors;
+-		priv->MaxThreadCount = 0;
+-		status = RegOpenKeyExA(HKEY_LOCAL_MACHINE, RFX_KEY, 0, KEY_READ | KEY_WOW64_64KEY, &hKey);
++		const LONG status =
++		    RegOpenKeyExA(HKEY_LOCAL_MACHINE, RFX_KEY, 0, KEY_READ | KEY_WOW64_64KEY, &hKey);
+ 
+ 		if (status == ERROR_SUCCESS)
+ 		{
+-			dwSize = sizeof(dwValue);
++			DWORD dwType = 0;
++			DWORD dwValue = 0;
++			DWORD dwSize = sizeof(dwValue);
+ 
+ 			if (RegQueryValueEx(hKey, _T("UseThreads"), NULL, &dwType, (BYTE*)&dwValue, &dwSize) ==
+ 			    ERROR_SUCCESS)
+ 				priv->UseThreads = dwValue ? 1 : 0;
+ 
+-			if (RegQueryValueEx(hKey, _T("MinThreadCount"), NULL, &dwType, (BYTE*)&dwValue,
+-			                    &dwSize) == ERROR_SUCCESS)
+-				priv->MinThreadCount = dwValue;
+-
+-			if (RegQueryValueEx(hKey, _T("MaxThreadCount"), NULL, &dwType, (BYTE*)&dwValue,
+-			                    &dwSize) == ERROR_SUCCESS)
+-				priv->MaxThreadCount = dwValue;
+-
+ 			RegCloseKey(hKey);
+ 		}
+ 	}
+@@ -304,20 +289,6 @@ RFX_CONTEXT* rfx_context_new_ex(BOOL encoder, UINT32 ThreadingFlags)
+ 		/* from multiple threads. This call will initialize all function pointers correctly     */
+ 		/* before any decoding threads are started */
+ 		primitives_get();
+-		priv->ThreadPool = CreateThreadpool(NULL);
+-
+-		if (!priv->ThreadPool)
+-			goto fail;
+-
+-		InitializeThreadpoolEnvironment(&priv->ThreadPoolEnv);
+-		SetThreadpoolCallbackPool(&priv->ThreadPoolEnv, priv->ThreadPool);
+-
+-		if (priv->MinThreadCount)
+-			if (!SetThreadpoolThreadMinimum(priv->ThreadPool, priv->MinThreadCount))
+-				goto fail;
+-
+-		if (priv->MaxThreadCount)
+-			SetThreadpoolThreadMaximum(priv->ThreadPool, priv->MaxThreadCount);
+ 	}
+ 
+ 	/* initialize the default pixel format */
+@@ -370,9 +341,6 @@ void rfx_context_free(RFX_CONTEXT* context)
+ 		ObjectPool_Free(priv->TilePool);
+ 		if (priv->UseThreads)
+ 		{
+-			if (priv->ThreadPool)
+-				CloseThreadpool(priv->ThreadPool);
+-			DestroyThreadpoolEnvironment(&priv->ThreadPoolEnv);
+ 			winpr_aligned_free((void*)priv->workObjects);
+ 			winpr_aligned_free(priv->tileWorkParams);
+ #ifdef WITH_PROFILER
+@@ -1086,9 +1054,8 @@ static INLINE BOOL rfx_process_message_tileset(RFX_CONTEXT* WINPR_RESTRICT conte
+ 				params[i].context = context;
+ 				params[i].tile = message->tiles[i];
+ 
+-				if (!(work_objects[i] =
+-				          CreateThreadpoolWork(rfx_process_message_tile_work_callback,
+-				                               (void*)&params[i], &context->priv->ThreadPoolEnv)))
++				if (!(work_objects[i] = CreateThreadpoolWork(rfx_process_message_tile_work_callback,
++				                                             (void*)&params[i], NULL)))
+ 				{
+ 					WLog_Print(context->priv->log, WLOG_ERROR, "CreateThreadpoolWork failed.");
+ 					rc = FALSE;
+@@ -1829,8 +1796,7 @@ RFX_MESSAGE* rfx_encode_message(RFX_CONTEXT* WINPR_RESTRICT context,
+ 					workParam->tile = tile;
+ 
+ 					if (!(*workObject = CreateThreadpoolWork(rfx_compose_message_tile_work_callback,
+-					                                         (void*)workParam,
+-					                                         &context->priv->ThreadPoolEnv)))
++					                                         (void*)workParam, NULL)))
+ 					{
+ 						goto skip_encoding_loop;
+ 					}
+diff --git a/libfreerdp/codec/rfx_types.h b/libfreerdp/codec/rfx_types.h
+index a9cd314da..c5a62259b 100644
+--- a/libfreerdp/codec/rfx_types.h
++++ b/libfreerdp/codec/rfx_types.h
+@@ -69,11 +69,11 @@ struct S_RFX_CONTEXT_PRIV
+ 	PTP_WORK* workObjects;
+ 	RFX_TILE_COMPOSE_WORK_PARAM* tileWorkParams;
+ 
+-	DWORD MinThreadCount;
++	DWORD MinThreadCount;              /* Kept only to silence abidiff */
+-	DWORD MaxThreadCount;
++	DWORD MaxThreadCount;              /* Kept only to silence abidiff */
+ 
+-	PTP_POOL ThreadPool;
++	PTP_POOL ThreadPool;               /* Kept only to silence abidiff */
+-	TP_CALLBACK_ENVIRON ThreadPoolEnv;
++	TP_CALLBACK_ENVIRON ThreadPoolEnv; /* Kept only to silence abidiff */
+ 
+ 	wBufferPool* BufferPool;
+ 
+diff --git a/libfreerdp/codec/yuv.c b/libfreerdp/codec/yuv.c
+index 75d8a6a89..4025782dd 100644
+--- a/libfreerdp/codec/yuv.c
++++ b/libfreerdp/codec/yuv.c
+@@ -55,11 +55,11 @@ struct S_YUV_CONTEXT
+ 	UINT32 width, height;
+ 	BOOL useThreads;
+ 	BOOL encoder;
+-	UINT32 nthreads;
++	UINT32 nthreads;                   /* Kept only to silence abidiff */
+ 	UINT32 heightStep;
+ 
+-	PTP_POOL threadPool;
++	PTP_POOL threadPool;               /* Kept only to silence abidiff */
+-	TP_CALLBACK_ENVIRON ThreadPoolEnv;
++	TP_CALLBACK_ENVIRON ThreadPoolEnv; /* Kept only to silence abidiff */
+ 
+ 	UINT32 work_object_count;
+ 	PTP_WORK* work_objects;
+@@ -166,16 +162,21 @@ BOOL yuv_context_reset(YUV_CONTEXT* WINPR_RESTRICT context, UINT32 width, UINT32
+ 
+ 	context->width = width;
+ 	context->height = height;
+-	context->heightStep = (height / context->nthreads);
++
++	context->heightStep = height;
+ 
+ 	if (context->useThreads)
+ 	{
+-		const UINT32 pw = (width + TILE_SIZE - width % TILE_SIZE) / TILE_SIZE;
+-		const UINT32 ph = (height + TILE_SIZE - height % TILE_SIZE) / TILE_SIZE;
++		context->heightStep = 16;
++		/* Preallocate workers for 16x16 tiles.
++		 * this is overallocation for most cases.
++		 *
++		 * ~2MB total for a 4k resolution, so negligible.
++		 */
++		const size_t pw = (width + TILE_SIZE - width % TILE_SIZE) / 16;
++		const size_t ph = (height + TILE_SIZE - height % TILE_SIZE) / 16;
+ 
+-		/* We´ve calculated the amount of workers for 64x64 tiles, but the decoder
+-		 * might get 16x16 tiles mixed in. */
+-		const UINT32 count = pw * ph * 16;
++		const size_t count = pw * ph;
+ 
+ 		context->work_object_count = 0;
+ 		if (context->encoder)
+@@ -237,33 +234,13 @@ YUV_CONTEXT* yuv_context_new(BOOL encoder, UINT32 ThreadingFlags)
+ 	primitives_get();
+ 
+ 	ret->encoder = encoder;
+-	ret->nthreads = 1;
+ 	if (!(ThreadingFlags & THREADING_FLAGS_DISABLE_THREADS))
+ 	{
+ 		GetNativeSystemInfo(&sysInfos);
+ 		ret->useThreads = (sysInfos.dwNumberOfProcessors > 1);
+-		if (ret->useThreads)
+-		{
+-			ret->nthreads = sysInfos.dwNumberOfProcessors;
+-			ret->threadPool = CreateThreadpool(NULL);
+-			if (!ret->threadPool)
+-			{
+-				goto error_threadpool;
+-			}
+-
+-			InitializeThreadpoolEnvironment(&ret->ThreadPoolEnv);
+-			SetThreadpoolCallbackPool(&ret->ThreadPoolEnv, ret->threadPool);
+-		}
+ 	}
+ 
+ 	return ret;
+-
+-error_threadpool:
+-	WINPR_PRAGMA_DIAG_PUSH
+-	WINPR_PRAGMA_DIAG_IGNORED_MISMATCHED_DEALLOC
+-	yuv_context_free(ret);
+-	WINPR_PRAGMA_DIAG_POP
+-	return NULL;
+ }
+ 
+ void yuv_context_free(YUV_CONTEXT* context)
+@@ -272,9 +249,6 @@ void yuv_context_free(YUV_CONTEXT* context)
+ 		return;
+ 	if (context->useThreads)
+ 	{
+-		if (context->threadPool)
+-			CloseThreadpool(context->threadPool);
+-		DestroyThreadpoolEnvironment(&context->ThreadPoolEnv);
+ 		winpr_aligned_free((void*)context->work_objects);
+ 		winpr_aligned_free(context->work_combined_params);
+ 		winpr_aligned_free(context->work_enc_params);
+@@ -330,7 +304,7 @@ static BOOL submit_object(PTP_WORK* WINPR_RESTRICT work_object, PTP_WORK_CALLBAC
+ 	if (!param || !context)
+ 		return FALSE;
+ 
+-	*work_object = CreateThreadpoolWork(cb, cnv.pv, &context->ThreadPoolEnv);
++	*work_object = CreateThreadpoolWork(cb, cnv.pv, NULL);
+ 	if (!*work_object)
+ 		return FALSE;
+ 
+@@ -439,11 +417,8 @@ static BOOL pool_decode(YUV_CONTEXT* WIN
+ 
+ 				if (context->work_object_count <= waitCount)
+ 				{
+-					WLog_ERR(TAG,
+-					         "YUV decoder: invalid number of tiles, only support less than %" PRIu32
+-					         ", got %" PRIu32,
+-					         context->work_object_count, waitCount);
+-					goto fail;
++					free_objects(context->work_objects, context->work_object_count);
++					waitCount = 0;
+ 				}
+ 
+ 				YUV_PROCESS_WORK_PARAM* cur = &context->work_dec_params[waitCount];
+@@ -586,11 +561,8 @@ static BOOL pool_decode_rect(YUV_CONTEXT
+ 
+ 		if (context->work_object_count <= waitCount)
+ 		{
+-			WLog_ERR(TAG,
+-			         "YUV rect decoder: invalid number of tiles, only support less than %" PRIu32
+-			         ", got %" PRIu32,
+-			         context->work_object_count, waitCount);
+-			goto fail;
++			free_objects(context->work_objects, context->work_object_count);
++			waitCount = 0;
+ 		}
+ 		current = &context->work_combined_params[waitCount];
+ 		*current = pool_decode_rect_param(&regionRects[waitCount], context, type, pYUVData, iStride,
+@@ -848,11 +820,8 @@ static BOOL pool_encode(YUV_CONTEXT* WIN
+ 
+ 			if (context->work_object_count <= waitCount)
+ 			{
+-				WLog_ERR(TAG,
+-				         "YUV encoder: invalid number of tiles, only support less than %" PRIu32
+-				         ", got %" PRIu32,
+-				         context->work_object_count, waitCount);
+-				goto fail;
++				free_objects(context->work_objects, context->work_object_count);
++				waitCount = 0;
+ 			}
+ 
+ 			current = &context->work_enc_params[waitCount];
+-- 
+2.51.0
+

freerdp.spec

@@ -0,0 +1,707 @@
+# Can be rebuilt with FFmpeg/OpenH264 support enabled by passing
+# "--with=ffmpeg", or "--with=openh264" to mock/rpmbuild; or by globally
+# setting these variables:
+# https://bugzilla.redhat.com/show_bug.cgi?id=2242028
+#global _with_ffmpeg 1
+#global _with_openh264 1
+
+# Can be rebuilt with OpenCL support enabled by passing # "--with=opencl"
+# or by globally setting:
+#global _opencl 1
+
+# Disable server support in RHEL
+# https://bugzilla.redhat.com/show_bug.cgi?id=1639165
+%if 0%{?fedora} || 0%{?rhel} >= 10
+%global _with_server 1
+%endif
+
+# Force uwac to be static to avoid conflicts with freerdp2
+# FIXME: Disable this once all freerdp2 consumers are ported to freerdp3
+%global _with_static_uwac 1
+
+# Disable unwanted dependencies for RHEL
+%{!?rhel:%global _with_sdl_client 1}
+%{!?rhel:%global _with_soxr 1}
+%{!?rhel:%global _with_uriparser 1}
+
+# Disable support for AAD WebView popup since it uses webkit2gtk-4.0
+#global _with_webview 1
+
+Name:           freerdp
+Epoch:          2
+Version:        3.10.3
+Release:        5%{?dist}
+Summary:        Free implementation of the Remote Desktop Protocol (RDP)
+
+# The effective license is Apache-2.0 but:
+# client/SDL/dialogs/font/* is OFL-1.1
+# uwac/libuwac/* is HPND
+# uwac/protocols/server-decoration.xml is LGPL-2.1-or-later
+# winpr/libwinpr/ncrypt/pkcs11-headers/pkcs11.h is LicenseRef-Fedora-Public-Domain
+License:        Apache-2.0 AND HPND AND LGPL-2.1-or-later AND LicenseRef-Fedora-Public-Domain AND OFL-1.1
+URL:            http://www.freerdp.com/
+
+# The license of the winpr/libwinpr/crt/unicode_builtin.c file is not allowed.
+# See: https://gitlab.com/fedora/legal/fedora-license-data/-/issues/498
+# Run the ./freerdp_download_and_repack.sh script to prepare tarball.
+Source0:        FreeRDP-%{version}-repack.tar.gz
+Source1:        freerdp_download_and_repack.sh
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2365232
+Patch0:         Initialize-function-pointers-after-resource-allocation.patch
+
+# https://issues.redhat.com/browse/RHEL-86251
+Patch1:         Limit-threadpool-to-16-threads.patch
+Patch2:         Use-default-threadpool.patch
+Patch3:         Default-minimum-thread-count.patch
+Patch4:         Limit-minimum-threadpool-size.patch
+
+BuildRequires:  gcc
+BuildRequires:  gcc-c++
+BuildRequires:  alsa-lib-devel
+BuildRequires:  cmake >= 3.13
+BuildRequires:  cups-devel
+BuildRequires:  gsm-devel
+BuildRequires:  lame-devel
+BuildRequires:  libicu-devel
+BuildRequires:  libjpeg-turbo-devel
+BuildRequires:  libX11-devel
+BuildRequires:  libXcursor-devel
+BuildRequires:  libXdamage-devel
+BuildRequires:  libXext-devel
+BuildRequires:  libXi-devel
+BuildRequires:  libXinerama-devel
+BuildRequires:  libxkbfile-devel
+BuildRequires:  libXrandr-devel
+%{?_with_server:BuildRequires:  libXtst-devel}
+BuildRequires:  libXv-devel
+%{?_with_opencl:BuildRequires: opencl-headers >= 3.0}
+%{?_with_opencl:BuildRequires: ocl-icd-devel}
+%{?_with_openh264:BuildRequires:  openh264-devel}
+%{?_with_x264:BuildRequires:  x264-devel}
+%{?_with_server:BuildRequires:  pam-devel}
+BuildRequires:  xmlto
+BuildRequires:  zlib-devel
+BuildRequires:  multilib-rpm-config
+
+BuildRequires:  cmake(json-c)
+# Packaging error led to cmake files in the wrong place
+# Fixed in https://src.fedoraproject.org/rpms/uriparser/c/1b07302bfc80983fbf84283783370e8338d36429
+%{?_with_uriparser:BuildRequires:  (cmake(uriparser) and uriparser-devel)}
+
+BuildRequires:  pkgconfig(cairo)
+BuildRequires:  pkgconfig(krb5)
+BuildRequires:  pkgconfig(fdk-aac)
+BuildRequires:  pkgconfig(fuse3)
+BuildRequires:  pkgconfig(libpcsclite)
+BuildRequires:  pkgconfig(libpulse)
+BuildRequires:  pkgconfig(libsystemd)
+BuildRequires:  pkgconfig(libusb-1.0)
+BuildRequires:  pkgconfig(libwebp)
+BuildRequires:  pkgconfig(openssl)
+BuildRequires:  pkgconfig(opus)
+%{?_with_sdl_client:BuildRequires:  pkgconfig(sdl2)}
+%{?_with_sdl_client:BuildRequires:  pkgconfig(SDL2_ttf)}
+%{?_with_soxr:BuildRequires:  pkgconfig(soxr)}
+BuildRequires:  pkgconfig(wayland-client)
+BuildRequires:  pkgconfig(wayland-scanner)
+%{?_with_webview:BuildRequires:  pkgconfig(webkit2gtk-4.0)}
+BuildRequires:  pkgconfig(xkbcommon)
+
+%{?_with_ffmpeg:
+BuildRequires:  pkgconfig(libavcodec) >= 57.48.101
+BuildRequires:  pkgconfig(libavutil)
+BuildRequires:  pkgconfig(libswscale)
+}
+
+Provides:       xfreerdp = %{?epoch}:%{version}-%{release}
+Requires:       %{name}-libs%{?_isa} = %{?epoch}:%{version}-%{release}
+Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
+
+%description
+The xfreerdp & wlfreerdp Remote Desktop Protocol (RDP) clients from the FreeRDP
+project.
+
+xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows
+machines, xrdp and VirtualBox.
+
+%package        libs
+Summary:        Core libraries implementing the RDP protocol
+Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
+Obsoletes:      %{name}-plugins < 1:1.1.0
+Provides:       %{name}-plugins = %{?epoch}:%{version}-%{release}
+%description    libs
+libfreerdp-core can be embedded in applications.
+
+libfreerdp-channels and libfreerdp-kbd might be convenient to use in X
+applications together with libfreerdp-core.
+
+libfreerdp-core can be extended with plugins handling RDP channels.
+
+%package        devel
+Summary:        Development files for %{name}
+Requires:       %{name}-libs%{?_isa} = %{?epoch}:%{version}-%{release}
+Requires:       pkgconfig
+Requires:       cmake >= 3.13
+
+%description    devel
+The %{name}-devel package contains libraries and header files for developing
+applications that use %{name}-libs.
+
+%{?_with_server:
+%package        server
+Summary:        Server support for %{name}
+Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
+Requires:       %{name}-libs%{?_isa} = %{?epoch}:%{version}-%{release}
+
+%description    server
+The %{name}-server package contains servers which can export a desktop via
+the RDP protocol.
+}
+
+%package -n     libwinpr
+Summary:        Windows Portable Runtime
+Provides:       %{name}-libwinpr = %{?epoch}:%{version}-%{release}
+Obsoletes:      %{name}-libwinpr < 1:1.2.0
+
+%description -n libwinpr
+WinPR provides API compatibility for applications targeting non-Windows
+environments. When on Windows, the original native API is being used instead of
+the equivalent WinPR implementation, without having to modify the code using it.
+
+%package -n     libwinpr-devel
+Summary:        Windows Portable Runtime development files
+Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
+Requires:       pkgconfig
+Requires:       cmake >= 3.13
+
+%description -n libwinpr-devel
+The %{name}-libwinpr-devel package contains libraries and header files for
+developing applications that use %{name}-libwinpr.
+
+%prep
+%autosetup -p1 -n FreeRDP-%{version}
+
+# Rpmlint fixes
+find . -name "*.h" -exec chmod 664 {} \;
+find . -name "*.c" -exec chmod 664 {} \;
+
+%build
+%cmake \
+    -DBUILD_TESTING=ON \
+    -DCMAKE_SKIP_INSTALL_RPATH=ON \
+    -DCMAKE_INSTALL_LIBDIR:PATH=%{_lib} \
+    -DWITH_ALSA=ON \
+    -DWITH_AAD=ON \
+    -DWITH_CAIRO=ON \
+    -DWITH_CUPS=ON \
+    -DWITH_CHANNELS=ON \
+    -DWITH_CLIENT=ON \
+    -DWITH_CLIENT_SDL=%{?_with_sdl_client:ON}%{?!_with_sdl_client:OFF} \
+    -DWITH_DSP_FFMPEG=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
+    -DWITH_FDK_AAC=ON \
+    -DWITH_FFMPEG=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
+    -DWITH_FUSE=ON \
+    -DWITH_GSM=ON \
+    -DWITH_IPP=OFF \
+    -DWITH_JPEG=ON \
+    -DWITH_JSONC_REQUIRED=ON \
+    -DWITH_KEYBOARD_LAYOUT_FROM_FILE=ON \
+    -DWITH_KRB5=ON \
+    -DWITH_LAME=ON \
+    -DWITH_MANPAGES=ON \
+    -DWITH_OPENCL=%{?_with_opencl:ON}%{?!_with_opencl:OFF} \
+    -DWITH_OPENH264=%{?_with_openh264:ON}%{?!_with_openh264:OFF} \
+    -DWITH_OPENSSL=ON \
+    -DWITH_OPUS=ON \
+    -DWITH_PCSC=ON \
+    -DWITH_PKCS11=ON \
+    -DWITH_PULSE=ON \
+    -DWITH_SAMPLE=OFF \
+    -DWITH_SERVER=%{?_with_server:ON}%{?!_with_server:OFF} \
+    -DWITH_SERVER_INTERFACE=%{?_with_server:ON}%{?!_with_server:OFF} \
+    -DWITH_SHADOW_X11=%{?_with_server:ON}%{?!_with_server:OFF} \
+    -DWITH_SHADOW_MAC=%{?_with_server:ON}%{?!_with_server:OFF} \
+    -DWITH_SOXR=%{?_with_soxr:ON}%{?!_with_soxr:OFF} \
+    -DWITH_SWSCALE=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
+    -DWITH_TIMEZONE_COMPILED=OFF \
+    -DWITH_TIMEZONE_FROM_FILE=ON \
+    -DWITH_URIPARSER=%{?_with_uriparser:ON}%{?!_with_uriparser:OFF} \
+    -DWITH_VIDEO_FFMPEG=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
+    -DWITH_WAYLAND=ON \
+    -DWITH_WEBVIEW=%{?_with_webview:ON}%{?!_with_webview:OFF} \
+    -DWITH_X11=ON \
+    -DWITH_XCURSOR=ON \
+    -DWITH_XEXT=ON \
+    -DWITH_XKBFILE=ON \
+    -DWITH_XI=ON \
+    -DWITH_XINERAMA=ON \
+    -DWITH_XRENDER=ON \
+    -DWITH_XTEST=%{?_with_server:ON}%{?!_with_server:OFF} \
+    -DWITH_XV=ON \
+    -DWITH_ZLIB=ON \
+%ifarch x86_64
+    -DWITH_SSE2=ON \
+    -DWITH_VAAPI=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
+%else
+    -DWITH_SSE2=OFF \
+%endif
+%ifarch armv7hl
+    -DARM_FP_ABI=hard \
+    -DWITH_NEON=OFF \
+%endif
+%ifarch armv7hnl
+    -DARM_FP_ABI=hard \
+    -DWITH_NEON=ON \
+%endif
+%ifarch armv5tel armv6l armv7l
+    -DARM_FP_ABI=soft \
+    -DWITH_NEON=OFF \
+%endif
+    -DUWAC_FORCE_STATIC_BUILD=%{?_with_static_uwac:ON}%{?!_with_static_uwac:OFF} \
+    -DWINPR_UTILS_IMAGE_PNG=ON \
+    -DWINPR_UTILS_IMAGE_WEBP=ON \
+    -DWINPR_UTILS_IMAGE_JPEG=ON \
+    %{nil}
+
+%cmake_build
+
+%check
+export CTEST_OUTPUT_ON_FAILURE=1
+%cmake_build --target test
+
+%install
+%cmake_install
+
+find %{buildroot} -name "*.a" -delete
+
+%multilib_fix_c_header --file %{_includedir}/freerdp3/freerdp/build-config.h
+
+%files
+%{?_with_sdl_client:
+%{_bindir}/sdl-freerdp
+}
+%{_bindir}/winpr-hash
+%{_bindir}/winpr-makecert
+%{_bindir}/wlfreerdp
+%{_bindir}/xfreerdp
+%{?_with_sdl_client:
+%{_mandir}/man1/sdl-freerdp.1*
+}
+%{_mandir}/man1/winpr-hash.1*
+%{_mandir}/man1/winpr-makecert.1*
+%{_mandir}/man1/wlfreerdp.1*
+%{_mandir}/man1/xfreerdp.1*
+
+%files libs
+%license LICENSE
+%doc README.md ChangeLog
+%{_datadir}/FreeRDP/
+%{_libdir}/freerdp3/
+%{_libdir}/libfreerdp-client3.so.*
+%{?_with_server:
+%{_libdir}/libfreerdp-server3.so.*
+%{_libdir}/libfreerdp-server-proxy3.so.*
+%{_libdir}/libfreerdp-shadow3.so.*
+%{_libdir}/libfreerdp-shadow-subsystem3.so.*
+}
+%{_libdir}/libfreerdp3.so.*
+%{?!_with_static_uwac:
+%{_libdir}/libuwac0.so.*
+}
+%{_libdir}/librdtk0.so.*
+%{_mandir}/man7/wlog.*
+
+%files devel
+%{_includedir}/freerdp3/
+%{?!_with_static_uwac:
+%{_includedir}/uwac0/
+}
+%{_includedir}/rdtk0/
+%{_libdir}/cmake/FreeRDP3/
+%{_libdir}/cmake/FreeRDP-Client3/
+%{?_with_server:
+%{_libdir}/cmake/FreeRDP-Proxy3/
+%{_libdir}/cmake/FreeRDP-Server3/
+%{_libdir}/cmake/FreeRDP-Shadow3/
+}
+%{?!_with_static_uwac:
+%{_libdir}/cmake/uwac0/
+}
+%{_libdir}/cmake/rdtk0/
+%{_libdir}/libfreerdp-client3.so
+%{?_with_server:
+%{_libdir}/libfreerdp-server3.so
+%{_libdir}/libfreerdp-server-proxy3.so
+%{_libdir}/libfreerdp-shadow3.so
+%{_libdir}/libfreerdp-shadow-subsystem3.so
+}
+%{_libdir}/libfreerdp3.so
+%{?!_with_static_uwac:
+%{_libdir}/libuwac0.so
+}
+%{_libdir}/librdtk0.so
+%{_libdir}/pkgconfig/freerdp3.pc
+%{_libdir}/pkgconfig/freerdp-client3.pc
+%{?_with_server:
+%{_libdir}/pkgconfig/freerdp-server3.pc
+%{_libdir}/pkgconfig/freerdp-server-proxy3.pc
+%{_libdir}/pkgconfig/freerdp-shadow3.pc
+}
+%{?!_with_static_uwac:
+%{_libdir}/pkgconfig/uwac0.pc
+}
+%{_libdir}/pkgconfig/rdtk0.pc
+
+%{?_with_server:
+%files server
+%{_bindir}/freerdp-proxy
+%{_bindir}/freerdp-shadow-cli
+%{_mandir}/man1/freerdp-proxy.1*
+%{_mandir}/man1/freerdp-shadow-cli.1*
+}
+
+%files -n libwinpr
+%license LICENSE
+%doc README.md ChangeLog
+%{_datadir}/WinPR/
+%{_libdir}/libwinpr3.so.*
+%{_libdir}/libwinpr-tools3.so.*
+
+%files -n libwinpr-devel
+%{_libdir}/cmake/WinPR3/
+%{_libdir}/cmake/WinPR-tools3/
+%{_includedir}/winpr3/
+%{_libdir}/libwinpr3.so
+%{_libdir}/libwinpr-tools3.so
+%{_libdir}/pkgconfig/winpr3.pc
+%{_libdir}/pkgconfig/winpr-tools3.pc
+
+%changelog
+* Tue Sep 30 2025 Marek Kasik <mkasik@redhat.com> - 2:3.10.3-5
+- Silence abidiff
+- Resolves: RHEL-86251
+
+* Mon Sep 29 2025 Marek Kasik <mkasik@redhat.com> - 2:3.10.3-4
+- Limit threadpool to 16 threads
+- Resolves: RHEL-86251
+
+* Mon Jun 16 2025 Marek Kasik <mkasik@redhat.com> - 2:3.10.3-3
+- Initialize function pointers after resource allocation
+- Fixes CVE-2025-4478
+- Resolves: RHEL-91583
+
+* Tue Dec 17 2024 Ondrej Holy <oholy@redhat.com> - 2:3.10.3-1
+- Update to 3.10.3
+
+* Thu Nov 14 2024 Ondrej Holy <oholy@redhat.com> - 2:3.9.0-1
+- Update to 3.9.0
+
+* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 2:3.8.0-2
+- Bump release for October 2024 mass rebuild:
+  Resolves: RHEL-64018
+
+* Thu Sep 05 2024 Ondrej Holy <oholy@redhat.com> - 2:3.8.0-1
+- Update to 3.8.0
+
+* Thu Aug 08 2024 Neal Gompa <ngompa@fedoraproject.org> - 2:3.7.0-1
+- Update to 3.7.0
+
+* Fri Jul 26 2024 Ondrej Holy <oholy@redhat.com> - 2:3.6.3-1
+- Update to 3.6.3 (#2299253)
+
+* Tue Jul 23 2024 Neal Gompa <ngompa@fedoraproject.org> - 2:3.6.2-2
+- Include freerdp source download script in SRPM
+
+* Mon Jul 08 2024 Ondrej Holy <oholy@redhat.com> - 2:3.6.2-1
+- Update to 3.6.2
+
+* Mon Jul 08 2024 Ondrej Holy <oholy@redhat.com> - 2:3.5.1-3
+- Remove file with non-allowed license from the tarball
+
+* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 2:3.5.1-2
+- Bump release for June 2024 mass rebuild
+
+* Tue May 07 2024 Ondrej Holy <oholy@redhat.com> - 2:3.5.1-1
+- Update to 3.5.1 (CVE-2024-32039, CVE-2024-32040, CVE-2024-32041,
+  CVE-2024-32458, CVE-2024-32459, CVE-2024-32460, CVE-2024-32658,
+  CVE-2024-32659, CVE-2024-32660, CVE-2024-32661, CVE-2024-32662)
+
+* Mon Mar 25 2024 Ondrej Holy <oholy@redhat.com> - 2:3.4.0-2
+- Disable unwanted dependencies for RHEL
+
+* Fri Mar 22 2024 Ondrej Holy <oholy@redhat.com> - 2:3.4.0-1
+- Update to 3.4.0
+
+* Thu Feb 22 2024 Neal Gompa <ngompa@fedoraproject.org> - 2:3.3.0-1
+- Update to 3.3.0
+
+* Thu Feb 01 2024 Ondrej Holy <oholy@redhat.com> - 2:3.2.0-4
+- Enable KRB5 support
+
+* Wed Jan 31 2024 Pete Walter <pwalter@fedoraproject.org> - 2:3.2.0-3
+- Rebuild for ICU 74
+
+* Sat Jan 27 2024 Neal Gompa <ngompa@fedoraproject.org> - 2:3.2.0-2
+- Force static libuwac to deconflict with freerdp2
+
+* Wed Jan 24 2024 Neal Gompa <ngompa@fedoraproject.org> - 2:3.2.0-1
+- Rebase to 3.2.0
+
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.11.4-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.11.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Jan 12 2024 Ondrej Holy <oholy@redhat.com> - 2:2.11.4-1
+- Update to 2.11.4.
+
+* Wed Oct 25 2023 Ondrej Holy <oholy@redhat.com> - 2:2.11.2-3
+- Disable FFmpeg support (#2242028).
+
+* Mon Oct 09 2023 John Wiele <jwiele@redhat.com> - 2:2.11.2-2
+- Enable optional build with OpenCL support.
+
+* Wed Sep 27 2023 Ondrej Holy <oholy@redhat.com> - 2:2.11.1-2
+- Update to 2.11.2.
+
+* Tue Sep 05 2023 Ondrej Holy <oholy@redhat.com> - 2:2.11.1-1
+- Update to 2.11.1.
+
+* Fri Sep 01 2023 Ondrej Holy <oholy@redhat.com> - 2:2.11.0-1
+- Update to 2.11.0 (CVE-2023-39350, CVE-2023-39351, CVE-2023-39352,
+  CVE-2023-39353, CVE-2023-39354, CVE-2023-39356, CVE-2023-40181,
+  CVE-2023-40186, CVE-2023-40188, CVE-2023-40567, CVE-2023-40569 and
+  CVE-2023-40589).
+
+* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.10.0-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Tue Jul 11 2023 František Zatloukal <fzatlouk@redhat.com> - 2:2.10.0-3
+- Rebuilt for ICU 73.2
+
+* Thu May 11 2023 Ondrej Holy <oholy@redhat.com> - 2:2.10.0-2
+- Enable recommended FFmpeg support.
+
+* Tue Feb 21 2023 Ondrej Holy <oholy@redhat.com> - 2:2.10.0-1
+- Update to 2.10.0.
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.9.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Sat Dec 31 2022 Pete Walter <pwalter@fedoraproject.org> - 2:2.9.0-2
+- Rebuild for ICU 72
+
+* Wed Nov 30 2022 Ondrej Holy <oholy@redhat.com> - 2:2.9.0-1
+- Update to 2.9.0 (CVE-2022-39316, CVE-2022-39317, CVE-2022-39318,
+CVE-2022-39319, CVE-2022-39320, CVE-2022-41877, CVE-2022-39347).
+
+* Mon Nov 14 2022 Ondrej Holy <oholy@redhat.com> - 2:2.8.1-1
+- Update to 2.8.1 (CVE-2022-39282, CVE-2022-39283).
+
+* Mon Aug 15 2022 Simone Caronni <negativo17@gmail.com> - 2:2.8.0-1
+- Update to 2.8.0.
+
+* Wed Aug 03 2022 Ondrej Holy <oholy@redhat.com> - 2:2.7.0-4
+- Enable server support in ELN.
+
+* Mon Aug 01 2022 Frantisek Zatloukal <fzatlouk@redhat.com> - 2:2.7.0-3
+- Rebuilt for ICU 71.1
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.7.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Mon Apr 25 2022 Ondrej Holy <oholy@redhat.com> - 2:2.7.0-1
+- Update to 2.7.0.
+
+* Fri Mar 11 2022 Ondrej Holy <oholy@redhat.com> - 2:2.6.1-1
+- Update to 2.6.1.
+
+* Thu Feb 03 2022 Ondrej Holy <oholy@redhat.com> - 2:2.5.0-1
+- Update to 2.5.0.
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.4.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Fri Nov 26 2021 Ondrej Holy <oholy@redhat.com> - 2:2.4.1-2
+- Fix datatype mismatch / big-endian breakage
+- Load legacy provider when initializing OpenSSL 3.0
+
+* Wed Nov 10 2021 Ondrej Holy <oholy@redhat.com> - 2:2.4.1-1
+- Update to 2.4.1 (CVE-2021-41159, CVE-2021-41160).
+
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2:2.4.0-3
+- Rebuilt with OpenSSL 3.0.0
+
+* Wed Aug 11 2021 Ondrej Holy <oholy@redhat.com> - 2:2.4.0-2
+- Preparation for OpenSSL 3.0
+
+* Thu Jul 29 2021 Ondrej Holy <oholy@redhat.com> - 2:2.4.0-1
+- Update to 2.4.0.
+
+* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.3.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Wed May 19 2021 Pete Walter <pwalter@fedoraproject.org> - 2:2.3.2-2
+- Rebuild for ICU 69
+
+* Thu Apr 15 2021 Simone Caronni <negativo17@gmail.com> - 2:2.3.2-1
+- Update to 2.3.2.
+
+* Tue Mar 23 2021 Simone Caronni <negativo17@gmail.com> - 2:2.2.0-6
+- Explicitly enable Cairo support (#1938393).
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.2.0-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Tue Aug 11 2020 Ondrej Holy <oholy@redhat.com> - 2:2.2.0-4
+- Use %%cmake_ macros to fix out-of-source builds (#1863586)
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.2.0-3
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.2.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Thu Jul 23 2020 Simone Caronni <negativo17@gmail.com> - 2:2.2.0-1
+- Update to 2.2.0.
+
+* Tue Jun 30 2020 Simone Caronni <negativo17@gmail.com> - 2:2.1.2-1
+- Update to 2.1.2.
+
+* Thu May 21 2020 Ondrej Holy <oholy@redhat.com> - 2:2.1.1-1
+- Update to 2.1.1.
+
+* Fri May 15 2020 Ondrej Holy <oholy@redhat.com> - 2:2.1.0-1
+- Update to 2.1.0 (#1833540).
+
+* Fri May 15 2020 Pete Walter <pwalter@fedoraproject.org> - 2:2.0.0-57.20200207git245fc60
+- Rebuild for ICU 67
+
+* Fri Feb 07 2020 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-56.20200207git245fc60
+- Update to latest snapshot.
+
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-55.20190820git6015229
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Fri Nov 01 2019 Pete Walter <pwalter@fedoraproject.org> - 2:2.0.0-54.20190820git6015229
+- Rebuild for ICU 65
+
+* Tue Aug 20 2019 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-53.20190820git6015229
+- Update to latest snapshot.
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-52.20190918git5e672d4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Sun Jul 21 2019 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-51.20190918git5e672d4
+- Update to latest snapshot.
+
+* Sat May 18 2019 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-50.20190517gitb907324
+- Update to latest snapshot.
+
+* Wed Mar 06 2019 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-49.20190304git435872b
+- Fix for GFX color depth (Windows 10).
+
+* Thu Feb 28 2019 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-48.20190228gitce386c8
+- Update to latest snapshot post rc4.
+- CVE-2018-1000852 (#1661642).
+
+* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-47.rc4.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Thu Nov 29 2018 Ondrej Holy <oholy@redhat.com> - 2:2.0.0-47.rc4
+- Update to 2.0.0-rc4
+
+* Mon Oct 15 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-46.20181008git00af869
+- Enable Xtest option (#1559606).
+
+* Mon Oct 15 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-45.20181008git00af869
+- Update to last snapshot post 2.0.0-rc3.
+
+* Mon Aug 20 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-44.rc3
+- Update SPEC file.
+
+* Sat Aug 04 2018 Mike DePaulo <mikedep333@fedoraproject.org> - 2:2.0.0-43.20180801.rc3
+- Update to 2.0.0-rc3
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-42.20180405gita9ecd6a
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Mon Apr 09 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-41.20180405gita9ecd6a
+- Update to latest snapshot.
+
+* Wed Mar 21 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-40.20180320gitde83f4d
+- Add PAM support (fixes freerdp-shadow-cli). Thanks Paolo Zeppegno.
+- Update to latest snapshot.
+
+* Thu Mar 15 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-39.20180314gitf8baeb7
+- Update to latest snapshot.
+- Fixes connection to RDP servers with the latest Microsoft patches:
+  https://github.com/FreeRDP/FreeRDP/issues/4449
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-38.20180115git8f52c7e
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Thu Jan 18 2018 Karsten Hopp <karsten@redhat.com> - 2.0.0-37git}
+- use versioned build requirement on pkgconfig(openssl) to prevent using
+  compat-openssl10-devel instead of openssl-devel
+
+* Tue Jan 16 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-36.20180115git8f52c7e
+- Update to latest snapshot.
+- Make GSS support optional and disable it for now (#1534094 and FreeRDP #4348,
+  #1435, #4363).
+
+* Wed Dec 20 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-35.20171220gitbfe8359
+- Update to latest snapshot post 2.0.0rc1.
+
+* Mon Sep 11 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-34.20170831git3b83526
+- Update to latest snapshot.
+- Trim changelog.
+
+* Mon Aug 07 2017 Björn Esser <besser82@fedoraproject.org> - 2:2.0.0-33.20170724gitf8c9f43
+- Rebuilt for AutoReq cmake-filesystem
+
+* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-32.20170724gitf8c9f43
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Thu Jul 27 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-31.20170724gitf8c9f43
+- Update to latest snapshot, Talos security fixes.
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-30.20170710gitf580bea
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Wed Jul 12 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-29.20170710gitf580bea
+- Update to latest snapshot.
+
+* Mon Jun 26 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-28.20170623git9904c32
+- Update to latest snapshot.
+
+* Mon May 15 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-27.20170512gitb1df835
+- Update to latest snapshot.
+
+* Thu Apr 20 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-26.20170419gitbfcf8e7
+- Update to latest 2.0 snapshot.
+
+* Thu Apr 13 2017 Orion Poplawski <orion@cora.nwra.com> - 2:2.0.0-25.20170317git8c68761
+- Install tools via make install
+
+* Wed Mar 22 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-24.20170317git8c68761
+- Update to latest snapshot.
+
+* Mon Mar 06 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-23.20170302git210de68
+- Remove shared libxfreerdp-client shared library.
+
+* Thu Mar 02 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-22.20170302git210de68
+- Move libxfreerdp-client shared object into devel subpackage.
+
+* Thu Mar 02 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-21.20170302git210de68
+- Update to latest snapshot.
+- Update build requirements, tune build options.
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-20.20161228git90877f5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Mon Jan 09 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-19.20161228git90877f5
+- Update to latest snapshot.

freerdp_download_and_repack.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+version=$(cat freerdp.spec | grep "Version: " | tr --squeeze-repeats " " | cut --delimiter " " --fields 2)
+
+echo "Downloading FreeRDP-$version.tar.gz"
+curl --silent --location "https://github.com/FreeRDP/FreeRDP/archive/$version/FreeRDP-$version.tar.gz" --output "FreeRDP-$version.tar.gz" || exit 1
+
+echo "Removing unicode_builtin.c"
+gzip --decompress "FreeRDP-$version.tar.gz" || exit 1
+tar --file "FreeRDP-$version.tar" --delete "*/winpr/libwinpr/crt/unicode_builtin.c" || exit 1
+gzip --best "FreeRDP-$version.tar" --stdout > FreeRDP-$version-repack.tar.gz
+rm FreeRDP-$version.tar
+
+echo "FreeRDP-$version-repack.tar.gz is prepared"
+exit 0

sources

@@ -0,0 +1 @@
+SHA512 (FreeRDP-3.10.3-repack.tar.gz) = cd007c28267e4b9ace47487f7d44061b03b029409fa167209bb1273f3d1b79fdd3ed96c855d78ccb03bdbedf452009e3a1a21189d282faffdfc3b2b504d03574