import CS freerdp-3.10.3-5.el10

.freerdp.metadata

@@ -1 +0,0 @@
-14a73f092e227a77f3d483658033d15d4501a753 SOURCES/FreeRDP-2.11.7.tar.gz

.gitignore

@@ -1 +1 @@
-SOURCES/FreeRDP-2.11.7.tar.gz
+FreeRDP-3.10.3-repack.tar.gz

Default-minimum-thread-count.patch

@@ -0,0 +1,52 @@
+From 0e6c921b206259474b1c14bb26b183a8b2089cdb Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Fri, 12 Sep 2025 08:25:16 +0200
+Subject: [PATCH 082/100] [winpr,threadpool] default minimum thread count
+
+Set a default minimum of 4 threads in a pool. Avoids issues with system
+running with a single processor (might lead to deadlocks if the code
+assumes > 1 thread handling stuff)
+---
+ winpr/libwinpr/pool/CMakeLists.txt | 2 ++
+ winpr/libwinpr/pool/pool.c         | 9 +++++++--
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/winpr/libwinpr/pool/CMakeLists.txt b/winpr/libwinpr/pool/CMakeLists.txt
+index cfa9bc891..6b5938fd0 100644
+--- a/winpr/libwinpr/pool/CMakeLists.txt
++++ b/winpr/libwinpr/pool/CMakeLists.txt
+@@ -16,7 +16,9 @@
+ # limitations under the License.
+ 
+ set(WINPR_THREADPOOL_DEFAULT_MAX_COUNT "16" CACHE STRING "The maximum (default) number of threads in a pool")
++set(WINPR_THREADPOOL_DEFAULT_MIN_COUNT "4" CACHE STRING "The minimum (default) number of threads in a pool")
+ winpr_definition_add(WINPR_THREADPOOL_DEFAULT_MAX_COUNT=${WINPR_THREADPOOL_DEFAULT_MAX_COUNT})
++winpr_definition_add(WINPR_THREADPOOL_DEFAULT_MIN_COUNT=${WINPR_THREADPOOL_DEFAULT_MIN_COUNT})
+ winpr_module_add(
+   synch.c
+   work.c
+diff --git a/winpr/libwinpr/pool/pool.c b/winpr/libwinpr/pool/pool.c
+index 96db6b247..cbfc274c5 100644
+--- a/winpr/libwinpr/pool/pool.c
++++ b/winpr/libwinpr/pool/pool.c
+@@ -127,10 +127,15 @@ static BOOL InitializeThreadpool(PTP_POOL pool)
+ 	obj = ArrayList_Object(pool->Threads);
+ 	obj->fnObjectFree = threads_close;
+ 
++#if !defined(WINPR_THREADPOOL_DEFAULT_MIN_COUNT)
++#error "WINPR_THREADPOOL_DEFAULT_MIN_COUNT must be defined"
++#endif
++
+ 	SYSTEM_INFO info = { 0 };
+ 	GetSystemInfo(&info);
+-	if (info.dwNumberOfProcessors < 1)
+-		info.dwNumberOfProcessors = 1;
++	if (info.dwNumberOfProcessors < WINPR_THREADPOOL_DEFAULT_MIN_COUNT)
++		info.dwNumberOfProcessors = WINPR_THREADPOOL_DEFAULT_MIN_COUNT;
++
+ 	if (!SetThreadpoolThreadMinimum(pool, info.dwNumberOfProcessors))
+ 		goto fail;
+ 
+-- 
+2.51.0
+

Initialize-function-pointers-after-resource-allocation.patch

@@ -0,0 +1,64 @@
+From a4bb702aa62e4fad91ca99142de075265555ec18 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jonas=20=C3=85dahl?= <jadahl@gmail.com>
+Date: Tue, 13 May 2025 10:34:08 +0200
+Subject: [PATCH] transport: Initialize function pointers after resource
+ allocation
+
+The transport instance is freed when an error occurs.
+If the TransportDisconnect function pointer is initialized it
+causes SIGSEGV during free.
+
+CVE: CVE-2025-4478
+---
+ libfreerdp/core/transport.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/libfreerdp/core/transport.c b/libfreerdp/core/transport.c
+index d199c31be..2ca146f65 100644
+--- a/libfreerdp/core/transport.c
++++ b/libfreerdp/core/transport.c
+@@ -1646,20 +1646,6 @@ rdpTransport* transport_new(rdpContext* context)
+ 	if (!transport->log)
+ 		goto fail;
+ 
+-	// transport->io.DataHandler = transport_data_handler;
+-	transport->io.TCPConnect = freerdp_tcp_default_connect;
+-	transport->io.TLSConnect = transport_default_connect_tls;
+-	transport->io.TLSAccept = transport_default_accept_tls;
+-	transport->io.TransportAttach = transport_default_attach;
+-	transport->io.TransportDisconnect = transport_default_disconnect;
+-	transport->io.ReadPdu = transport_default_read_pdu;
+-	transport->io.WritePdu = transport_default_write;
+-	transport->io.ReadBytes = transport_read_layer;
+-	transport->io.GetPublicKey = transport_default_get_public_key;
+-	transport->io.SetBlockingMode = transport_default_set_blocking_mode;
+-	transport->io.ConnectLayer = transport_default_connect_layer;
+-	transport->io.AttachLayer = transport_default_attach_layer;
+-
+ 	transport->context = context;
+ 	transport->ReceivePool = StreamPool_New(TRUE, BUFFER_SIZE);
+ 
+@@ -1698,6 +1684,20 @@ rdpTransport* transport_new(rdpContext* context)
+ 	if (!InitializeCriticalSectionAndSpinCount(&(transport->WriteLock), 4000))
+ 		goto fail;
+ 
++	// transport->io.DataHandler = transport_data_handler;
++	transport->io.TCPConnect = freerdp_tcp_default_connect;
++	transport->io.TLSConnect = transport_default_connect_tls;
++	transport->io.TLSAccept = transport_default_accept_tls;
++	transport->io.TransportAttach = transport_default_attach;
++	transport->io.TransportDisconnect = transport_default_disconnect;
++	transport->io.ReadPdu = transport_default_read_pdu;
++	transport->io.WritePdu = transport_default_write;
++	transport->io.ReadBytes = transport_read_layer;
++	transport->io.GetPublicKey = transport_default_get_public_key;
++	transport->io.SetBlockingMode = transport_default_set_blocking_mode;
++	transport->io.ConnectLayer = transport_default_connect_layer;
++	transport->io.AttachLayer = transport_default_attach_layer;
++
+ 	return transport;
+ fail:
+ 	WINPR_PRAGMA_DIAG_PUSH
+-- 
+2.49.0
+

Limit-minimum-threadpool-size.patch

@@ -0,0 +1,51 @@
+From 8fc7acbfd0a1892bc9237ae25e99d32270812dcc Mon Sep 17 00:00:00 2001
+From: akallabeth <akallabeth@posteo.net>
+Date: Mon, 29 Sep 2025 08:37:06 +0200
+Subject: [PATCH] [winpr,pool] limit minimum threadpool size
+
+---
+ winpr/libwinpr/pool/pool.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/winpr/libwinpr/pool/pool.c b/winpr/libwinpr/pool/pool.c
+index cbfc274c5..2cbe9a4fa 100644
+--- a/winpr/libwinpr/pool/pool.c
++++ b/winpr/libwinpr/pool/pool.c
+@@ -129,22 +129,26 @@ static BOOL InitializeThreadpool(PTP_POOL pool)
+ 
+ #if !defined(WINPR_THREADPOOL_DEFAULT_MIN_COUNT)
+ #error "WINPR_THREADPOOL_DEFAULT_MIN_COUNT must be defined"
++#endif
++#if !defined(WINPR_THREADPOOL_DEFAULT_MAX_COUNT)
++#error "WINPR_THREADPOOL_DEFAULT_MAX_COUNT must be defined"
+ #endif
+ 
+ 	SYSTEM_INFO info = { 0 };
+ 	GetSystemInfo(&info);
++
++	DWORD min = info.dwNumberOfProcessors;
++	DWORD max = info.dwNumberOfProcessors;
+ 	if (info.dwNumberOfProcessors < WINPR_THREADPOOL_DEFAULT_MIN_COUNT)
+-		info.dwNumberOfProcessors = WINPR_THREADPOOL_DEFAULT_MIN_COUNT;
++		min = WINPR_THREADPOOL_DEFAULT_MIN_COUNT;
++	if (info.dwNumberOfProcessors > WINPR_THREADPOOL_DEFAULT_MAX_COUNT)
++		max = WINPR_THREADPOOL_DEFAULT_MAX_COUNT;
++	if (min > max)
++		min = max;
+ 
+-	if (!SetThreadpoolThreadMinimum(pool, info.dwNumberOfProcessors))
++	if (!SetThreadpoolThreadMinimum(pool, min))
+ 		goto fail;
+ 
+-#if !defined(WINPR_THREADPOOL_DEFAULT_MAX_COUNT)
+-#error "WINPR_THREADPOOL_DEFAULT_MAX_COUNT must be defined"
+-#endif
+-	DWORD max = info.dwNumberOfProcessors;
+-	if (max > WINPR_THREADPOOL_DEFAULT_MAX_COUNT)
+-		max = WINPR_THREADPOOL_DEFAULT_MAX_COUNT;
+ 	SetThreadpoolThreadMaximum(pool, max);
+ 
+ 	rc = TRUE;
+-- 
+2.51.0
+

Limit-threadpool-to-16-threads.patch

@@ -0,0 +1,60 @@
+From c2fc455d8f2dc60de35ed98cb300b7e6a84fe383 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Wed, 3 Sep 2025 14:03:10 +0200
+Subject: [PATCH 066/100] [winpr,pool] limit threadpool to 16 threads by
+ default
+
+Initialize the threadpool to minimum of number of processors and 16 by
+default.
+---
+ winpr/libwinpr/pool/CMakeLists.txt |  2 ++
+ winpr/libwinpr/pool/pool.c         | 13 +++++++++----
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/winpr/libwinpr/pool/CMakeLists.txt b/winpr/libwinpr/pool/CMakeLists.txt
+index fb2dee58f..cfa9bc891 100644
+--- a/winpr/libwinpr/pool/CMakeLists.txt
++++ b/winpr/libwinpr/pool/CMakeLists.txt
+@@ -15,6 +15,8 @@
+ # See the License for the specific language governing permissions and
+ # limitations under the License.
+ 
++set(WINPR_THREADPOOL_DEFAULT_MAX_COUNT "16" CACHE STRING "The maximum (default) number of threads in a pool")
++winpr_definition_add(WINPR_THREADPOOL_DEFAULT_MAX_COUNT=${WINPR_THREADPOOL_DEFAULT_MAX_COUNT})
+ winpr_module_add(
+   synch.c
+   work.c
+diff --git a/winpr/libwinpr/pool/pool.c b/winpr/libwinpr/pool/pool.c
+index 39bbaaac9..96db6b247 100644
+--- a/winpr/libwinpr/pool/pool.c
++++ b/winpr/libwinpr/pool/pool.c
+@@ -133,7 +133,14 @@ static BOOL InitializeThreadpool(PTP_POOL pool)
+ 		info.dwNumberOfProcessors = 1;
+ 	if (!SetThreadpoolThreadMinimum(pool, info.dwNumberOfProcessors))
+ 		goto fail;
+-	SetThreadpoolThreadMaximum(pool, info.dwNumberOfProcessors);
++
++#if !defined(WINPR_THREADPOOL_DEFAULT_MAX_COUNT)
++#error "WINPR_THREADPOOL_DEFAULT_MAX_COUNT must be defined"
++#endif
++	DWORD max = info.dwNumberOfProcessors;
++	if (max > WINPR_THREADPOOL_DEFAULT_MAX_COUNT)
++		max = WINPR_THREADPOOL_DEFAULT_MAX_COUNT;
++	SetThreadpoolThreadMaximum(pool, max);
+ 
+ 	rc = TRUE;
+ 
+@@ -143,9 +150,7 @@ fail:
+ 
+ PTP_POOL GetDefaultThreadpool(void)
+ {
+-	PTP_POOL pool = NULL;
+-
+-	pool = &DEFAULT_POOL;
++	PTP_POOL pool = &DEFAULT_POOL;
+ 
+ 	if (!InitializeThreadpool(pool))
+ 		return NULL;
+-- 
+2.51.0
+

SOURCES/Revert-Moved-clipboard-utils-to-core-library-fixes-6.patch

@@ -1,560 +0,0 @@
-From a441e68fccc8ef137c9e8e667fed6adaab34ba37 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 1 Oct 2024 15:43:07 +0200
-Subject: [PATCH] Revert "Moved clipboard utils to core library, fixes #6760
- (#7752)"
-
-This reverts commit 26a83e6ccde272c1bbc2b2591325dc7a493811bc.
----
- channels/cliprdr/client/cliprdr_format.c | 195 +++++++++++++++++++
- include/freerdp/channels/cliprdr.h       |  12 +-
- include/freerdp/utils/cliprdr_utils.h    |  48 -----
- libfreerdp/utils/CMakeLists.txt          |   1 -
- libfreerdp/utils/cliprdr_utils.c         | 235 -----------------------
- 5 files changed, 206 insertions(+), 285 deletions(-)
- delete mode 100644 include/freerdp/utils/cliprdr_utils.h
- delete mode 100644 libfreerdp/utils/cliprdr_utils.c
-
-diff --git a/channels/cliprdr/client/cliprdr_format.c b/channels/cliprdr/client/cliprdr_format.c
-index 0b6111b96..4c31a1b08 100644
---- a/channels/cliprdr/client/cliprdr_format.c
-+++ b/channels/cliprdr/client/cliprdr_format.c
-@@ -173,3 +173,198 @@ UINT cliprdr_process_format_data_response(cliprdrPlugin* cliprdr, wStream* s, UI
- 
- 	return error;
- }
-+
-+static UINT64 filetime_to_uint64(FILETIME value)
-+{
-+	UINT64 converted = 0;
-+	converted |= (UINT32)value.dwHighDateTime;
-+	converted <<= 32;
-+	converted |= (UINT32)value.dwLowDateTime;
-+	return converted;
-+}
-+
-+static FILETIME uint64_to_filetime(UINT64 value)
-+{
-+	FILETIME converted;
-+	converted.dwLowDateTime = (UINT32)(value >> 0);
-+	converted.dwHighDateTime = (UINT32)(value >> 32);
-+	return converted;
-+}
-+
-+#define CLIPRDR_FILEDESCRIPTOR_SIZE (4 + 32 + 4 + 16 + 8 + 8 + 520)
-+
-+/**
-+ * Parse a packed file list.
-+ *
-+ * The resulting array must be freed with the `free()` function.
-+ *
-+ * @param [in]  format_data            packed `CLIPRDR_FILELIST` to parse.
-+ * @param [in]  format_data_length     length of `format_data` in bytes.
-+ * @param [out] file_descriptor_array  parsed array of `FILEDESCRIPTOR` structs.
-+ * @param [out] file_descriptor_count  number of elements in `file_descriptor_array`.
-+ *
-+ * @returns 0 on success, otherwise a Win32 error code.
-+ */
-+UINT cliprdr_parse_file_list(const BYTE* format_data, UINT32 format_data_length,
-+                             FILEDESCRIPTORW** file_descriptor_array, UINT32* file_descriptor_count)
-+{
-+	UINT result = NO_ERROR;
-+	UINT32 i;
-+	UINT32 count = 0;
-+	wStream* s = NULL;
-+
-+	if (!format_data || !file_descriptor_array || !file_descriptor_count)
-+		return ERROR_BAD_ARGUMENTS;
-+
-+	s = Stream_New((BYTE*)format_data, format_data_length);
-+	if (!s)
-+		return ERROR_NOT_ENOUGH_MEMORY;
-+
-+	if (Stream_GetRemainingLength(s) < 4)
-+	{
-+		WLog_ERR(TAG, "invalid packed file list");
-+
-+		result = ERROR_INCORRECT_SIZE;
-+		goto out;
-+	}
-+
-+	Stream_Read_UINT32(s, count); /* cItems (4 bytes) */
-+
-+	if (Stream_GetRemainingLength(s) / CLIPRDR_FILEDESCRIPTOR_SIZE < count)
-+	{
-+		WLog_ERR(TAG, "packed file list is too short: expected %" PRIuz ", have %" PRIuz,
-+		         ((size_t)count) * CLIPRDR_FILEDESCRIPTOR_SIZE, Stream_GetRemainingLength(s));
-+
-+		result = ERROR_INCORRECT_SIZE;
-+		goto out;
-+	}
-+
-+	*file_descriptor_count = count;
-+	*file_descriptor_array = calloc(count, sizeof(FILEDESCRIPTORW));
-+	if (!*file_descriptor_array)
-+	{
-+		result = ERROR_NOT_ENOUGH_MEMORY;
-+		goto out;
-+	}
-+
-+	for (i = 0; i < count; i++)
-+	{
-+		int c;
-+		UINT64 lastWriteTime;
-+		FILEDESCRIPTORW* file = &((*file_descriptor_array)[i]);
-+
-+		Stream_Read_UINT32(s, file->dwFlags);          /* flags (4 bytes) */
-+		Stream_Seek(s, 32);                            /* reserved1 (32 bytes) */
-+		Stream_Read_UINT32(s, file->dwFileAttributes); /* fileAttributes (4 bytes) */
-+		Stream_Seek(s, 16);                            /* reserved2 (16 bytes) */
-+		Stream_Read_UINT64(s, lastWriteTime);          /* lastWriteTime (8 bytes) */
-+		file->ftLastWriteTime = uint64_to_filetime(lastWriteTime);
-+		Stream_Read_UINT32(s, file->nFileSizeHigh); /* fileSizeHigh (4 bytes) */
-+		Stream_Read_UINT32(s, file->nFileSizeLow);  /* fileSizeLow (4 bytes) */
-+		for (c = 0; c < 260; c++)                   /* cFileName (520 bytes) */
-+			Stream_Read_UINT16(s, file->cFileName[c]);
-+	}
-+
-+	if (Stream_GetRemainingLength(s) > 0)
-+		WLog_WARN(TAG, "packed file list has %" PRIuz " excess bytes",
-+		          Stream_GetRemainingLength(s));
-+out:
-+	Stream_Free(s, FALSE);
-+
-+	return result;
-+}
-+
-+#define CLIPRDR_MAX_FILE_SIZE (2U * 1024 * 1024 * 1024)
-+
-+/**
-+ * Serialize a packed file list.
-+ *
-+ * The resulting format data must be freed with the `free()` function.
-+ *
-+ * @param [in]  file_descriptor_array  array of `FILEDESCRIPTOR` structs to serialize.
-+ * @param [in]  file_descriptor_count  number of elements in `file_descriptor_array`.
-+ * @param [out] format_data            serialized CLIPRDR_FILELIST.
-+ * @param [out] format_data_length     length of `format_data` in bytes.
-+ *
-+ * @returns 0 on success, otherwise a Win32 error code.
-+ */
-+UINT cliprdr_serialize_file_list(const FILEDESCRIPTORW* file_descriptor_array,
-+                                 UINT32 file_descriptor_count, BYTE** format_data,
-+                                 UINT32* format_data_length)
-+{
-+	return cliprdr_serialize_file_list_ex(CB_STREAM_FILECLIP_ENABLED, file_descriptor_array,
-+	                                      file_descriptor_count, format_data, format_data_length);
-+}
-+
-+UINT cliprdr_serialize_file_list_ex(UINT32 flags, const FILEDESCRIPTORW* file_descriptor_array,
-+                                    UINT32 file_descriptor_count, BYTE** format_data,
-+                                    UINT32* format_data_length)
-+{
-+	UINT result = NO_ERROR;
-+	UINT32 i;
-+	wStream* s = NULL;
-+
-+	if (!file_descriptor_array || !format_data || !format_data_length)
-+		return ERROR_BAD_ARGUMENTS;
-+
-+	if ((flags & CB_STREAM_FILECLIP_ENABLED) == 0)
-+	{
-+		WLog_WARN(TAG, "No file clipboard support annouonced!");
-+		return ERROR_BAD_ARGUMENTS;
-+	}
-+
-+	s = Stream_New(NULL, 4 + file_descriptor_count * CLIPRDR_FILEDESCRIPTOR_SIZE);
-+	if (!s)
-+		return ERROR_NOT_ENOUGH_MEMORY;
-+
-+	Stream_Write_UINT32(s, file_descriptor_count); /* cItems (4 bytes) */
-+
-+	for (i = 0; i < file_descriptor_count; i++)
-+	{
-+		int c;
-+		UINT64 lastWriteTime;
-+		const FILEDESCRIPTORW* file = &file_descriptor_array[i];
-+
-+		/*
-+		 * There is a known issue with Windows server getting stuck in
-+		 * an infinite loop when downloading files that are larger than
-+		 * 2 gigabytes. Do not allow clients to send such file lists.
-+		 *
-+		 * https://support.microsoft.com/en-us/help/2258090
-+		 */
-+		if ((flags & CB_HUGE_FILE_SUPPORT_ENABLED) == 0)
-+		{
-+			if ((file->nFileSizeHigh > 0) || (file->nFileSizeLow >= CLIPRDR_MAX_FILE_SIZE))
-+			{
-+				WLog_ERR(TAG, "cliprdr does not support files over 2 GB");
-+				result = ERROR_FILE_TOO_LARGE;
-+				goto error;
-+			}
-+		}
-+
-+		Stream_Write_UINT32(s, file->dwFlags);          /* flags (4 bytes) */
-+		Stream_Zero(s, 32);                             /* reserved1 (32 bytes) */
-+		Stream_Write_UINT32(s, file->dwFileAttributes); /* fileAttributes (4 bytes) */
-+		Stream_Zero(s, 16);                             /* reserved2 (16 bytes) */
-+		lastWriteTime = filetime_to_uint64(file->ftLastWriteTime);
-+		Stream_Write_UINT64(s, lastWriteTime);       /* lastWriteTime (8 bytes) */
-+		Stream_Write_UINT32(s, file->nFileSizeHigh); /* fileSizeHigh (4 bytes) */
-+		Stream_Write_UINT32(s, file->nFileSizeLow);  /* fileSizeLow (4 bytes) */
-+		for (c = 0; c < 260; c++)                    /* cFileName (520 bytes) */
-+			Stream_Write_UINT16(s, file->cFileName[c]);
-+	}
-+
-+	Stream_SealLength(s);
-+
-+	Stream_GetBuffer(s, *format_data);
-+	Stream_GetLength(s, *format_data_length);
-+
-+	Stream_Free(s, FALSE);
-+
-+	return result;
-+
-+error:
-+	Stream_Free(s, TRUE);
-+
-+	return result;
-+}
-diff --git a/include/freerdp/channels/cliprdr.h b/include/freerdp/channels/cliprdr.h
-index fbf23f6e5..86fc65890 100644
---- a/include/freerdp/channels/cliprdr.h
-+++ b/include/freerdp/channels/cliprdr.h
-@@ -22,7 +22,6 @@
- 
- #include <freerdp/api.h>
- #include <freerdp/types.h>
--#include <freerdp/utils/cliprdr_utils.h>
- 
- #include <winpr/shell.h>
- 
-@@ -94,6 +93,17 @@ extern "C"
- {
- #endif
- 
-+	FREERDP_API UINT cliprdr_parse_file_list(const BYTE* format_data, UINT32 format_data_length,
-+	                                         FILEDESCRIPTORW** file_descriptor_array,
-+	                                         UINT32* file_descriptor_count);
-+	FREERDP_API UINT cliprdr_serialize_file_list(const FILEDESCRIPTORW* file_descriptor_array,
-+	                                             UINT32 file_descriptor_count, BYTE** format_data,
-+	                                             UINT32* format_data_length);
-+	FREERDP_API UINT cliprdr_serialize_file_list_ex(UINT32 flags,
-+	                                                const FILEDESCRIPTORW* file_descriptor_array,
-+	                                                UINT32 file_descriptor_count,
-+	                                                BYTE** format_data, UINT32* format_data_length);
-+
- #ifdef __cplusplus
- }
- #endif
-diff --git a/include/freerdp/utils/cliprdr_utils.h b/include/freerdp/utils/cliprdr_utils.h
-deleted file mode 100644
-index 59ecf848f..000000000
---- a/include/freerdp/utils/cliprdr_utils.h
-+++ /dev/null
-@@ -1,48 +0,0 @@
--/**
-- * FreeRDP: A Remote Desktop Protocol Implementation
-- * RDPDR utility functions
-- *
-- * Copyright 2022 Armin Novak <armin.novak@thincast.com>
-- * Copyright 2022 Thincast Technologies GmbH
-- *
-- * Licensed under the Apache License, Version 2.0 (the "License");
-- * you may not use this file except in compliance with the License.
-- * You may obtain a copy of the License at
-- *
-- *     http://www.apache.org/licenses/LICENSE-2.0
-- *
-- * Unless required by applicable law or agreed to in writing, software
-- * distributed under the License is distributed on an "AS IS" BASIS,
-- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-- * See the License for the specific language governing permissions and
-- * limitations under the License.
-- */
--
--#ifndef FREERDP_UTILS_CLIPRDR_H
--#define FREERDP_UTILS_CLIPRDR_H
--
--#include <winpr/wtypes.h>
--#include <winpr/shell.h>
--#include <freerdp/api.h>
--
--#ifdef __cplusplus
--extern "C"
--{
--#endif
--
--	FREERDP_API UINT cliprdr_parse_file_list(const BYTE* format_data, UINT32 format_data_length,
--	                                         FILEDESCRIPTORW** file_descriptor_array,
--	                                         UINT32* file_descriptor_count);
--	FREERDP_API UINT cliprdr_serialize_file_list(const FILEDESCRIPTORW* file_descriptor_array,
--	                                             UINT32 file_descriptor_count, BYTE** format_data,
--	                                             UINT32* format_data_length);
--	FREERDP_API UINT cliprdr_serialize_file_list_ex(UINT32 flags,
--	                                                const FILEDESCRIPTORW* file_descriptor_array,
--	                                                UINT32 file_descriptor_count,
--	                                                BYTE** format_data, UINT32* format_data_length);
--
--#ifdef __cplusplus
--}
--#endif
--
--#endif
-diff --git a/libfreerdp/utils/CMakeLists.txt b/libfreerdp/utils/CMakeLists.txt
-index 2ec561d33..7bff6736a 100644
---- a/libfreerdp/utils/CMakeLists.txt
-+++ b/libfreerdp/utils/CMakeLists.txt
-@@ -20,7 +20,6 @@ set(MODULE_PREFIX "FREERDP_UTILS")
- 
- set(${MODULE_PREFIX}_SRCS
- 	passphrase.c
--	cliprdr_utils.c
- 	pcap.c
- 	profiler.c
- 	ringbuffer.c
-diff --git a/libfreerdp/utils/cliprdr_utils.c b/libfreerdp/utils/cliprdr_utils.c
-deleted file mode 100644
-index 7fb99d63a..000000000
---- a/libfreerdp/utils/cliprdr_utils.c
-+++ /dev/null
-@@ -1,235 +0,0 @@
--/**
-- * FreeRDP: A Remote Desktop Protocol Implementation
-- * Clipboard Virtual Channel Extension
-- *
-- * Copyright 2013 Marc-Andre Moreau <marcandre.moreau@gmail.com>
-- * Copyright 2022 Armin Novak <anovak@thincast.com
-- * Copyright 2022 Thincast Technologies GmbH
-- *
-- * Licensed under the Apache License, Version 2.0 (the "License");
-- * you may not use this file except in compliance with the License.
-- * You may obtain a copy of the License at
-- *
-- *	 http://www.apache.org/licenses/LICENSE-2.0
-- *
-- * Unless required by applicable law or agreed to in writing, software
-- * distributed under the License is distributed on an "AS IS" BASIS,
-- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-- * See the License for the specific language governing permissions and
-- * limitations under the License.
-- */
--
--#include <winpr/stream.h>
--#include <freerdp/utils/cliprdr_utils.h>
--#include <freerdp/channels/cliprdr.h>
--
--#include <freerdp/log.h>
--#define TAG FREERDP_TAG("utils." CLIPRDR_SVC_CHANNEL_NAME)
--
--#define CLIPRDR_FILEDESCRIPTOR_SIZE (4 + 32 + 4 + 16 + 8 + 8 + 520)
--#define CLIPRDR_MAX_FILE_SIZE (2U * 1024 * 1024 * 1024)
--
--static UINT64 filetime_to_uint64(FILETIME value)
--{
--	UINT64 converted = 0;
--	converted |= (UINT32)value.dwHighDateTime;
--	converted <<= 32;
--	converted |= (UINT32)value.dwLowDateTime;
--	return converted;
--}
--
--static FILETIME uint64_to_filetime(UINT64 value)
--{
--	FILETIME converted;
--	converted.dwLowDateTime = (UINT32)(value >> 0);
--	converted.dwHighDateTime = (UINT32)(value >> 32);
--	return converted;
--}
--
--/**
-- * Parse a packed file list.
-- *
-- * The resulting array must be freed with the `free()` function.
-- *
-- * @param [in]  format_data            packed `CLIPRDR_FILELIST` to parse.
-- * @param [in]  format_data_length     length of `format_data` in bytes.
-- * @param [out] file_descriptor_array  parsed array of `FILEDESCRIPTOR` structs.
-- * @param [out] file_descriptor_count  number of elements in `file_descriptor_array`.
-- *
-- * @returns 0 on success, otherwise a Win32 error code.
-- */
--UINT cliprdr_parse_file_list(const BYTE* format_data, UINT32 format_data_length,
--                             FILEDESCRIPTORW** file_descriptor_array, UINT32* file_descriptor_count)
--{
--	UINT result = NO_ERROR;
--	UINT32 i;
--	UINT32 count = 0;
--	wStream sbuffer;
--	wStream* s = &sbuffer;
--
--	if (!format_data || !file_descriptor_array || !file_descriptor_count)
--		return ERROR_BAD_ARGUMENTS;
--
--	Stream_StaticInit(&sbuffer, format_data, format_data_length);
--	if (!s)
--		return ERROR_NOT_ENOUGH_MEMORY;
--
--	if (Stream_GetRemainingLength(s) < 4)
--	{
--		WLog_ERR(TAG, "invalid packed file list");
--
--		result = ERROR_INCORRECT_SIZE;
--		goto out;
--	}
--
--	Stream_Read_UINT32(s, count); /* cItems (4 bytes) */
--
--	if (Stream_GetRemainingLength(s) / CLIPRDR_FILEDESCRIPTOR_SIZE < count)
--	{
--		WLog_ERR(TAG, "packed file list is too short: expected %" PRIuz ", have %" PRIuz,
--		         ((size_t)count) * CLIPRDR_FILEDESCRIPTOR_SIZE, Stream_GetRemainingLength(s));
--
--		result = ERROR_INCORRECT_SIZE;
--		goto out;
--	}
--
--	*file_descriptor_count = count;
--	*file_descriptor_array = calloc(count, sizeof(FILEDESCRIPTORW));
--	if (!*file_descriptor_array)
--	{
--		result = ERROR_NOT_ENOUGH_MEMORY;
--		goto out;
--	}
--
--	for (i = 0; i < count; i++)
--	{
--		UINT64 tmp;
--		FILEDESCRIPTORW* file = &((*file_descriptor_array)[i]);
--
--		Stream_Read_UINT32(s, file->dwFlags);          /* flags (4 bytes) */
--		Stream_Read_UINT32(s, file->clsid.Data1);
--		Stream_Read_UINT16(s, file->clsid.Data2);
--		Stream_Read_UINT16(s, file->clsid.Data3);
--		Stream_Read(s, &file->clsid.Data4, sizeof(file->clsid.Data4));
--		Stream_Read_INT32(s, file->sizel.cx);
--		Stream_Read_INT32(s, file->sizel.cy);
--		Stream_Read_INT32(s, file->pointl.x);
--		Stream_Read_INT32(s, file->pointl.y);
--		Stream_Read_UINT32(s, file->dwFileAttributes); /* fileAttributes (4 bytes) */
--		Stream_Read_UINT64(s, tmp);                    /* ftCreationTime (8 bytes) */
--		file->ftCreationTime = uint64_to_filetime(tmp);
--		Stream_Read_UINT64(s, tmp); /* ftLastAccessTime (8 bytes) */
--		file->ftLastAccessTime = uint64_to_filetime(tmp);
--		Stream_Read_UINT64(s, tmp); /* lastWriteTime (8 bytes) */
--		file->ftLastWriteTime = uint64_to_filetime(tmp);
--		Stream_Read_UINT32(s, file->nFileSizeHigh); /* fileSizeHigh (4 bytes) */
--		Stream_Read_UINT32(s, file->nFileSizeLow);  /* fileSizeLow (4 bytes) */
--		Stream_Read_UTF16_String(s, file->cFileName,
--		                         ARRAYSIZE(file->cFileName)); /* cFileName (520 bytes) */
--	}
--
--	if (Stream_GetRemainingLength(s) > 0)
--		WLog_WARN(TAG, "packed file list has %" PRIuz " excess bytes",
--		          Stream_GetRemainingLength(s));
--out:
--
--	return result;
--}
--
--/**
-- * Serialize a packed file list.
-- *
-- * The resulting format data must be freed with the `free()` function.
-- *
-- * @param [in]  file_descriptor_array  array of `FILEDESCRIPTOR` structs to serialize.
-- * @param [in]  file_descriptor_count  number of elements in `file_descriptor_array`.
-- * @param [out] format_data            serialized CLIPRDR_FILELIST.
-- * @param [out] format_data_length     length of `format_data` in bytes.
-- *
-- * @returns 0 on success, otherwise a Win32 error code.
-- */
--UINT cliprdr_serialize_file_list(const FILEDESCRIPTORW* file_descriptor_array,
--                                 UINT32 file_descriptor_count, BYTE** format_data,
--                                 UINT32* format_data_length)
--{
--	return cliprdr_serialize_file_list_ex(CB_STREAM_FILECLIP_ENABLED, file_descriptor_array,
--	                                      file_descriptor_count, format_data, format_data_length);
--}
--
--UINT cliprdr_serialize_file_list_ex(UINT32 flags, const FILEDESCRIPTORW* file_descriptor_array,
--                                    UINT32 file_descriptor_count, BYTE** format_data,
--                                    UINT32* format_data_length)
--{
--	UINT result = NO_ERROR;
--	UINT32 i;
--	size_t len;
--	wStream* s = NULL;
--
--	if (!file_descriptor_array || !format_data || !format_data_length)
--		return ERROR_BAD_ARGUMENTS;
--
--	if ((flags & CB_STREAM_FILECLIP_ENABLED) == 0)
--	{
--		WLog_WARN(TAG, "No file clipboard support annouonced!");
--		return ERROR_BAD_ARGUMENTS;
--	}
--
--	s = Stream_New(NULL, 4 + file_descriptor_count * CLIPRDR_FILEDESCRIPTOR_SIZE);
--	if (!s)
--		return ERROR_NOT_ENOUGH_MEMORY;
--
--	Stream_Write_UINT32(s, file_descriptor_count); /* cItems (4 bytes) */
--
--	for (i = 0; i < file_descriptor_count; i++)
--	{
--		int c;
--		UINT64 lastWriteTime;
--		const FILEDESCRIPTORW* file = &file_descriptor_array[i];
--
--		/*
--		 * There is a known issue with Windows server getting stuck in
--		 * an infinite loop when downloading files that are larger than
--		 * 2 gigabytes. Do not allow clients to send such file lists.
--		 *
--		 * https://support.microsoft.com/en-us/help/2258090
--		 */
--		if ((flags & CB_HUGE_FILE_SUPPORT_ENABLED) == 0)
--		{
--			if ((file->nFileSizeHigh > 0) || (file->nFileSizeLow >= CLIPRDR_MAX_FILE_SIZE))
--			{
--				WLog_ERR(TAG, "cliprdr does not support files over 2 GB");
--				result = ERROR_FILE_TOO_LARGE;
--				goto error;
--			}
--		}
--
--		Stream_Write_UINT32(s, file->dwFlags);          /* flags (4 bytes) */
--		Stream_Zero(s, 32);                             /* reserved1 (32 bytes) */
--		Stream_Write_UINT32(s, file->dwFileAttributes); /* fileAttributes (4 bytes) */
--		Stream_Zero(s, 16);                             /* reserved2 (16 bytes) */
--		lastWriteTime = filetime_to_uint64(file->ftLastWriteTime);
--		Stream_Write_UINT64(s, lastWriteTime);       /* lastWriteTime (8 bytes) */
--		Stream_Write_UINT32(s, file->nFileSizeHigh); /* fileSizeHigh (4 bytes) */
--		Stream_Write_UINT32(s, file->nFileSizeLow);  /* fileSizeLow (4 bytes) */
--		for (c = 0; c < 260; c++)                    /* cFileName (520 bytes) */
--			Stream_Write_UINT16(s, file->cFileName[c]);
--	}
--
--	Stream_SealLength(s);
--
--	Stream_GetBuffer(s, *format_data);
--	Stream_GetLength(s, len);
--	if (len > UINT32_MAX)
--		goto error;
--
--	*format_data_length = (UINT32)len;
--
--	Stream_Free(s, FALSE);
--
--	return result;
--
--error:
--	Stream_Free(s, TRUE);
--
--	return result;
--}
--- 
-2.46.1
-

SOURCES/allocations-fix-growth-of-preallocated-buffers.patch

@@ -1,36 +0,0 @@
-From 563a19a683d6e0e7b1218e4558a0fb75333b5b34 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 28 Apr 2026 04:14:23 +0000
-Subject: [PATCH] [allocations] fix growth of preallocated buffers
-
-Partial backport of commit 118afc0b954ba9d5632b7836ad24e454555ed113.
-
-Only the `Stream_EnsureCapacity` fix is included. Other changes from
-the upstream commit (`sizeof(WCHAR)` replacements, collection growth
-patterns, environment block handling) are unrelated to CVE-2026-27951.
-
-Made-with: Cursor
----
- winpr/libwinpr/utils/stream.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/winpr/libwinpr/utils/stream.c b/winpr/libwinpr/utils/stream.c
-index cc119c7..cb145b0 100644
---- a/winpr/libwinpr/utils/stream.c
-+++ b/winpr/libwinpr/utils/stream.c
-@@ -40,8 +40,10 @@ BOOL Stream_EnsureCapacity(wStream* s, size_t size)
- 
- 		do
- 		{
--			new_capacity *= 2;
--		} while (new_capacity < size);
-+			if (new_capacity > SIZE_MAX - 128ull)
-+				return FALSE;
-+			new_capacity += 128ull;
-+		} while (new_capacity <= size);
- 
- 		position = Stream_GetPosition(s);
- 
--- 
-2.53.0
-

SOURCES/cache-bitmap-initialize-overallocated-bitmap-cache-extra-slot.patch

@@ -1,52 +0,0 @@
-From 23320a6d5f2e1c8a9b7d6f4e3c2a1b0987654321 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 28 Apr 2026 04:25:58 +0000
-Subject: [PATCH] [cache,bitmap] initialize overallocated bitmap cache extra
- slot
-
-Backport of commit 8270e0bb3d6726c947d57c93ba9caa92a052b557.
-
-Adjusted hunk offsets for 2.11.7.
-
-Made-with: Cursor
----
- libfreerdp/cache/bitmap.c | 16 +++++++++++++++-
- 1 file changed, 15 insertions(+), 1 deletion(-)
-
-diff --git a/libfreerdp/cache/bitmap.c b/libfreerdp/cache/bitmap.c
-index b8a4f21..23320a6 100644
---- a/libfreerdp/cache/bitmap.c
-+++ b/libfreerdp/cache/bitmap.c
-@@ -303,6 +303,19 @@ rdpBitmapCache* bitmap_cache_new(rdpSettings* settings)
- 		cell->number = nr;
- 	}
- 
-+	/* initialize the overallocated extra slot for old RDP servers that send
-+	 * cacheId == maxCells; use a minimal allocation since no protocol-negotiated
-+	 * capacity exists for this slot */
-+	{
-+		BITMAP_V2_CELL* extra = &bitmapCache->cells[bitmapCache->maxCells];
-+		/* allocate an extra entry for BITMAP_CACHE_WAITING_LIST_INDEX */
-+		extra->entries = (rdpBitmap**)calloc(1, sizeof(rdpBitmap*));
-+
-+		if (!extra->entries)
-+			goto fail;
-+		extra->number = 0;
-+	}
-+
- 	return bitmapCache;
- fail:
- 
-@@ -315,7 +328,8 @@ void bitmap_cache_free(rdpBitmapCache* bitmapCache)
- 	if (bitmapCache)
- 	{
- 		UINT32 i;
--		for (i = 0; i < bitmapCache->maxCells; i++)
-+		/* iterate through maxCells + 1 to also free the overallocated extra slot */
-+		for (i = 0; i <= bitmapCache->maxCells; i++)
- 		{
- 			UINT32 j;
- 			BITMAP_V2_CELL* cell = &bitmapCache->cells[i];
--- 
-2.53.0
-

SOURCES/cache-bitmap-overallocate-bitmap-cache.patch

@@ -1,33 +0,0 @@
-From 608c5d40f6ab4cabd4d5793b2d641f401e146233 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 28 Apr 2026 04:25:52 +0000
-Subject: [PATCH] [cache,bitmap] overallocate bitmap cache
-
-Backport of commit ffad58fd2b329efd81a3239e9d7e3c927b8e503f.
-
-Adjusted hunk offsets for 2.11.7.
-
-Made-with: Cursor
----
- libfreerdp/cache/bitmap.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/libfreerdp/cache/bitmap.c b/libfreerdp/cache/bitmap.c
-index 0ce2599..b8a4f21 100644
---- a/libfreerdp/cache/bitmap.c
-+++ b/libfreerdp/cache/bitmap.c
-@@ -281,8 +281,10 @@ rdpBitmapCache* bitmap_cache_new(rdpSettings* settings)
- 	bitmapCache->settings = settings;
- 	bitmapCache->update = ((freerdp*)settings->instance)->update;
- 	bitmapCache->context = bitmapCache->update->context;
-+
-+	/* overallocate by 1. older RDP servers do send a off by 1 cache index. */
- 	bitmapCache->cells =
--	    (BITMAP_V2_CELL*)calloc(settings->BitmapCacheV2NumCells, sizeof(BITMAP_V2_CELL));
-+	    (BITMAP_V2_CELL*)calloc(settings->BitmapCacheV2NumCells + 1ull, sizeof(BITMAP_V2_CELL));
- 
- 	if (!bitmapCache->cells)
- 		goto fail;
--- 
-2.53.0
-

SOURCES/cache-glyph-tighten-bounds-checks.patch

@@ -1,22 +0,0 @@
-From 8b6476acac05c00ebdb9184c7906d149994f7577 Mon Sep 17 00:00:00 2001
-From: Armin Novak <armin.novak@thincast.com>
-Date: Thu, 9 Jul 2026 08:34:18 +0200
-Subject: [PATCH] [cache,glyph] tighten bounds checks
-
----
- libfreerdp/cache/glyph.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/libfreerdp/cache/glyph.c b/libfreerdp/cache/glyph.c
-index 5c41f912a..67afbdfa6 100644
---- a/libfreerdp/cache/glyph.c
-+++ b/libfreerdp/cache/glyph.c
-@@ -268,6 +268,8 @@ static BOOL update_process_glyph_fragments(rdpContext* context, const BYTE* data
- 
- 				id = data[index++];
- 				size = data[index++];
-+				if (size > length - index)
-+					return FALSE;
- 				glyph_cache_fragment_put(glyph_cache, id, size, data);
- 				break;
- 

SOURCES/cache-offscreen-invalidate-bitmap-before-free.patch

@@ -1,46 +0,0 @@
-From 4a4126380430a3517d1015b628475b816705ceb4 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 22 Jan 2026 12:52:16 +0100
-Subject: [PATCH] [cache,offscreen] invalidate bitmap before free
-
-Backport of commit 52106a26726a2aba77aa6d86014d2eb3507f0783.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
----
- libfreerdp/cache/offscreen.c | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/libfreerdp/cache/offscreen.c b/libfreerdp/cache/offscreen.c
-index cdad56b4d..11e6caf21 100644
---- a/libfreerdp/cache/offscreen.c
-+++ b/libfreerdp/cache/offscreen.c
-@@ -160,7 +160,7 @@ void offscreen_cache_put(rdpOffscreenCache* offscreenCache, UINT32 index, rdpBit
- 
- void offscreen_cache_delete(rdpOffscreenCache* offscreenCache, UINT32 index)
- {
--	rdpBitmap* prevBitmap;
-+	WINPR_ASSERT(offscreenCache);
- 
- 	if (index >= offscreenCache->maxEntries)
- 	{
-@@ -168,10 +168,16 @@ void offscreen_cache_delete(rdpOffscreenCache* offscreenCache, UINT32 index)
- 		return;
- 	}
- 
--	prevBitmap = offscreenCache->entries[index];
-+	rdpBitmap* prevBitmap = offscreenCache->entries[index];
- 
- 	if (prevBitmap != NULL)
-+	{
-+		WINPR_ASSERT(offscreenCache->update->context);
-+
-+		/* Ensure that the bitmap is no longer used in GDI */
-+		IFCALL(prevBitmap->SetSurface, offscreenCache->update->context, NULL, FALSE);
- 		Bitmap_Free(offscreenCache->update->context, prevBitmap);
-+	}
- 
- 	offscreenCache->entries[index] = NULL;
- }
--- 
-2.52.0
-

SOURCES/channel-rdpsnd-only-clean-up-thread-before-free.patch

@@ -1,117 +0,0 @@
-From b96bfa485a286335bcb4c698fa6490fb4a98b9e6 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Fri, 13 Mar 2026 15:47:11 +0100
-Subject: [PATCH] [channel,rdpsnd] only clean up thread before free
-
-Backport of commit afa6851dc80835d3101e40fcef51b6c5c0f43ea5.
-
-Made-with: Cursor
----
- channels/rdpsnd/client/rdpsnd_main.c | 37 ++++++++++++++++------------
- 1 file changed, 21 insertions(+), 16 deletions(-)
-
-diff --git a/channels/rdpsnd/client/rdpsnd_main.c b/channels/rdpsnd/client/rdpsnd_main.c
-index c7660a857..576e065d2 100644
---- a/channels/rdpsnd/client/rdpsnd_main.c
-+++ b/channels/rdpsnd/client/rdpsnd_main.c
-@@ -133,6 +133,8 @@ struct rdpsnd_plugin
- 	BOOL applyVolume;
- };
- 
-+static DWORD WINAPI play_thread(LPVOID arg);
-+
- static const char* rdpsnd_is_dyn_str(BOOL dynamic)
- {
- 	if (dynamic)
-@@ -1267,7 +1269,6 @@ static void cleanup_internals(rdpsndPlugin* rdpsnd)
- 	if (!rdpsnd)
- 		return;
- 
--	rdpsnd_terminate_thread(rdpsnd);
- 	if (rdpsnd->pool)
- 		StreamPool_Return(rdpsnd->pool, rdpsnd->data_in);
- 
-@@ -1331,6 +1332,7 @@ static void free_internals(rdpsndPlugin* rdpsnd)
- 	if (!rdpsnd)
- 		return;
- 
-+	rdpsnd_terminate_thread(rdpsnd);
- 	freerdp_dsp_context_free(rdpsnd->dsp_context);
- 	StreamPool_Free(rdpsnd->pool);
- 	rdpsnd->pool = NULL;
-@@ -1353,6 +1355,23 @@ static BOOL allocate_internals(rdpsndPlugin* rdpsnd)
- 			return FALSE;
- 	}
- 
-+	if (!rdpsnd->queue)
-+	{
-+		wObject obj = { 0 };
-+
-+		obj.fnObjectFree = _queue_free;
-+		rdpsnd->queue = MessageQueue_New(&obj);
-+		if (!rdpsnd->queue)
-+			return FALSE;
-+	}
-+
-+	if (!rdpsnd->thread)
-+	{
-+		rdpsnd->thread = CreateThread(NULL, 0, play_thread, rdpsnd, 0, NULL);
-+		if (!rdpsnd->thread)
-+			return FALSE;
-+	}
-+
- 	return TRUE;
- }
- 
-@@ -1391,23 +1410,12 @@ static DWORD WINAPI play_thread(LPVOID arg)
- 
- static UINT rdpsnd_virtual_channel_event_initialized(rdpsndPlugin* rdpsnd)
- {
--	wObject obj = { 0 };
--
- 	if (!rdpsnd)
- 		return ERROR_INVALID_PARAMETER;
- 
--	obj.fnObjectFree = _queue_free;
--	rdpsnd->queue = MessageQueue_New(&obj);
--	if (!rdpsnd->queue)
--		return CHANNEL_RC_NO_MEMORY;
--
- 	if (!allocate_internals(rdpsnd))
- 		return CHANNEL_RC_NO_MEMORY;
- 
--	rdpsnd->thread = CreateThread(NULL, 0, play_thread, rdpsnd, 0, NULL);
--	if (!rdpsnd->thread)
--		return CHANNEL_RC_INITIALIZATION_ERROR;
--
- 	return CHANNEL_RC_OK;
- }
- 
-@@ -1415,8 +1423,6 @@ void rdpsnd_virtual_channel_event_terminated(rdpsndPlugin* rdpsnd)
- {
- 	if (rdpsnd)
- 	{
--		rdpsnd_terminate_thread(rdpsnd);
--
- 		free_internals(rdpsnd);
- 		audio_formats_free(rdpsnd->fixed_format, 1);
- 		free(rdpsnd->subsystem);
-@@ -1604,14 +1610,13 @@ static UINT rdpsnd_on_close(IWTSVirtualChannelCallback* pChannelCallback)
- 		IFCALL(rdpsnd->device->Close, rdpsnd->device);
- 
- 	cleanup_internals(rdpsnd);
--
-+	free_internals(rdpsnd);
- 	if (rdpsnd->device)
- 	{
- 		IFCALL(rdpsnd->device->Free, rdpsnd->device);
- 		rdpsnd->device = NULL;
- 	}
- 
--	free_internals(rdpsnd);
- 	free(pChannelCallback);
- 	return CHANNEL_RC_OK;
- }
--- 
-2.53.0
-

SOURCES/channels-ainput-lock-context-when-updating-listener.patch

@@ -1,132 +0,0 @@
-From 6bf4e2558861e06fd68ef8036796ff475a1c23fa Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Fri, 13 Mar 2026 15:24:09 +0100
-Subject: [PATCH] [channels,ainput] lock context when updating listener
-
-Backport of commit d9ca272dce7a776ab475e9b1a8e8c3d2968c8486.
-
-Made-with: Cursor
----
- channels/ainput/client/ainput_main.c | 38 ++++++++++++++++++++--------
- 1 file changed, 27 insertions(+), 11 deletions(-)
-
-diff --git a/channels/ainput/client/ainput_main.c b/channels/ainput/client/ainput_main.c
-index d8eb8ec59..ff901d2a0 100644
---- a/channels/ainput/client/ainput_main.c
-+++ b/channels/ainput/client/ainput_main.c
-@@ -28,6 +28,7 @@
- #include <winpr/crt.h>
- #include <winpr/assert.h>
- #include <winpr/stream.h>
-+#include <winpr/synch.h>
- #include <winpr/sysinfo.h>
- 
- #include "ainput_main.h"
-@@ -69,6 +70,7 @@ struct AINPUT_PLUGIN_
- 	UINT32 MajorVersion;
- 	UINT32 MinorVersion;
- 	BOOL initialized;
-+	CRITICAL_SECTION lock;
- };
- 
- /**
-@@ -109,10 +111,7 @@ static UINT ainput_on_data_received(IWTSVirtualChannelCallback* pChannelCallback
- 
- static UINT ainput_send_input_event(AInputClientContext* context, UINT64 flags, INT32 x, INT32 y)
- {
--	AINPUT_PLUGIN* ainput;
--	AINPUT_CHANNEL_CALLBACK* callback;
- 	BYTE buffer[32] = { 0 };
--	UINT64 time;
- 	wStream sbuffer = { 0 };
- 	wStream* s = &sbuffer;
- 
-@@ -121,8 +120,8 @@ static UINT ainput_send_input_event(AInputClientContext* context, UINT64 flags,
- 	WINPR_ASSERT(s);
- 	WINPR_ASSERT(context);
- 
--	time = GetTickCount64();
--	ainput = (AINPUT_PLUGIN*)context->handle;
-+	const UINT64 time = GetTickCount64();
-+	AINPUT_PLUGIN* ainput = (AINPUT_PLUGIN*)context->handle;
- 	WINPR_ASSERT(ainput);
- 	WINPR_ASSERT(ainput->listener_callback);
- 
-@@ -132,8 +131,6 @@ static UINT ainput_send_input_event(AInputClientContext* context, UINT64 flags,
- 		          ainput->MajorVersion, ainput->MinorVersion);
- 		return CHANNEL_RC_UNSUPPORTED_VERSION;
- 	}
--	callback = ainput->listener_callback->channel_callback;
--	WINPR_ASSERT(callback);
- 
- 	{
- 		char buffer[128] = { 0 };
-@@ -152,10 +149,15 @@ static UINT ainput_send_input_event(AInputClientContext* context, UINT64 flags,
- 	Stream_SealLength(s);
- 
- 	/* ainput back what we have received. AINPUT does not have any message IDs. */
-+	EnterCriticalSection(&ainput->lock);
-+	AINPUT_CHANNEL_CALLBACK* callback = ainput->listener_callback->channel_callback;
-+	WINPR_ASSERT(callback);
- 	WINPR_ASSERT(callback->channel);
- 	WINPR_ASSERT(callback->channel->Write);
--	return callback->channel->Write(callback->channel, (ULONG)Stream_Length(s), Stream_Buffer(s),
--	                                NULL);
-+	const UINT rc = callback->channel->Write(callback->channel, (ULONG)Stream_Length(s),
-+	                                         Stream_Buffer(s), NULL);
-+	LeaveCriticalSection(&ainput->lock);
-+	return rc;
- }
- 
- /**
-@@ -167,8 +169,16 @@ static UINT ainput_on_close(IWTSVirtualChannelCallback* pChannelCallback)
- {
- 	AINPUT_CHANNEL_CALLBACK* callback = (AINPUT_CHANNEL_CALLBACK*)pChannelCallback;
- 
--	free(callback);
-+	if (callback)
-+	{
-+		AINPUT_PLUGIN* ainput = (AINPUT_PLUGIN*)callback->plugin;
-+		WINPR_ASSERT(ainput);
- 
-+		/* Lock here to ensure that no ainput_send_input_event is in progress. */
-+		EnterCriticalSection(&ainput->lock);
-+		free(callback);
-+		LeaveCriticalSection(&ainput->lock);
-+	}
- 	return CHANNEL_RC_OK;
- }
- 
-@@ -255,6 +265,7 @@ static UINT ainput_plugin_initialize(IWTSPlugin* pPlugin, IWTSVirtualChannelMana
- static UINT ainput_plugin_terminated(IWTSPlugin* pPlugin)
- {
- 	AINPUT_PLUGIN* ainput = (AINPUT_PLUGIN*)pPlugin;
-+
- 	if (ainput && ainput->listener_callback)
- 	{
- 		IWTSVirtualChannelManager* mgr = ainput->listener_callback->channel_mgr;
-@@ -263,6 +274,7 @@ static UINT ainput_plugin_terminated(IWTSPlugin* pPlugin)
- 	}
- 	if (ainput)
- 	{
-+		DeleteCriticalSection(&ainput->lock);
- 		free(ainput->listener_callback);
- 		free(ainput->iface.pInterface);
- 	}
-@@ -306,8 +318,12 @@ UINT DVCPluginEntry(IDRDYNVC_ENTRY_POINTS* pEntryPoints)
- 
- 		context->handle = (void*)ainput;
- 		context->AInputSendInputEvent = ainput_send_input_event;
--		ainput->iface.pInterface = (void*)context;
- 
-+		InitializeCriticalSection(&ainput->lock);
-+
-+		EnterCriticalSection(&ainput->lock);
-+		ainput->iface.pInterface = (void*)context;
-+		LeaveCriticalSection(&ainput->lock);
- 		status = pEntryPoints->RegisterPlugin(pEntryPoints, AINPUT_CHANNEL_NAME, &ainput->iface);
- 	}
- 
--- 
-2.53.0
-

SOURCES/channels-audin-free-up-old-audio-formats.patch

@@ -1,27 +0,0 @@
-From cd1ffa112cfbe1b40a9fd57e299a8ea12e23df0d Mon Sep 17 00:00:00 2001
-From: akallabeth <akallabeth@posteo.net>
-Date: Sat, 10 Jan 2026 08:36:38 +0100
-Subject: [PATCH] [channels,audin] free up old audio formats
-
----
- channels/audin/client/audin_main.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/channels/audin/client/audin_main.c b/channels/audin/client/audin_main.c
-index bcaf1a646..b4c8ba580 100644
---- a/channels/audin/client/audin_main.c
-+++ b/channels/audin/client/audin_main.c
-@@ -206,6 +206,10 @@ static UINT audin_process_formats(AUDIN_PLUGIN* audin, AUDIN_CHANNEL_CALLBACK* c
- 	}
- 
- 	Stream_Seek_UINT32(s); /* cbSizeFormatsPacket */
-+
-+	audio_formats_free(callback->formats, callback->formats_count);
-+	callback->formats_count = 0;
-+
- 	callback->formats = audio_formats_new(NumFormats);
- 
- 	if (!callback->formats)
--- 
-2.53.0
-

SOURCES/channels-audin-limit-FramesPerPacket.patch

@@ -1,37 +0,0 @@
-From 97e9d90528690f6973398c9d7e4f8da52145f669 Mon Sep 17 00:00:00 2001
-From: Armin Novak <armin.novak@thincast.com>
-Date: Sun, 12 Jul 2026 17:37:48 +0200
-Subject: [PATCH] [channels,audin] limit FramesPerPacket
-
----
- channels/audin/client/audin_main.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/channels/audin/client/audin_main.c b/channels/audin/client/audin_main.c
-index 332aef9da..186e356cd 100644
---- a/channels/audin/client/audin_main.c
-+++ b/channels/audin/client/audin_main.c
-@@ -488,7 +488,6 @@ static UINT audin_process_open(AUDIN_PLUGIN* audin, AUDIN_CHANNEL_CALLBACK* cal
- 	Stream_Read_UINT32(s, initialFormat);
- 	WLog_Print(audin->log, WLOG_DEBUG, "FramesPerPacket=%" PRIu32 " initialFormat=%" PRIu32 "",
- 	           FramesPerPacket, initialFormat);
--	audin->FramesPerPacket = FramesPerPacket;
-
- 	if (initialFormat >= callback->formats_count)
- 	{
-@@ -496,6 +496,15 @@ static UINT audin_process_open(AUDIN_PLUGIN* audin, AUDIN_CHANNEL_CALLBACK* cal
- 		return ERROR_INVALID_DATA;
- 	}
-
-+	/* The RDP protocol field allows UINT32_MAX, but most backend API use INT32 as input parameter
-+	 * or do some math with it, so ensure that the value does not exceed reasonable limits */
-+	if (FramesPerPacket >= INT32_MAX)
-+	{
-+		WLog_Print(audin->log, WLOG_ERROR, "invalid frames per packet %" PRIu32, FramesPerPacket);
-+		return ERROR_INVALID_DATA;
-+	}
-+
-+	audin->FramesPerPacket = FramesPerPacket;
- 	audin->format = &callback->formats[initialFormat];
-
- 	if (!audin_open_device(audin, callback))

SOURCES/channels-audin-reset-audin-format.patch

@@ -1,33 +0,0 @@
-From fa33edf53a2087c106b2801745bdff0f4a589425 Mon Sep 17 00:00:00 2001
-From: akallabeth <akallabeth@posteo.net>
-Date: Mon, 26 Jan 2026 10:20:23 +0100
-Subject: [PATCH] [channels,audin] reset audin->format
-
-Whenever the underlying structure changes reset the pointer to NULL
----
- channels/audin/client/audin_main.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/channels/audin/client/audin_main.c b/channels/audin/client/audin_main.c
-index 5ffe09127..332aef9da 100644
---- a/channels/audin/client/audin_main.c
-+++ b/channels/audin/client/audin_main.c
-@@ -220,6 +220,7 @@ static UINT audin_process_formats(AUDIN_PLUGIN* audin, AUDIN_CHANNEL_CALLBACK* c
- 
- 	Stream_Seek_UINT32(s); /* cbSizeFormatsPacket */
- 
-+	audin->format = NULL;
- 	audio_formats_free(callback->formats, callback->formats_count);
- 	callback->formats_count = 0;
- 
-@@ -297,6 +298,7 @@ out:
- 
- 	if (error != CHANNEL_RC_OK)
- 	{
-+		audin->format = NULL;
- 		audio_formats_free(callback->formats, NumFormats);
- 		callback->formats = NULL;
- 	}
--- 
-2.53.0
-

SOURCES/channels-drdynvc-reset-channel_callback-before-close.patch

@@ -1,34 +0,0 @@
-From 7865a2832ebdfd04374c787c917b3ea7f078ba2c Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Wed, 11 Mar 2026 16:55:44 +0100
-Subject: [PATCH] [channels,drdynvc] reset channel_callback before close
-
-Backport of commit e02e052f6692550e539d10f99de9c35a23492db2.
-
-Made-with: Cursor
----
- channels/drdynvc/client/drdynvc_main.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/channels/drdynvc/client/drdynvc_main.c b/channels/drdynvc/client/drdynvc_main.c
-index b2005a903..0a4af7179 100644
---- a/channels/drdynvc/client/drdynvc_main.c
-+++ b/channels/drdynvc/client/drdynvc_main.c
-@@ -346,10 +346,11 @@ static void dvcman_channel_free(void* arg)
- 
- 	if (channel)
- 	{
--		if (channel->channel_callback)
-+		IWTSVirtualChannelCallback* cb = channel->channel_callback;
-+		channel->channel_callback = NULL;
-+		if (cb)
- 		{
--			IFCALL(channel->channel_callback->OnClose, channel->channel_callback);
--			channel->channel_callback = NULL;
-+			IFCALL(cb->OnClose, cb);
- 		}
- 
- 		if (channel->status == CHANNEL_RC_OK)
--- 
-2.53.0
-

SOURCES/channels-drive-fix-constant-type.patch

@@ -1,26 +0,0 @@
-From 3da319570c8a6be0a79b3306f1ed354c4a943259 Mon Sep 17 00:00:00 2001
-From: akallabeth <akallabeth@posteo.net>
-Date: Mon, 12 Jan 2026 03:44:06 +0100
-Subject: [PATCH] [channels,drive] fix constant type
-
-ensure constant is of 64bit integer type
----
- channels/drive/client/drive_main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/channels/drive/client/drive_main.c b/channels/drive/client/drive_main.c
-index 1dce5c348..13188fbc6 100644
---- a/channels/drive/client/drive_main.c
-+++ b/channels/drive/client/drive_main.c
-@@ -302,7 +302,7 @@ static UINT drive_process_irp_read(DRIVE_DEVICE* drive, IRP* irp)
- 		Length = 0;
- 	}
- 
--	if (!Stream_EnsureRemainingCapacity(irp->output, Length + 4))
-+	if (!Stream_EnsureRemainingCapacity(irp->output, 4ull + Length))
- 	{
- 		WLog_ERR(TAG, "Stream_EnsureRemainingCapacity failed!");
- 		return ERROR_INTERNAL_ERROR;
--- 
-2.53.0
-

SOURCES/channels-rdpsnd-terminate-thread-before-free.patch

@@ -1,73 +0,0 @@
-From c9f2b4222cf51a259b77ed4e83c45f6a08884cb8 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Fri, 13 Mar 2026 15:46:17 +0100
-Subject: [PATCH] [channels,rdpsnd] terminate thread before free
-
-Backport of commit 622bb7b4402491ca003f47472d0e478132673696.
-
-Made-with: Cursor
----
- channels/rdpsnd/client/rdpsnd_main.c | 28 ++++++++++++++++++++--------
- 1 file changed, 20 insertions(+), 8 deletions(-)
-
-diff --git a/channels/rdpsnd/client/rdpsnd_main.c b/channels/rdpsnd/client/rdpsnd_main.c
-index 3de4cbc66..c7660a857 100644
---- a/channels/rdpsnd/client/rdpsnd_main.c
-+++ b/channels/rdpsnd/client/rdpsnd_main.c
-@@ -36,6 +36,7 @@
- #include <string.h>
- #include <errno.h>
- 
-+#include <winpr/assert.h>
- #include <winpr/crt.h>
- #include <winpr/wlog.h>
- #include <winpr/stream.h>
-@@ -1244,11 +1245,29 @@ fail:
- 	return CHANNEL_RC_NO_MEMORY;
- }
- 
-+static void rdpsnd_terminate_thread(rdpsndPlugin* rdpsnd)
-+{
-+	WINPR_ASSERT(rdpsnd);
-+	if (rdpsnd->queue)
-+		MessageQueue_PostQuit(rdpsnd->queue, 0);
-+
-+	if (rdpsnd->thread)
-+	{
-+		(void)WaitForSingleObject(rdpsnd->thread, INFINITE);
-+		(void)CloseHandle(rdpsnd->thread);
-+	}
-+
-+	MessageQueue_Free(rdpsnd->queue);
-+	rdpsnd->thread = NULL;
-+	rdpsnd->queue = NULL;
-+}
-+
- static void cleanup_internals(rdpsndPlugin* rdpsnd)
- {
- 	if (!rdpsnd)
- 		return;
- 
-+	rdpsnd_terminate_thread(rdpsnd);
- 	if (rdpsnd->pool)
- 		StreamPool_Return(rdpsnd->pool, rdpsnd->data_in);
- 
-@@ -1396,14 +1415,7 @@ void rdpsnd_virtual_channel_event_terminated(rdpsndPlugin* rdpsnd)
- {
- 	if (rdpsnd)
- 	{
--		if (rdpsnd->queue)
--			MessageQueue_PostQuit(rdpsnd->queue, 0);
--		if (rdpsnd->thread)
--		{
--			WaitForSingleObject(rdpsnd->thread, INFINITE);
--			CloseHandle(rdpsnd->thread);
--		}
--		MessageQueue_Free(rdpsnd->queue);
-+		rdpsnd_terminate_thread(rdpsnd);
- 
- 		free_internals(rdpsnd);
- 		audio_formats_free(rdpsnd->fixed_format, 1);
--- 
-2.53.0
-

SOURCES/channels-serial-explicitly-lock-serial-IrpThreads.patch

@@ -1,55 +0,0 @@
-From c0283812c918c7738facafac52cf51d916536138 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 10 Mar 2026 08:47:57 +0100
-Subject: [PATCH] [channels,serial] explicitly lock serial->IrpThreads
-
-Backport of commit 675c20f08f32ca5ec06297108bdf30147d6e2cd9.
-
-Made-with: Cursor
----
- channels/serial/client/serial_main.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/channels/serial/client/serial_main.c b/channels/serial/client/serial_main.c
-index d76d725f1..c8a27c46c 100644
---- a/channels/serial/client/serial_main.c
-+++ b/channels/serial/client/serial_main.c
-@@ -597,7 +597,10 @@ static void create_irp_thread(SERIAL_DEVICE* serial, IRP* irp)
- 	 * observed with FreeRDP).
- 	 */
- 	key = irp->CompletionId;
-+
-+	ListDictionary_Lock(serial->IrpThreads);
- 	previousIrpThread = ListDictionary_GetItemValue(serial->IrpThreads, (void*)key);
-+	ListDictionary_Unlock(serial->IrpThreads);
- 
- 	if (previousIrpThread)
- 	{
-@@ -678,6 +681,7 @@ static void terminate_pending_irp_threads(SERIAL_DEVICE* serial)
- {
- 	ULONG_PTR* ids;
- 	int i, nbIds;
-+	ListDictionary_Lock(serial->IrpThreads);
- 	nbIds = ListDictionary_GetKeys(serial->IrpThreads, &ids);
- 	WLog_Print(serial->log, WLOG_DEBUG, "Terminating %d IRP thread(s)", nbIds);
- 
-@@ -699,6 +703,7 @@ static void terminate_pending_irp_threads(SERIAL_DEVICE* serial)
- 	}
- 
- 	ListDictionary_Clear(serial->IrpThreads);
-+	ListDictionary_Unlock(serial->IrpThreads);
- 	free(ids);
- }
- 
-@@ -932,7 +937,7 @@ UINT DeviceServiceEntry(PDEVICE_SERVICE_ENTRY_POINTS pEntryPoints)
- 		}
- 
- 		/* IrpThreads content only modified by create_irp_thread() */
--		serial->IrpThreads = ListDictionary_New(TRUE);
-+		serial->IrpThreads = ListDictionary_New(FALSE);
- 
- 		if (!serial->IrpThreads)
- 		{
--- 
-2.53.0
-

SOURCES/channels-serial-lock-list-dictionary.patch

@@ -1,89 +0,0 @@
-From 7cf742159bd2675366c7187c4bc51018b548d228 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 10 Mar 2026 08:47:45 +0100
-Subject: [PATCH] [channels,serial] lock list dictionary
-
-Backport of commit b35aa3614d32bff3fc1272cd7c4617f711fca1a4.
-
-Made-with: Cursor
----
- channels/serial/client/serial_main.c | 35 ++++++++++++++++------------
- 1 file changed, 20 insertions(+), 15 deletions(-)
-
-diff --git a/channels/serial/client/serial_main.c b/channels/serial/client/serial_main.c
-index afe67b4d3..d76d725f1 100644
---- a/channels/serial/client/serial_main.c
-+++ b/channels/serial/client/serial_main.c
-@@ -540,6 +540,7 @@ static void create_irp_thread(SERIAL_DEVICE* serial, IRP* irp)
- 		HANDLE irpThread;
- 		ULONG_PTR* ids;
- 		int i, nbIds;
-+		ListDictionary_Lock(serial->IrpThreads);
- 		nbIds = ListDictionary_GetKeys(serial->IrpThreads, &ids);
- 
- 		for (i = 0; i < nbIds; i++)
-@@ -581,6 +582,7 @@ static void create_irp_thread(SERIAL_DEVICE* serial, IRP* irp)
- 		}
- 
- 		free(ids);
-+		ListDictionary_Unlock(serial->IrpThreads);
- 	}
- 
- 	LeaveCriticalSection(&serial->TerminatingIrpThreadsLock);
-@@ -621,19 +623,6 @@ static void create_irp_thread(SERIAL_DEVICE* serial, IRP* irp)
- 		return;
- 	}
- 
--	if (ListDictionary_Count(serial->IrpThreads) >= MAX_IRP_THREADS)
--	{
--		WLog_Print(serial->log, WLOG_WARN,
--		           "Number of IRP threads threshold reached: %d, keep on anyway",
--		           ListDictionary_Count(serial->IrpThreads));
--		assert(FALSE); /* unimplemented */
--		               /* TODO: MAX_IRP_THREADS has been thought to avoid a
--		                * flooding of pending requests. Use
--		                * WaitForMultipleObjects() when available in winpr
--		                * for threads.
--		                */
--	}
--
- 	/* error_handle to be used ... */
- 	data = (IRP_THREAD_DATA*)calloc(1, sizeof(IRP_THREAD_DATA));
- 
-@@ -656,7 +645,23 @@ static void create_irp_thread(SERIAL_DEVICE* serial, IRP* irp)
- 
- 	key = irp->CompletionId;
- 
--	if (!ListDictionary_Add(serial->IrpThreads, (void*)key, irpThread))
-+	ListDictionary_Lock(serial->IrpThreads);
-+	if (ListDictionary_Count(serial->IrpThreads) >= MAX_IRP_THREADS)
-+	{
-+		WLog_Print(serial->log, WLOG_WARN,
-+		           "Number of IRP threads threshold reached: %d, keep on anyway",
-+		           ListDictionary_Count(serial->IrpThreads));
-+		assert(FALSE); /* unimplemented */
-+		               /* TODO: MAX_IRP_THREADS has been thought to avoid a
-+		                * flooding of pending requests. Use
-+		                * WaitForMultipleObjects() when available in winpr
-+		                * for threads.
-+		                */
-+	}
-+	const BOOL added = ListDictionary_Add(serial->IrpThreads, (void*)key, irpThread);
-+	ListDictionary_Unlock(serial->IrpThreads);
-+
-+	if (!added)
- 	{
- 		WLog_ERR(TAG, "ListDictionary_Add failed!");
- 		goto error_handle;
-@@ -927,7 +932,7 @@ UINT DeviceServiceEntry(PDEVICE_SERVICE_ENTRY_POINTS pEntryPoints)
- 		}
- 
- 		/* IrpThreads content only modified by create_irp_thread() */
--		serial->IrpThreads = ListDictionary_New(FALSE);
-+		serial->IrpThreads = ListDictionary_New(TRUE);
- 
- 		if (!serial->IrpThreads)
- 		{
--- 
-2.53.0
-

SOURCES/channels-urbdrc-cancel-all-usb-transfers-on-channel-.patch

@@ -1,24 +0,0 @@
-From 414f701464929c217f2509bcbd6d2c1f00f7ed73 Mon Sep 17 00:00:00 2001
-From: akallabeth <akallabeth@posteo.net>
-Date: Mon, 26 Jan 2026 11:07:25 +0100
-Subject: [PATCH] [channels,urbdrc] cancel all usb transfers on channel close
-
----
- channels/urbdrc/client/libusb/libusb_udevice.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c
-index 5341248ec..9e2d3ec5a 100644
---- a/channels/urbdrc/client/libusb/libusb_udevice.c
-+++ b/channels/urbdrc/client/libusb/libusb_udevice.c
-@@ -1165,6 +1165,7 @@ static void libusb_udev_mark_channel_closed(IUDEVICE* idev)
- 		const uint8_t devNr = idev->get_dev_number(idev);
- 
- 		pdev->status |= URBDRC_DEVICE_CHANNEL_CLOSED;
-+		pdev->iface.cancel_all_transfer_request(&pdev->iface);
- 		urbdrc->udevman->unregister_udevice(urbdrc->udevman, busNr, devNr);
- 	}
- }
--- 
-2.53.0
-

SOURCES/channels-urbdrc-check-interface-indices-before-use.patch

@@ -1,70 +0,0 @@
-From f8453bda5069314d271973eff69dc2e04f6df980 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 17 Feb 2026 13:01:37 +0100
-Subject: [PATCH] [channels,urbdrc] check interface indices before use
-
-Backport of commit 7b7e6de8fe427a2f01d331056774aec69710590b (functional changes only).
-
-Co-authored-by: Cursor <cursoragent@cursor.com>
----
- .../urbdrc/client/libusb/libusb_udevice.c     | 25 +++++++++++++++++++
- channels/urbdrc/common/msusb.c                |  2 ++
- 2 files changed, 27 insertions(+)
-
-diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c
-index ef87f195f..b2d80243b 100644
---- a/channels/urbdrc/client/libusb/libusb_udevice.c
-+++ b/channels/urbdrc/client/libusb/libusb_udevice.c
-@@ -597,11 +597,36 @@ libusb_udev_complete_msconfig_setup(IUDEVICE* idev, MSUSB_CONFIG_DESCRIPTOR* MsC
- 		           "Select Configuration: Libusb NumberInterfaces(%" PRIu8 ") is different "
- 		           "with MsConfig NumberInterfaces(%" PRIu32 ")",
- 		           LibusbConfig->bNumInterfaces, MsConfig->NumInterfaces);
-+		return NULL;
- 	}
- 
- 	/* replace MsPipes for libusb */
- 	MsInterfaces = MsConfig->MsInterfaces;
- 
-+	/* check interface indices before use */
-+	for (inum = 0; inum < MsConfig->NumInterfaces; inum++)
-+	{
-+		MsInterface = MsInterfaces[inum];
-+		if (MsInterface->InterfaceNumber >= MsConfig->NumInterfaces)
-+		{
-+			WLog_Print(urbdrc->log, WLOG_ERROR,
-+			           "MSUSB_CONFIG_DESCRIPTOR::NumInterfaces (%" PRIu32
-+			           " <= MSUSB_INTERFACE_DESCRIPTOR::InterfaceNumber( %" PRIu8 ")",
-+			           MsConfig->NumInterfaces, MsInterface->InterfaceNumber);
-+			return NULL;
-+		}
-+
-+		LibusbInterface = &LibusbConfig->interface[MsInterface->InterfaceNumber];
-+		if (MsInterface->AlternateSetting >= LibusbInterface->num_altsetting)
-+		{
-+			WLog_Print(urbdrc->log, WLOG_ERROR,
-+			           "LIBUSB_INTERFACE::num_altsetting (%" PRId32
-+			           " <= MSUSB_INTERFACE_DESCRIPTOR::AlternateSetting( %" PRIu8 ")",
-+			           LibusbInterface->num_altsetting, MsInterface->AlternateSetting);
-+			return NULL;
-+		}
-+	}
-+
- 	for (inum = 0; inum < MsConfig->NumInterfaces; inum++)
- 	{
- 		MsInterface = MsInterfaces[inum];
-diff --git a/channels/urbdrc/common/msusb.c b/channels/urbdrc/common/msusb.c
-index bb517ce5d..113b7c96b 100644
---- a/channels/urbdrc/common/msusb.c
-+++ b/channels/urbdrc/common/msusb.c
-@@ -139,6 +139,8 @@ BOOL msusb_msinterface_replace(MSUSB_CONFIG_DESCRIPTOR* MsConfig, BYTE Interface
- {
- 	if (!MsConfig || !MsConfig->MsInterfaces)
- 		return FALSE;
-+	if (MsConfig->NumInterfaces <= InterfaceNumber)
-+		return FALSE;
- 
- 	msusb_msinterface_free(MsConfig->MsInterfaces[InterfaceNumber]);
- 	MsConfig->MsInterfaces[InterfaceNumber] = NewMsInterface;
--- 
-2.52.0
-

SOURCES/channels-urbdrc-do-not-free-MsConfig-on-failure.patch

@@ -1,31 +0,0 @@
-From aaad4718d80b0354fd807d680b12390075fe4fa0 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Wed, 11 Mar 2026 12:27:47 +0100
-Subject: [PATCH] [channels,urbdrc] do not free MsConfig on failure
-
-Backport of commit d676518809c319eec15911c705c13536036af2ae.
-
-Made-with: Cursor
----
- channels/urbdrc/client/data_transfer.c | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
-
-diff --git a/channels/urbdrc/client/data_transfer.c b/channels/urbdrc/client/data_transfer.c
-index ed6ccf32d..c547d52d7 100644
---- a/channels/urbdrc/client/data_transfer.c
-+++ b/channels/urbdrc/client/data_transfer.c
-@@ -570,10 +570,8 @@ static UINT urb_select_interface(IUDEVICE* pdev, URBDRC_CHANNEL_CALLBACK* callba
- 	MsConfig = pdev->get_MsConfig(pdev);
- 	InterfaceNumber = MsInterface->InterfaceNumber;
- 	if (!msusb_msinterface_replace(MsConfig, InterfaceNumber, MsInterface))
--	{
--		msusb_msconfig_free(MsConfig);
- 		return ERROR_BAD_CONFIGURATION;
--	}
-+
- 	/* complete configuration setup */
- 	if (!pdev->complete_msconfig_setup(pdev, MsConfig))
- 	{
--- 
-2.53.0
-

SOURCES/channels-urbdrc-ensure-InterfaceNumber-is-within-ran.patch

@@ -1,45 +0,0 @@
-From ea49391b3463b7df18eb9c358cdec04edf9c4001 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 12 Mar 2026 11:03:20 +0100
-Subject: [PATCH] [channels,urbdrc] ensure InterfaceNumber is within range
-
-Backport of commit 2d563a50be17c1b407ca448b1321378c0726dd31.
-
-Made-with: Cursor
----
- channels/urbdrc/client/libusb/libusb_udevice.c | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c
-index b2d80243b..ae8bbb4c5 100644
---- a/channels/urbdrc/client/libusb/libusb_udevice.c
-+++ b/channels/urbdrc/client/libusb/libusb_udevice.c
-@@ -528,19 +528,19 @@ static int libusb_udev_select_interface(IUDEVICE* idev, BYTE InterfaceNumber, BY
- {
- 	int error = 0, diff = 0;
- 	UDEVICE* pdev = (UDEVICE*)idev;
--	URBDRC_PLUGIN* urbdrc;
--	MSUSB_CONFIG_DESCRIPTOR* MsConfig;
--	MSUSB_INTERFACE_DESCRIPTOR** MsInterfaces;
- 
- 	if (!pdev || !pdev->urbdrc)
- 		return -1;
- 
--	urbdrc = pdev->urbdrc;
--	MsConfig = pdev->MsConfig;
-+	URBDRC_PLUGIN* urbdrc = pdev->urbdrc;
-+	MSUSB_CONFIG_DESCRIPTOR* MsConfig = pdev->MsConfig;
- 
- 	if (MsConfig)
- 	{
--		MsInterfaces = MsConfig->MsInterfaces;
-+		if (InterfaceNumber >= MsConfig->NumInterfaces)
-+			return -2;
-+
-+		MSUSB_INTERFACE_DESCRIPTOR** MsInterfaces = MsConfig->MsInterfaces;
- 		if (MsInterfaces)
- 		{
- 			WLog_Print(urbdrc->log, WLOG_INFO,
--- 
-2.53.0
-

SOURCES/channels-video-fix-wrong-cast.patch

@@ -1,37 +0,0 @@
-From 970ad2311e69589004d6a84961aa9d1e3b33c085 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 26 Mar 2026 15:57:34 +0100
-Subject: [PATCH] [channels,video] fix wrong cast
-
-Backport of commit e01cd85c8003a245ef9778f0eda4b9235514c201.
-
-Made-with: Cursor
----
- channels/video/client/video_main.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/channels/video/client/video_main.c b/channels/video/client/video_main.c
-index 641231b1d..0af78140e 100644
---- a/channels/video/client/video_main.c
-+++ b/channels/video/client/video_main.c
-@@ -959,7 +959,7 @@ static UINT video_control_on_close(IWTSVirtualChannelCallback* pChannelCallback)
- {
- 	if (pChannelCallback)
- 	{
--		VIDEO_LISTENER_CALLBACK* listener_callback = (VIDEO_LISTENER_CALLBACK*)pChannelCallback;
-+		VIDEO_CHANNEL_CALLBACK* listener_callback = (VIDEO_CHANNEL_CALLBACK*)pChannelCallback;
- 		VIDEO_PLUGIN* video = (VIDEO_PLUGIN*)listener_callback->plugin;
- 		if (video && video->control_callback)
- 		{
-@@ -974,7 +974,7 @@ static UINT video_data_on_close(IWTSVirtualChannelCallback* pChannelCallback)
- {
- 	if (pChannelCallback)
- 	{
--		VIDEO_LISTENER_CALLBACK* listener_callback = (VIDEO_LISTENER_CALLBACK*)pChannelCallback;
-+		VIDEO_CHANNEL_CALLBACK* listener_callback = (VIDEO_CHANNEL_CALLBACK*)pChannelCallback;
- 		VIDEO_PLUGIN* video = (VIDEO_PLUGIN*)listener_callback->plugin;
- 		if (video && video->data_callback)
- 		{
--- 
-2.53.0
-

SOURCES/channels-video-unify-error-handling.patch

@@ -1,121 +0,0 @@
-From 2cfdc16faed93a8d5d1ec391788547409df986de Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 26 Mar 2026 15:57:28 +0100
-Subject: [PATCH] [channels,video] unify error handling
-
-Partial backport of commit 635ae3c8193256db01774fab5ff11bcae57aed6b.
-
-Made-with: Cursor
----
- channels/video/client/video_main.c | 45 ++++++++++++++++++++++--------
- 1 file changed, 34 insertions(+), 11 deletions(-)
-
-diff --git a/channels/video/client/video_main.c b/channels/video/client/video_main.c
-index a8031fc86..641231b1d 100644
---- a/channels/video/client/video_main.c
-+++ b/channels/video/client/video_main.c
-@@ -25,7 +25,9 @@
- #include <stdlib.h>
- #include <string.h>
- 
-+#include <winpr/assert.h>
- #include <winpr/crt.h>
-+#include <winpr/error.h>
- #include <winpr/synch.h>
- #include <winpr/print.h>
- #include <winpr/stream.h>
-@@ -351,14 +353,24 @@ static void VideoClientContextPriv_free(VideoClientContextPriv* priv)
- 	free(priv);
- }
- 
-+static UINT video_channel_write(VIDEO_PLUGIN* video, const BYTE* data, UINT32 length)
-+{
-+	WINPR_ASSERT(video);
-+
-+	if (!video->control_callback || !video->control_callback->channel_callback)
-+		return ERROR_BAD_CONFIGURATION;
-+	IWTSVirtualChannel* channel = video->control_callback->channel_callback->channel;
-+	if (!channel || !channel->Write)
-+		return ERROR_BAD_CONFIGURATION;
-+	return channel->Write(channel, length, data, NULL);
-+}
-+
- static UINT video_control_send_presentation_response(VideoClientContext* context,
-                                                      TSMM_PRESENTATION_RESPONSE* resp)
- {
- 	BYTE buf[12];
- 	wStream* s;
- 	VIDEO_PLUGIN* video = (VIDEO_PLUGIN*)context->handle;
--	IWTSVirtualChannel* channel;
--	UINT ret;
- 
- 	s = Stream_New(buf, 12);
- 	if (!s)
-@@ -370,11 +382,9 @@ static UINT video_control_send_presentation_response(VideoClientContext* context
- 	Stream_Zero(s, 3);
- 	Stream_SealLength(s);
- 
--	channel = video->control_callback->channel_callback->channel;
--	ret = channel->Write(channel, 12, buf, NULL);
- 	Stream_Free(s, FALSE);
- 
--	return ret;
-+	return video_channel_write(video, buf, sizeof(buf));
- }
- 
- static BOOL video_onMappedGeometryUpdate(MAPPED_GEOMETRY* geometry)
-@@ -592,8 +602,6 @@ static UINT video_control_send_client_notification(VideoClientContext* context,
- 	BYTE buf[100];
- 	wStream* s;
- 	VIDEO_PLUGIN* video = (VIDEO_PLUGIN*)context->handle;
--	IWTSVirtualChannel* channel;
--	UINT ret;
- 	UINT32 cbSize;
- 
- 	s = Stream_New(buf, 30);
-@@ -627,10 +635,7 @@ static UINT video_control_send_client_notification(VideoClientContext* context,
- 	Stream_Write_UINT32(s, cbSize);
- 	Stream_Free(s, FALSE);
- 
--	channel = video->control_callback->channel_callback->channel;
--	ret = channel->Write(channel, cbSize, buf, NULL);
--
--	return ret;
-+	return video_channel_write(video, buf, cbSize);
- }
- 
- static void video_timer(VideoClientContext* video, UINT64 now)
-@@ -952,12 +957,30 @@ static UINT video_data_on_data_received(IWTSVirtualChannelCallback* pChannelCall
-  */
- static UINT video_control_on_close(IWTSVirtualChannelCallback* pChannelCallback)
- {
-+	if (pChannelCallback)
-+	{
-+		VIDEO_LISTENER_CALLBACK* listener_callback = (VIDEO_LISTENER_CALLBACK*)pChannelCallback;
-+		VIDEO_PLUGIN* video = (VIDEO_PLUGIN*)listener_callback->plugin;
-+		if (video && video->control_callback)
-+		{
-+			video->control_callback->channel_callback = NULL;
-+		}
-+	}
- 	free(pChannelCallback);
- 	return CHANNEL_RC_OK;
- }
- 
- static UINT video_data_on_close(IWTSVirtualChannelCallback* pChannelCallback)
- {
-+	if (pChannelCallback)
-+	{
-+		VIDEO_LISTENER_CALLBACK* listener_callback = (VIDEO_LISTENER_CALLBACK*)pChannelCallback;
-+		VIDEO_PLUGIN* video = (VIDEO_PLUGIN*)listener_callback->plugin;
-+		if (video && video->data_callback)
-+		{
-+			video->data_callback->channel_callback = NULL;
-+		}
-+	}
- 	free(pChannelCallback);
- 	return CHANNEL_RC_OK;
- }
--- 
-2.53.0
-

SOURCES/client-common-deactivate-cli-parsing-in-rdp-files.patch

@@ -1,65 +0,0 @@
-From 20a3489c23763f94d31dcf8fd7ed880e07cbb2e8 Mon Sep 17 00:00:00 2001
-From: Armin Novak <armin.novak@thincast.com>
-Date: Thu, 2 Jul 2026 10:21:54 +0200
-Subject: [PATCH] [client,common] deactivate cli parsing in RDP files
-
-This feature was uncodumented and might have unintended side effects.
-Deactivate it by default and (for the time being) keep an option to
-enable it at compile time.
----
- client/common/CMakeLists.txt | 5 +++++
- client/common/file.c         | 4 ++++
- 2 files changed, 9 insertions(+)
-
-diff --git a/client/common/CMakeLists.txt b/client/common/CMakeLists.txt
-index b465a6311..7bc7cf083 100644
---- a/client/common/CMakeLists.txt
-+++ b/client/common/CMakeLists.txt
-@@ -85,6 +85,11 @@ if (WITH_DEBUG_SYMBOLS AND MSVC AND BUILD_SHARED_LIBS)
- 	install(FILES ${CMAKE_PDB_BINARY_DIR}/${OUTPUT_FILENAME}.pdb DESTINATION ${CMAKE_INSTALL_LIBDIR} COMPONENT symbols)
- endif()
-
-+option(WITH_EMBEDDED_CLI_IN_RDP_FILES "[dangrous] allow embedded cli arguments in rdp files" OFF)
-+if(WITH_EMBEDDED_CLI_IN_RDP_FILES)
-+  add_compile_definitions(WITH_EMBEDDED_CLI_IN_RDP_FILES)
-+endif()
-+
- set_property(TARGET ${MODULE_NAME} PROPERTY FOLDER "Client/Common")
-
- if(BUILD_TESTING)
-diff --git a/client/common/file.c b/client/common/file.c
-index b56fe6f06..bff94bad0 100644
---- a/client/common/file.c
-+++ b/client/common/file.c
-@@ -26,6 +26,7 @@
-
- #include <winpr/file.h>
-
-+
- #include <freerdp/client/file.h>
- #include <freerdp/client/cmdline.h>
-
-@@ -661,6 +662,7 @@ static BOOL trim_strings(rdpFile* file)
- 		return FALSE;
- 	if (!trim(&file->KdcProxyName))
- 		return FALSE;
-+
- 	return TRUE;
- }
-
-@@ -721,6 +723,7 @@ BOOL freerdp_client_parse_rdp_file_buffer_ex(rdpFile* file, const BYTE* buffer,
- 			if (freerdp_client_parse_rdp_file_add_line(file, line, index) == -1)
- 				goto fail;
-
-+#if defined(WITH_EMBEDDED_CLI_IN_RDP_FILES)
- 			if (beg[0] == '/')
- 			{
- 				if (!freerdp_client_parse_rdp_file_option(file, line, index))
-@@ -728,6 +731,7 @@ BOOL freerdp_client_parse_rdp_file_buffer_ex(rdpFile* file, const BYTE* buffer,
-
- 				goto next_line; /* FreeRDP option */
- 			}
-+#endif
-
- 			d1 = strchr(line, ':');
-

SOURCES/client-x11-fix-deadlock-on-output-expose.patch

@@ -1,170 +0,0 @@
-From a25a6b8c53602d2023dd0ad685000dc006179e94 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 27 Apr 2026 20:12:42 +0000
-Subject: [PATCH] [client,x11] fix deadlock on output expose
-
-Defer screen update from xf_event_Expose to after X11 lock is released,
-preventing a deadlock between X11 lock and railWindows lock.
-
-Backport of commit a278ff74117444c635c50ffa5084ecf517171f5a.
-
-Adjusted hunk offsets for 2.11.7.
-
-Made-with: Cursor
----
- client/X11/xf_client.c |  3 ++
- client/X11/xf_event.c  | 77 ++++++++++++++++++++++++++++--------------
- client/X11/xf_event.h  |  2 ++
- client/X11/xfreerdp.h  |  4 +++
- 4 files changed, 60 insertions(+), 26 deletions(-)
-
-diff --git a/client/X11/xf_client.c b/client/X11/xf_client.c
-index bd3eb0d..f14cb55 100644
---- a/client/X11/xf_client.c
-+++ b/client/X11/xf_client.c
-@@ -516,6 +516,9 @@ static BOOL xf_process_x_events(freerdp* instance)
- 		xf_unlock_x11(xfc);
- 		if (!status)
- 			break;
-+		status = xf_event_update_screen(instance);
-+		if (!status)
-+			break;
- 	}
- 
- 	return status;
-diff --git a/client/X11/xf_event.c b/client/X11/xf_event.c
-index e1421ad..524e5e3 100644
---- a/client/X11/xf_event.c
-+++ b/client/X11/xf_event.c
-@@ -324,45 +324,34 @@ void xf_event_adjust_coordinates(xfContext* xfc, int* x, int* y)
- }
- static BOOL xf_event_Expose(xfContext* xfc, const XExposeEvent* event, BOOL app)
- {
--	int x, y;
--	int w, h;
-+	WINPR_ASSERT(xfc);
-+	WINPR_ASSERT(event);
-+
- 	rdpSettings* settings = xfc->context.settings;
-+	WINPR_ASSERT(settings);
- 
- 	if (!app && (settings->SmartSizing || settings->MultiTouchGestures))
- 	{
--		x = 0;
--		y = 0;
--		w = settings->DesktopWidth;
--		h = settings->DesktopHeight;
-+		xfc->exposedArea.x = 0;
-+		xfc->exposedArea.y = 0;
-+		xfc->exposedArea.w = settings->DesktopWidth;
-+		xfc->exposedArea.h = settings->DesktopHeight;
- 	}
- 	else
- 	{
--		x = event->x;
--		y = event->y;
--		w = event->width;
--		h = event->height;
-+		xfc->exposedArea.x = event->x;
-+		xfc->exposedArea.y = event->y;
-+		xfc->exposedArea.w = event->width;
-+		xfc->exposedArea.h = event->height;
- 	}
- 
--	if (!app)
--	{
--		if (xfc->context.gdi->gfx)
--		{
--			xf_OutputExpose(xfc, x, y, w, h);
--			return TRUE;
--		}
--		xf_draw_screen(xfc, x, y, w, h);
--	}
--	else
--	{
--		xfAppWindow* appWindow = xf_AppWindowFromX11Window(xfc, event->window);
--		if (appWindow)
--			xf_UpdateWindowArea(xfc, appWindow, x, y, w, h);
--		xf_rail_return_window(appWindow, FALSE);
--	}
-+	xfc->exposedWindow = event->window;
-+	xfc->exposeRequested = TRUE;
- 
- 	return TRUE;
- }
- 
-+
- static BOOL xf_event_VisibilityNotify(xfContext* xfc, const XVisibilityEvent* event, BOOL app)
- {
- 	WINPR_UNUSED(app);
-@@ -1180,3 +1169,39 @@ BOOL xf_event_process(freerdp* instance, const XEvent* event)
- 	XSync(xfc->display, FALSE);
- 	return status;
- }
-+
-+BOOL xf_event_update_screen(freerdp* instance)
-+{
-+	WINPR_ASSERT(instance);
-+
-+	xfContext* xfc = (xfContext*)instance->context;
-+	WINPR_ASSERT(xfc);
-+
-+	rdpSettings* settings = xfc->context.settings;
-+	WINPR_ASSERT(settings);
-+
-+	if (!xfc->exposeRequested)
-+		return TRUE;
-+	xfc->exposeRequested = FALSE;
-+
-+	if (!xfc->remote_app)
-+	{
-+		if (xfc->context.gdi->gfx)
-+		{
-+			xf_OutputExpose(xfc, xfc->exposedArea.x, xfc->exposedArea.y,
-+			                xfc->exposedArea.w, xfc->exposedArea.h);
-+			return TRUE;
-+		}
-+		xf_draw_screen(xfc, xfc->exposedArea.x, xfc->exposedArea.y, xfc->exposedArea.w,
-+		               xfc->exposedArea.h);
-+	}
-+	else
-+	{
-+		xfAppWindow* appWindow = xf_AppWindowFromX11Window(xfc, xfc->exposedWindow);
-+		if (appWindow)
-+			xf_UpdateWindowArea(xfc, appWindow, xfc->exposedArea.x, xfc->exposedArea.y,
-+			                    xfc->exposedArea.w, xfc->exposedArea.h);
-+		xf_rail_return_window(appWindow, FALSE);
-+	}
-+	return TRUE;
-+}
-diff --git a/client/X11/xf_event.h b/client/X11/xf_event.h
-index 2269d3e..e025d19 100644
---- a/client/X11/xf_event.h
-+++ b/client/X11/xf_event.h
-@@ -29,6 +29,8 @@ BOOL xf_event_action_script_init(xfContext* xfc);
- void xf_event_action_script_free(xfContext* xfc);
- 
- BOOL xf_event_process(freerdp* instance, const XEvent* event);
-+
-+BOOL xf_event_update_screen(freerdp* instance);
- void xf_event_SendClientEvent(xfContext* xfc, xfWindow* window, Atom atom, unsigned int numArgs,
-                               ...);
- 
-diff --git a/client/X11/xfreerdp.h b/client/X11/xfreerdp.h
-index 636e60a..a1a33b2 100644
---- a/client/X11/xfreerdp.h
-+++ b/client/X11/xfreerdp.h
-@@ -261,6 +261,10 @@ struct xf_context
- 	wHashTable* railWindows;
- 	xfRailIconCache* railIconCache;
- 
-+	BOOL exposeRequested;
-+	GDI_RGN exposedArea;
-+	Window exposedWindow;
-+
- 	BOOL xkbAvailable;
- 	BOOL xrenderAvailable;
- 
--- 
-2.53.0
-

SOURCES/client-x11-fix-double-free-in-case-of-invalid-pointe.patch

@@ -1,53 +0,0 @@
-From c0e85d92e45dff6c9a12e6af5be2e9ed10b4990c Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 22 Jan 2026 12:51:08 +0100
-Subject: [PATCH] [client,x11] fix double free in case of invalid pointer
-
-Backport of commit 0421b53fcb4a80c95f51342e4a2c40c68a4101d3.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
----
- client/X11/xf_graphics.c | 13 ++++++-------
- 1 file changed, 6 insertions(+), 7 deletions(-)
-
-diff --git a/client/X11/xf_graphics.c b/client/X11/xf_graphics.c
-index 5aa1fd48b..d596b23da 100644
---- a/client/X11/xf_graphics.c
-+++ b/client/X11/xf_graphics.c
-@@ -406,7 +406,6 @@ static BOOL xf_Pointer_New(rdpContext* context, rdpPointer* pointer)
- 	BOOL rc = FALSE;
- #ifdef WITH_XCURSOR
- 	UINT32 CursorFormat;
--	size_t size;
- 	xfContext* xfc = (xfContext*)context;
- 	xfPointer* xpointer = (xfPointer*)pointer;
- 
-@@ -421,19 +420,19 @@ static BOOL xf_Pointer_New(rdpContext* context, rdpPointer* pointer)
- 	xpointer->nCursors = 0;
- 	xpointer->mCursors = 0;
- 
--	size = 1ull * pointer->height * pointer->width * GetBytesPerPixel(CursorFormat);
-+	const size_t size =
-+	    1ull * pointer->height * pointer->width * GetBytesPerPixel(CursorFormat);
- 
--	if (!(xpointer->cursorPixels = (XcursorPixel*)_aligned_malloc(size, 16)))
-+	xpointer->cursorPixels = (XcursorPixel*)_aligned_malloc(size, 16);
-+	if (!xpointer->cursorPixels)
- 		goto fail;
- 
- 	if (!freerdp_image_copy_from_pointer_data(
- 	        (BYTE*)xpointer->cursorPixels, CursorFormat, 0, 0, 0, pointer->width, pointer->height,
- 	        pointer->xorMaskData, pointer->lengthXorMask, pointer->andMaskData,
- 	        pointer->lengthAndMask, pointer->xorBpp, &context->gdi->palette))
--	{
--		_aligned_free(xpointer->cursorPixels);
--		return FALSE;
--	}
-+		goto fail;
-+
- 	rc = TRUE;
- 
- #endif
--- 
-2.52.0
-

SOURCES/client-x11-fix-xf_rail_window_common-cleanup.patch

@@ -1,45 +0,0 @@
-From 562cc4b33257074d1d50535138998bc81796d447 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 27 Apr 2026 19:00:00 +0000
-Subject: [PATCH] [client,x11] fix xf_rail_window_common cleanup
-
-Backport of commit b4f0f0a18fe53aa8d47d062f91471f4e9c5e0d51.
-
-Adjusted hunk offsets for 2.11.7.
-
-Made-with: Cursor
----
- client/X11/xf_rail.c | 6 +-----
- 1 file changed, 1 insertion(+), 5 deletions(-)
-
-diff --git a/client/X11/xf_rail.c b/client/X11/xf_rail.c
-index 242c54b..4c4f47d 100644
---- a/client/X11/xf_rail.c
-+++ b/client/X11/xf_rail.c
-@@ -260,11 +260,10 @@ static void window_state_log_style(wLog* log, const WINDOW_STATE_ORDER* windowSt
- static BOOL xf_rail_window_common(rdpContext* context, const WINDOW_ORDER_INFO* orderInfo,
-                                   const WINDOW_STATE_ORDER* windowState)
- {
--	xfAppWindow* appWindow = NULL;
- 	xfContext* xfc = (xfContext*)context;
- 	UINT32 fieldFlags = orderInfo->fieldFlags;
- 	BOOL position_or_size_updated = FALSE;
--	appWindow = xf_rail_get_window(xfc, orderInfo->windowId);
-+	xfAppWindow* appWindow = xf_rail_get_window(xfc, orderInfo->windowId);
- 
- 	if (fieldFlags & WINDOW_ORDER_STATE_NEW)
- 	{
-@@ -310,10 +309,7 @@ static BOOL xf_rail_window_common(rdpContext* context, const WINDOW_ORDER_INFO*
- 		}
- 
- 		if (!appWindow->title)
--		{
--			free(appWindow);
- 			return FALSE;
--		}
- 
- 		xf_AppWindowInit(xfc, appWindow);
- 	}
--- 
-2.53.0
-

SOURCES/client-x11-improve-rails-window-locking.patch

@@ -1,331 +0,0 @@
-From e6edabe690ad8de63af327403e8371b6ef1319e2 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 27 Apr 2026 19:38:47 +0000
-Subject: [PATCH] [client,x11] improve rails window locking
-
-Backport of commit 78fd7f580d5f9e6d9d582d82e5ea96003844fbdf.
-
-Adapted for 2.11.7: C89 declaration style, simplified
-`xfAppWindowsLockFrom`/`UnlockFrom` signatures (no
-`WINPR_ATTR_UNUSED`), `XSetTransientForHint` inline error handling.
-
-Made-with: Cursor
----
- client/X11/xf_event.c    |  7 ++----
- client/X11/xf_graphics.c |  4 +--
- client/X11/xf_rail.c     | 53 +++++++++++++++++++--------------------
- client/X11/xf_rail.h     | 10 ++++++--
- client/X11/xf_window.c   | 54 ++++++++++++++++++++++++++++++++--------
- client/X11/xf_window.h   | 11 ++++++--
- 6 files changed, 89 insertions(+), 50 deletions(-)
-
-diff --git a/client/X11/xf_event.c b/client/X11/xf_event.c
-index 8bebcd4..8801fbd 100644
---- a/client/X11/xf_event.c
-+++ b/client/X11/xf_event.c
-@@ -354,13 +354,10 @@ static BOOL xf_event_Expose(xfContext* xfc, const XExposeEvent* event, BOOL app)
- 	}
- 	else
- 	{
--		xfAppWindow* appWindow;
--		appWindow = xf_AppWindowFromX11Window(xfc, event->window);
--
-+		xfAppWindow* appWindow = xf_AppWindowFromX11Window(xfc, event->window);
- 		if (appWindow)
--		{
- 			xf_UpdateWindowArea(xfc, appWindow, x, y, w, h);
--		}
-+		xf_rail_return_window(appWindow);
- 	}
- 
- 	return TRUE;
-diff --git a/client/X11/xf_graphics.c b/client/X11/xf_graphics.c
-index 70979bd..f5b4f3d 100644
---- a/client/X11/xf_graphics.c
-+++ b/client/X11/xf_graphics.c
-@@ -372,12 +372,12 @@ static Window xf_Pointer_get_window(xfContext* xfc)
- 	if (xfc->remote_app)
- 	{
- 		Window w = 0;
--		EnterCriticalSection(&xfc->railWindows->lock);
-+		xf_AppWindowsLock(xfc);
- 		if (!xfc->appWindow)
- 			WLog_WARN(TAG, "xf_Pointer: Invalid appWindow");
- 		else
- 			w = xfc->appWindow->handle;
--		LeaveCriticalSection(&xfc->railWindows->lock);
-+		xf_AppWindowsUnlock(xfc);
- 		return w;
- 	}
- 	else
-diff --git a/client/X11/xf_rail.c b/client/X11/xf_rail.c
-index 1938bdd..1e57046 100644
---- a/client/X11/xf_rail.c
-+++ b/client/X11/xf_rail.c
-@@ -101,9 +101,10 @@ void xf_rail_send_activate(xfContext* xfc, Window xwindow, BOOL enabled)
- 		xf_SetWindowStyle(xfc, appWindow, 0, 0);
- 
- 	activate.windowId = appWindow->windowId;
-+	xf_rail_return_window(appWindow);
-+
- 	activate.enabled = enabled;
- 	xfc->rail->ClientActivate(xfc->rail, &activate);
--	xf_rail_return_window(appWindow);
- }
- 
- void xf_rail_send_client_system_command(xfContext* xfc, UINT32 windowId, UINT16 command)
-@@ -260,6 +261,7 @@ void xf_rail_paint(xfContext* xfc, INT32 uleft, INT32 utop, UINT32 uright, UINT3
- static BOOL xf_rail_window_common(rdpContext* context, const WINDOW_ORDER_INFO* orderInfo,
-                                   const WINDOW_STATE_ORDER* windowState)
- {
-+	BOOL rc = FALSE;
- 	xfContext* xfc = (xfContext*)context;
- 	UINT32 fieldFlags = orderInfo->fieldFlags;
- 	BOOL position_or_size_updated = FALSE;
-@@ -379,14 +381,14 @@ static BOOL xf_rail_window_common(rdpContext* context, const WINDOW_ORDER_INFO*
- 			if (!(title = _strdup("")))
- 			{
- 				WLog_ERR(TAG, "failed to duplicate empty window title string");
--				return FALSE;
-+				goto fail;
- 			}
- 		}
- 		else if (ConvertFromUnicode(CP_UTF8, 0, (WCHAR*)windowState->titleInfo.string,
- 		                            windowState->titleInfo.length / 2, &title, 0, NULL, NULL) < 1)
- 		{
- 			WLog_ERR(TAG, "failed to convert window title");
--			return FALSE;
-+			goto fail;
- 		}
- 
- 		free(appWindow->title);
-@@ -427,7 +429,7 @@ static BOOL xf_rail_window_common(rdpContext* context, const WINDOW_ORDER_INFO*
- 			    (RECTANGLE_16*)calloc(appWindow->numWindowRects, sizeof(RECTANGLE_16));
- 
- 			if (!appWindow->windowRects)
--				return FALSE;
-+				goto fail;
- 
- 			CopyMemory(appWindow->windowRects, windowState->windowRects,
- 			           appWindow->numWindowRects * sizeof(RECTANGLE_16));
-@@ -456,7 +458,7 @@ static BOOL xf_rail_window_common(rdpContext* context, const WINDOW_ORDER_INFO*
- 			    (RECTANGLE_16*)calloc(appWindow->numVisibilityRects, sizeof(RECTANGLE_16));
- 
- 			if (!appWindow->visibilityRects)
--				return FALSE;
-+				goto fail;
- 
- 			CopyMemory(appWindow->visibilityRects, windowState->visibilityRects,
- 			           appWindow->numVisibilityRects * sizeof(RECTANGLE_16));
-@@ -522,7 +524,10 @@ static BOOL xf_rail_window_common(rdpContext* context, const WINDOW_ORDER_INFO*
- 	{
- 	    xf_SetWindowRects(xfc, appWindow, appWindow->windowRects, appWindow->numWindowRects);
- 	}*/
--	return TRUE;
-+	rc = TRUE;
-+fail:
-+	xf_rail_return_window(appWindow);
-+	return rc;
- }
- 
- static BOOL xf_rail_window_delete(rdpContext* context, const WINDOW_ORDER_INFO* orderInfo)
-@@ -1000,14 +1005,14 @@ static UINT xf_rail_server_local_move_size(RailClientContext* context,
- 			x = localMoveSize->posX;
- 			y = localMoveSize->posY;
- 			/* FIXME: local keyboard moves not working */
--			return CHANNEL_RC_OK;
-+			break;
- 
- 		case RAIL_WMSZ_KEYSIZE:
- 			direction = _NET_WM_MOVERESIZE_SIZE_KEYBOARD;
- 			x = localMoveSize->posX;
- 			y = localMoveSize->posY;
- 			/* FIXME: local keyboard moves not working */
--			return CHANNEL_RC_OK;
-+			break;
- 	}
- 
- 	if (localMoveSize->isMoveSizeStart)
-@@ -1173,9 +1178,17 @@ xfAppWindow* xf_rail_add_window(xfContext* xfc, UINT64 id, UINT32 x, UINT32 y, U
- 	appWindow->y = y;
- 	appWindow->width = width;
- 	appWindow->height = height;
--	xf_AppWindowCreate(xfc, appWindow);
--	HashTable_Add(xfc->railWindows, &appWindow->windowId, (void*)appWindow);
-+	xf_AppWindowsLock(xfc);
-+	if (xf_AppWindowCreate(xfc, appWindow) < 0)
-+		goto fail;
-+
-+	if (HashTable_Add(xfc->railWindows, &appWindow->windowId, (void*)appWindow) < 0)
-+		goto fail;
- 	return appWindow;
-+fail:
-+	free(appWindow);
-+	xf_AppWindowsUnlock(xfc);
-+	return NULL;
- }
- 
- BOOL xf_rail_del_window(xfContext* xfc, UINT64 id)
-@@ -1189,26 +1202,10 @@ BOOL xf_rail_del_window(xfContext* xfc, UINT64 id)
- 	return HashTable_Remove(xfc->railWindows, &id);
- }
- 
--xfAppWindow* xf_rail_get_window(xfContext* xfc, UINT64 id)
--{
--	if (!xfc)
--		return NULL;
--
--	if (!xfc->railWindows)
--		return NULL;
--
--	EnterCriticalSection(&xfc->railWindows->lock);
--	xfAppWindow* window = HashTable_GetItemValue(xfc->railWindows, &id);
--	if (!window)
--		LeaveCriticalSection(&xfc->railWindows->lock);
--
--	return window;
--}
--
--void xf_rail_return_window(xfAppWindow* window)
-+void xf_rail_return_windowFrom(xfAppWindow* window, const char* file, const char* fkt, size_t line)
- {
- 	if (!window)
- 		return;
- 
--	LeaveCriticalSection(&window->xfc->railWindows->lock);
-+	xfAppWindowsUnlockFrom(window->xfc, file, fkt, line);
- }
-diff --git a/client/X11/xf_rail.h b/client/X11/xf_rail.h
-index 5fbc316..83d5fff 100644
---- a/client/X11/xf_rail.h
-+++ b/client/X11/xf_rail.h
-@@ -36,9 +36,15 @@ void xf_rail_disable_remoteapp_mode(xfContext* xfc);
- xfAppWindow* xf_rail_add_window(xfContext* xfc, UINT64 id, UINT32 x, UINT32 y, UINT32 width,
-                                 UINT32 height, UINT32 surfaceId);
- 
--void xf_rail_return_window(xfAppWindow* window);
-+#define xf_rail_return_window(window) \
-+	xf_rail_return_windowFrom((window), __FILE__, __func__, __LINE__)
-+void xf_rail_return_windowFrom(xfAppWindow* window, const char* file, const char* fkt, size_t line);
- 
--xfAppWindow* xf_rail_get_window(xfContext* xfc, UINT64 id);
-+#define xf_rail_get_window(xfc, id) \
-+	xf_rail_get_windowFrom((xfc), (id), __FILE__, __func__, __LINE__)
-+
-+xfAppWindow* xf_rail_get_windowFrom(xfContext* xfc, UINT64 id, const char* file, const char* fkt,
-+                                    size_t line);
- 
- BOOL xf_rail_del_window(xfContext* xfc, UINT64 id);
- 
-diff --git a/client/X11/xf_window.c b/client/X11/xf_window.c
-index 7e936fe..09b4a81 100644
---- a/client/X11/xf_window.c
-+++ b/client/X11/xf_window.c
-@@ -1116,39 +1116,71 @@ void xf_DestroyWindow(xfContext* xfc, xfAppWindow* appWindow)
- 	free(appWindow);
- }
- 
--xfAppWindow* xf_AppWindowFromX11Window(xfContext* xfc, Window wnd)
-+static xfAppWindow* get_windowUnlocked(xfContext* xfc, UINT64 id)
-+{
-+	WINPR_ASSERT(xfc);
-+	return HashTable_GetItemValue(xfc->railWindows, &id);
-+}
-+
-+xfAppWindow* xf_rail_get_windowFrom(xfContext* xfc, UINT64 id, const char* file, const char* fkt,
-+                                    size_t line)
-+{
-+	if (!xfc)
-+		return NULL;
-+
-+	if (!xfc->railWindows)
-+		return NULL;
-+
-+	xfAppWindowsLockFrom(xfc, file, fkt, line);
-+	xfAppWindow* window = get_windowUnlocked(xfc, id);
-+	if (!window)
-+		xfAppWindowsUnlockFrom(xfc, file, fkt, line);
-+
-+	return window;
-+}
-+
-+xfAppWindow* xf_AppWindowFromX11WindowFrom(xfContext* xfc, Window wnd, const char* file,
-+                                           const char* fkt, size_t line)
- {
--	int index;
--	int count;
- 	ULONG_PTR* pKeys = NULL;
--	xfAppWindow* appWindow;
- 
- 	if (!xfc->railWindows)
- 		return NULL;
- 
--	EnterCriticalSection(&xfc->railWindows->lock);
--	count = HashTable_GetKeys(xfc->railWindows, &pKeys);
-+	xfAppWindowsLockFrom(xfc, file, fkt, line);
-+	size_t count = HashTable_GetKeys(xfc->railWindows, &pKeys);
- 
--	for (index = 0; index < count; index++)
-+	for (size_t index = 0; index < count; index++)
- 	{
--		appWindow = HashTable_GetItemValue(xfc->railWindows, (void*)pKeys[index]);
-+		xfAppWindow* appWindow = get_windowUnlocked(xfc, *(UINT64*)pKeys[index]);
- 
- 		if (!appWindow)
- 		{
--			LeaveCriticalSection(&xfc->railWindows->lock);
-+			xfAppWindowsUnlockFrom(xfc, file, fkt, line);
- 			free(pKeys);
- 			return NULL;
- 		}
- 
- 		if (appWindow->handle == wnd)
- 		{
--			LeaveCriticalSection(&xfc->railWindows->lock);
- 			free(pKeys);
- 			return appWindow;
- 		}
- 	}
- 
--	LeaveCriticalSection(&xfc->railWindows->lock);
-+	xfAppWindowsUnlockFrom(xfc, file, fkt, line);
- 	free(pKeys);
- 	return NULL;
- }
-+
-+void xfAppWindowsLockFrom(xfContext* xfc, const char* file, const char* fkt, size_t line)
-+{
-+	WINPR_ASSERT(xfc);
-+	EnterCriticalSection(&xfc->railWindows->lock);
-+}
-+
-+void xfAppWindowsUnlockFrom(xfContext* xfc, const char* file, const char* fkt, size_t line)
-+{
-+	WINPR_ASSERT(xfc);
-+	LeaveCriticalSection(&xfc->railWindows->lock);
-+}
-diff --git a/client/X11/xf_window.h b/client/X11/xf_window.h
-index c7702ed..45d40bb 100644
---- a/client/X11/xf_window.h
-+++ b/client/X11/xf_window.h
-@@ -187,8 +187,15 @@ void xf_SetWindowMinMaxInfo(xfContext* xfc, xfAppWindow* appWindow, int maxWidth
-                             int maxTrackWidth, int maxTrackHeight);
- void xf_StartLocalMoveSize(xfContext* xfc, xfAppWindow* appWindow, int direction, int x, int y);
- void xf_EndLocalMoveSize(xfContext* xfc, xfAppWindow* appWindow);
--void xf_rail_return_window(xfAppWindow* window);
-+#define xf_AppWindowFromX11Window(xfc, wnd) \
-+	xf_AppWindowFromX11WindowFrom((xfc), (wnd), __FILE__, __func__, __LINE__)
-+xfAppWindow* xf_AppWindowFromX11WindowFrom(xfContext* xfc, Window wnd, const char* file,
-+                                           const char* fkt, size_t line);
- 
--xfAppWindow* xf_AppWindowFromX11Window(xfContext* xfc, Window wnd);
-+#define xf_AppWindowsLock(xfc) xfAppWindowsLockFrom((xfc), __FILE__, __func__, __LINE__)
-+void xfAppWindowsLockFrom(xfContext* xfc, const char* file, const char* fkt, size_t line);
-+
-+#define xf_AppWindowsUnlock(xfc) xfAppWindowsUnlockFrom((xfc), __FILE__, __func__, __LINE__)
-+void xfAppWindowsUnlockFrom(xfContext* xfc, const char* file, const char* fkt, size_t line);
- 
- #endif /* FREERDP_CLIENT_X11_WINDOW_H */
--- 
-2.53.0
-

SOURCES/client-x11-lock-appwindow.patch

@@ -1,404 +0,0 @@
-From 8152c347e96c1e3af15cb2551d4efb6740fe9f87 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 27 Apr 2026 19:37:40 +0000
-Subject: [PATCH] [client,x11] lock appWindow
-
-Backport of commit 1994e9844212a6dfe0ff12309fef520e888986b5.
-
-Adapted for 2.11.7: C89 declaration style, `(Atom)` cast for
-`xfc->_NET_WM_STATE` comparison, `xf_rail_send_client_system_command`
-return value handling adapted (no direct return), `HashTable_GetKeys`
-variable pre-declared, `xf_AppWindowFromX11Window` loop adapted.
-
-Made-with: Cursor
----
- client/X11/xf_event.c    | 46 ++++++++++++++++-----------
- client/X11/xf_graphics.c | 10 +++---
- client/X11/xf_rail.c     | 68 +++++++++++++++++++++++++---------------
- client/X11/xf_rail.h     |  3 ++
- client/X11/xf_window.c   | 13 +++++++-
- client/X11/xf_window.h   |  2 ++
- 6 files changed, 94 insertions(+), 48 deletions(-)
-
-diff --git a/client/X11/xf_event.c b/client/X11/xf_event.c
-index eb50ef1..8bebcd4 100644
---- a/client/X11/xf_event.c
-+++ b/client/X11/xf_event.c
-@@ -388,7 +388,9 @@ BOOL xf_generic_MotionNotify(xfContext* xfc, int x, int y, int state, Window win
- 	if (app)
- 	{
- 		/* make sure window exists */
--		if (!xf_AppWindowFromX11Window(xfc, window))
-+		xfAppWindow* appWindow = xf_AppWindowFromX11Window(xfc, window);
-+		xf_rail_return_window(appWindow);
-+		if (!appWindow)
- 			return TRUE;
- 
- 		/* Translate to desktop coordinates */
-@@ -465,7 +467,9 @@ BOOL xf_generic_ButtonEvent(xfContext* xfc, int x, int y, int button, Window win
- 			if (app)
- 			{
- 				/* make sure window exists */
--				if (!xf_AppWindowFromX11Window(xfc, window))
-+				xfAppWindow* appWindow = xf_AppWindowFromX11Window(xfc, window);
-+				xf_rail_return_window(appWindow);
-+				if (!appWindow)
- 					return TRUE;
- 
- 				/* Translate to desktop coordinates */
-@@ -574,9 +578,8 @@ static BOOL xf_event_FocusIn(xfContext* xfc, const XFocusInEvent* event, BOOL ap
- 		/* Update the server with any window changes that occurred while the window was not focused.
- 		 */
- 		if (appWindow)
--		{
- 			xf_rail_adjust_position(xfc, appWindow);
--		}
-+		xf_rail_return_window(appWindow);
- 	}
- 
- 	xf_keyboard_focus_in(xfc);
-@@ -623,15 +626,13 @@ static BOOL xf_event_ClientMessage(xfContext* xfc, const XClientMessageEvent* ev
- 	{
- 		if (app)
- 		{
--			xfAppWindow* appWindow;
--			appWindow = xf_AppWindowFromX11Window(xfc, event->window);
-+			BOOL rc = TRUE;
-+			xfAppWindow* appWindow = xf_AppWindowFromX11Window(xfc, event->window);
- 
- 			if (appWindow)
--			{
- 				xf_rail_send_client_system_command(xfc, appWindow->windowId, SC_CLOSE);
--			}
--
--			return TRUE;
-+			xf_rail_return_window(appWindow);
-+			return rc;
- 		}
- 		else
- 		{
-@@ -665,6 +666,7 @@ static BOOL xf_event_EnterNotify(xfContext* xfc, const XEnterWindowEvent* event,
- 
- 		/* keep track of which window has focus so that we can apply pointer updates */
- 		xfc->appWindow = appWindow;
-+		xf_rail_return_window(appWindow);
- 	}
- 
- 	return TRUE;
-@@ -684,6 +686,7 @@ static BOOL xf_event_LeaveNotify(xfContext* xfc, const XLeaveWindowEvent* event,
- 		/* keep track of which window has focus so that we can apply pointer updates */
- 		if (xfc->appWindow == appWindow)
- 			xfc->appWindow = NULL;
-+		xf_rail_return_window(appWindow);
- 	}
- 	return TRUE;
- }
-@@ -774,6 +777,7 @@ static BOOL xf_event_ConfigureNotify(xfContext* xfc, const XConfigureEvent* even
- 					xf_rail_adjust_position(xfc, appWindow);
- 			}
- 		}
-+		xf_rail_return_window(appWindow);
- 	}
- 	return xf_pointer_update_scale(xfc);
- }
-@@ -798,6 +802,7 @@ static BOOL xf_event_MapNotify(xfContext* xfc, const XMapEvent* event, BOOL app)
- 			// xf_rail_send_client_system_command(xfc, appWindow->windowId, SC_RESTORE);
- 			appWindow->is_mapped = TRUE;
- 		}
-+		xf_rail_return_window(appWindow);
- 	}
- 
- 	return TRUE;
-@@ -813,15 +818,14 @@ static BOOL xf_event_UnmapNotify(xfContext* xfc, const XUnmapEvent* event, BOOL
- 	xf_keyboard_release_all_keypress(xfc);
- 
- 	if (!app)
--		gdi_send_suppress_output(xfc->context.gdi, TRUE);
--	else
-+		return gdi_send_suppress_output(xfc->context.gdi, TRUE);
-+
- 	{
- 		appWindow = xf_AppWindowFromX11Window(xfc, event->window);
- 
- 		if (appWindow)
--		{
- 			appWindow->is_mapped = FALSE;
--		}
-+		xf_rail_return_window(appWindow);
- 	}
- 
- 	return TRUE;
-@@ -829,6 +833,7 @@ static BOOL xf_event_UnmapNotify(xfContext* xfc, const XUnmapEvent* event, BOOL
- 
- static BOOL xf_event_PropertyNotify(xfContext* xfc, const XPropertyEvent* event, BOOL app)
- {
-+	BOOL rc = TRUE;
- 	WINPR_ASSERT(xfc);
- 	WINPR_ASSERT(event);
- 
-@@ -856,7 +861,7 @@ static BOOL xf_event_PropertyNotify(xfContext* xfc, const XPropertyEvent* event,
- 			appWindow = xf_AppWindowFromX11Window(xfc, event->window);
- 
- 			if (!appWindow)
--				return TRUE;
-+				goto fail;
- 		}
- 
- 		if ((Atom)event->atom == xfc->_NET_WM_STATE)
-@@ -949,10 +954,13 @@ static BOOL xf_event_PropertyNotify(xfContext* xfc, const XPropertyEvent* event,
- 			}
- 		}
- 		else if (minimizedChanged)
--			gdi_send_suppress_output(xfc->context.gdi, minimized);
-+			rc = gdi_send_suppress_output(xfc->context.gdi, minimized);
-+
-+	fail:
-+		xf_rail_return_window(appWindow);
- 	}
- 
--	return TRUE;
-+	return rc;
- }
- 
- static BOOL xf_event_suppress_events(xfContext* xfc, xfAppWindow* appWindow, const XEvent* event)
-@@ -1060,7 +1068,9 @@ BOOL xf_event_process(freerdp* instance, const XEvent* event)
- 			/* Update "current" window for cursor change orders */
- 			xfc->appWindow = appWindow;
- 
--			if (xf_event_suppress_events(xfc, appWindow, event))
-+			BOOL suppress = xf_event_suppress_events(xfc, appWindow, event);
-+			xf_rail_return_window(appWindow);
-+			if (suppress)
- 				return TRUE;
- 		}
- 	}
-diff --git a/client/X11/xf_graphics.c b/client/X11/xf_graphics.c
-index d596b23..70979bd 100644
---- a/client/X11/xf_graphics.c
-+++ b/client/X11/xf_graphics.c
-@@ -371,12 +371,14 @@ static Window xf_Pointer_get_window(xfContext* xfc)
- 	}
- 	if (xfc->remote_app)
- 	{
-+		Window w = 0;
-+		EnterCriticalSection(&xfc->railWindows->lock);
- 		if (!xfc->appWindow)
--		{
- 			WLog_WARN(TAG, "xf_Pointer: Invalid appWindow");
--			return 0;
--		}
--		return xfc->appWindow->handle;
-+		else
-+			w = xfc->appWindow->handle;
-+		LeaveCriticalSection(&xfc->railWindows->lock);
-+		return w;
- 	}
- 	else
- 	{
-diff --git a/client/X11/xf_rail.c b/client/X11/xf_rail.c
-index fdc2244..1938bdd 100644
---- a/client/X11/xf_rail.c
-+++ b/client/X11/xf_rail.c
-@@ -103,6 +103,7 @@ void xf_rail_send_activate(xfContext* xfc, Window xwindow, BOOL enabled)
- 	activate.windowId = appWindow->windowId;
- 	activate.enabled = enabled;
- 	xfc->rail->ClientActivate(xfc->rail, &activate);
-+	xf_rail_return_window(appWindow);
- }
- 
- void xf_rail_send_client_system_command(xfContext* xfc, UINT32 windowId, UINT16 command)
-@@ -658,61 +659,63 @@ static void xf_rail_set_window_icon(xfContext* xfc, xfAppWindow* railWindow, xfR
- static BOOL xf_rail_window_icon(rdpContext* context, const WINDOW_ORDER_INFO* orderInfo,
-                                 const WINDOW_ICON_ORDER* windowIcon)
- {
-+	BOOL rc = FALSE;
- 	xfContext* xfc = (xfContext*)context;
--	xfAppWindow* railWindow;
--	xfRailIcon* icon;
--	BOOL replaceIcon;
--	railWindow = xf_rail_get_window(xfc, orderInfo->windowId);
-+	BOOL replaceIcon = 0;
-+	xfAppWindow* railWindow = xf_rail_get_window(xfc, orderInfo->windowId);
- 
- 	if (!railWindow)
- 		return TRUE;
- 
--	icon = RailIconCache_Lookup(xfc->railIconCache, windowIcon->iconInfo->cacheId,
-+	xfRailIcon* icon = RailIconCache_Lookup(xfc->railIconCache, windowIcon->iconInfo->cacheId,
- 	                            windowIcon->iconInfo->cacheEntry);
- 
- 	if (!icon)
- 	{
- 		WLog_WARN(TAG, "failed to get icon from cache %02X:%04X", windowIcon->iconInfo->cacheId,
- 		          windowIcon->iconInfo->cacheEntry);
--		return FALSE;
- 	}
--
--	if (!convert_rail_icon(windowIcon->iconInfo, icon))
-+	else if (!convert_rail_icon(windowIcon->iconInfo, icon))
- 	{
- 		WLog_WARN(TAG, "failed to convert icon for window %08X", orderInfo->windowId);
--		return FALSE;
- 	}
--
--	replaceIcon = !!(orderInfo->fieldFlags & WINDOW_ORDER_STATE_NEW);
--	xf_rail_set_window_icon(xfc, railWindow, icon, replaceIcon);
--	return TRUE;
-+	else
-+	{
-+		replaceIcon = !!(orderInfo->fieldFlags & WINDOW_ORDER_STATE_NEW);
-+		xf_rail_set_window_icon(xfc, railWindow, icon, replaceIcon);
-+		rc = TRUE;
-+	}
-+	xf_rail_return_window(railWindow);
-+	return rc;
- }
- 
- static BOOL xf_rail_window_cached_icon(rdpContext* context, const WINDOW_ORDER_INFO* orderInfo,
-                                        const WINDOW_CACHED_ICON_ORDER* windowCachedIcon)
- {
-+	BOOL rc = FALSE;
- 	xfContext* xfc = (xfContext*)context;
--	xfAppWindow* railWindow;
--	xfRailIcon* icon;
--	BOOL replaceIcon;
--	railWindow = xf_rail_get_window(xfc, orderInfo->windowId);
-+	BOOL replaceIcon = 0;
-+	xfAppWindow* railWindow = xf_rail_get_window(xfc, orderInfo->windowId);
- 
- 	if (!railWindow)
- 		return TRUE;
- 
--	icon = RailIconCache_Lookup(xfc->railIconCache, windowCachedIcon->cachedIcon.cacheId,
-+	xfRailIcon* icon = RailIconCache_Lookup(xfc->railIconCache, windowCachedIcon->cachedIcon.cacheId,
- 	                            windowCachedIcon->cachedIcon.cacheEntry);
- 
- 	if (!icon)
- 	{
- 		WLog_WARN(TAG, "failed to get icon from cache %02X:%04X",
- 		          windowCachedIcon->cachedIcon.cacheId, windowCachedIcon->cachedIcon.cacheEntry);
--		return FALSE;
- 	}
--
--	replaceIcon = !!(orderInfo->fieldFlags & WINDOW_ORDER_STATE_NEW);
--	xf_rail_set_window_icon(xfc, railWindow, icon, replaceIcon);
--	return TRUE;
-+	else
-+	{
-+		replaceIcon = !!(orderInfo->fieldFlags & WINDOW_ORDER_STATE_NEW);
-+		xf_rail_set_window_icon(xfc, railWindow, icon, replaceIcon);
-+		rc = TRUE;
-+	}
-+	xf_rail_return_window(railWindow);
-+	return rc;
- }
- 
- static BOOL xf_rail_notify_icon_common(rdpContext* context, const WINDOW_ORDER_INFO* orderInfo,
-@@ -1012,6 +1015,7 @@ static UINT xf_rail_server_local_move_size(RailClientContext* context,
- 	else
- 		xf_EndLocalMoveSize(xfc, appWindow);
- 
-+	xf_rail_return_window(appWindow);
- 	return CHANNEL_RC_OK;
- }
- 
-@@ -1033,6 +1037,7 @@ static UINT xf_rail_server_min_max_info(RailClientContext* context,
- 		                       minMaxInfo->minTrackHeight, minMaxInfo->maxTrackWidth,
- 		                       minMaxInfo->maxTrackHeight);
- 	}
-+	xf_rail_return_window(appWindow);
- 
- 	return CHANNEL_RC_OK;
- }
-@@ -1190,7 +1195,20 @@ xfAppWindow* xf_rail_get_window(xfContext* xfc, UINT64 id)
- 		return NULL;
- 
- 	if (!xfc->railWindows)
--		return FALSE;
-+		return NULL;
-+
-+	EnterCriticalSection(&xfc->railWindows->lock);
-+	xfAppWindow* window = HashTable_GetItemValue(xfc->railWindows, &id);
-+	if (!window)
-+		LeaveCriticalSection(&xfc->railWindows->lock);
-+
-+	return window;
-+}
-+
-+void xf_rail_return_window(xfAppWindow* window)
-+{
-+	if (!window)
-+		return;
- 
--	return HashTable_GetItemValue(xfc->railWindows, &id);
-+	LeaveCriticalSection(&window->xfc->railWindows->lock);
- }
-diff --git a/client/X11/xf_rail.h b/client/X11/xf_rail.h
-index c99ed70..5fbc316 100644
---- a/client/X11/xf_rail.h
-+++ b/client/X11/xf_rail.h
-@@ -35,6 +35,9 @@ void xf_rail_disable_remoteapp_mode(xfContext* xfc);
- 
- xfAppWindow* xf_rail_add_window(xfContext* xfc, UINT64 id, UINT32 x, UINT32 y, UINT32 width,
-                                 UINT32 height, UINT32 surfaceId);
-+
-+void xf_rail_return_window(xfAppWindow* window);
-+
- xfAppWindow* xf_rail_get_window(xfContext* xfc, UINT64 id);
- 
- BOOL xf_rail_del_window(xfContext* xfc, UINT64 id);
-diff --git a/client/X11/xf_window.c b/client/X11/xf_window.c
-index 9b5b1c4..7e936fe 100644
---- a/client/X11/xf_window.c
-+++ b/client/X11/xf_window.c
-@@ -1122,22 +1122,33 @@ xfAppWindow* xf_AppWindowFromX11Window(xfContext* xfc, Window wnd)
- 	int count;
- 	ULONG_PTR* pKeys = NULL;
- 	xfAppWindow* appWindow;
-+
-+	if (!xfc->railWindows)
-+		return NULL;
-+
-+	EnterCriticalSection(&xfc->railWindows->lock);
- 	count = HashTable_GetKeys(xfc->railWindows, &pKeys);
- 
- 	for (index = 0; index < count; index++)
- 	{
--		appWindow = xf_rail_get_window(xfc, *(UINT64*)pKeys[index]);
-+		appWindow = HashTable_GetItemValue(xfc->railWindows, (void*)pKeys[index]);
- 
- 		if (!appWindow)
-+		{
-+			LeaveCriticalSection(&xfc->railWindows->lock);
-+			free(pKeys);
- 			return NULL;
-+		}
- 
- 		if (appWindow->handle == wnd)
- 		{
-+			LeaveCriticalSection(&xfc->railWindows->lock);
- 			free(pKeys);
- 			return appWindow;
- 		}
- 	}
- 
-+	LeaveCriticalSection(&xfc->railWindows->lock);
- 	free(pKeys);
- 	return NULL;
- }
-diff --git a/client/X11/xf_window.h b/client/X11/xf_window.h
-index 0f85af1..c7702ed 100644
---- a/client/X11/xf_window.h
-+++ b/client/X11/xf_window.h
-@@ -187,6 +187,8 @@ void xf_SetWindowMinMaxInfo(xfContext* xfc, xfAppWindow* appWindow, int maxWidth
-                             int maxTrackWidth, int maxTrackHeight);
- void xf_StartLocalMoveSize(xfContext* xfc, xfAppWindow* appWindow, int direction, int x, int y);
- void xf_EndLocalMoveSize(xfContext* xfc, xfAppWindow* appWindow);
-+void xf_rail_return_window(xfAppWindow* window);
-+
- xfAppWindow* xf_AppWindowFromX11Window(xfContext* xfc, Window wnd);
- 
- #endif /* FREERDP_CLIENT_X11_WINDOW_H */
--- 
-2.53.0
-

SOURCES/client-x11-refactor-locking.patch

@@ -1,360 +0,0 @@
-From eeb38c3565473c46da5dea6b43f597064e89b717 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 27 Apr 2026 20:12:11 +0000
-Subject: [PATCH] [client,x11] refactor locking
-
-X11 and railWindows lock must be held at the same time to avoid
-deadlocking.
-
-Backport of commit 4ff57b68c2960fa414d03c78ff0e0660be1cc5bd.
-
-Adapted for 2.11.7: C89 declaration style, direct X11 calls instead
-of `LogDynAnd*` wrappers, `WINPR_ATTR_UNUSED` removed from
-`xfAppWindowsLockFrom`/`UnlockFrom`.
-
-Made-with: Cursor
----
- client/X11/xf_event.c  | 24 ++++++++++++------------
- client/X11/xf_rail.c   | 35 +++++++++++++++++++++--------------
- client/X11/xf_rail.h   | 14 ++++++++------
- client/X11/xf_window.c | 16 +++++++++-------
- 4 files changed, 50 insertions(+), 39 deletions(-)
-
-diff --git a/client/X11/xf_event.c b/client/X11/xf_event.c
-index 8801fbd..e1421ad 100644
---- a/client/X11/xf_event.c
-+++ b/client/X11/xf_event.c
-@@ -357,7 +357,7 @@ static BOOL xf_event_Expose(xfContext* xfc, const XExposeEvent* event, BOOL app)
- 		xfAppWindow* appWindow = xf_AppWindowFromX11Window(xfc, event->window);
- 		if (appWindow)
- 			xf_UpdateWindowArea(xfc, appWindow, x, y, w, h);
--		xf_rail_return_window(appWindow);
-+		xf_rail_return_window(appWindow, FALSE);
- 	}
- 
- 	return TRUE;
-@@ -386,7 +386,7 @@ BOOL xf_generic_MotionNotify(xfContext* xfc, int x, int y, int state, Window win
- 	{
- 		/* make sure window exists */
- 		xfAppWindow* appWindow = xf_AppWindowFromX11Window(xfc, window);
--		xf_rail_return_window(appWindow);
-+		xf_rail_return_window(appWindow, FALSE);
- 		if (!appWindow)
- 			return TRUE;
- 
-@@ -465,7 +465,7 @@ BOOL xf_generic_ButtonEvent(xfContext* xfc, int x, int y, int button, Window win
- 			{
- 				/* make sure window exists */
- 				xfAppWindow* appWindow = xf_AppWindowFromX11Window(xfc, window);
--				xf_rail_return_window(appWindow);
-+				xf_rail_return_window(appWindow, FALSE);
- 				if (!appWindow)
- 					return TRUE;
- 
-@@ -576,7 +576,7 @@ static BOOL xf_event_FocusIn(xfContext* xfc, const XFocusInEvent* event, BOOL ap
- 		 */
- 		if (appWindow)
- 			xf_rail_adjust_position(xfc, appWindow);
--		xf_rail_return_window(appWindow);
-+		xf_rail_return_window(appWindow, FALSE);
- 	}
- 
- 	xf_keyboard_focus_in(xfc);
-@@ -628,7 +628,7 @@ static BOOL xf_event_ClientMessage(xfContext* xfc, const XClientMessageEvent* ev
- 
- 			if (appWindow)
- 				xf_rail_send_client_system_command(xfc, appWindow->windowId, SC_CLOSE);
--			xf_rail_return_window(appWindow);
-+			xf_rail_return_window(appWindow, FALSE);
- 			return rc;
- 		}
- 		else
-@@ -663,7 +663,7 @@ static BOOL xf_event_EnterNotify(xfContext* xfc, const XEnterWindowEvent* event,
- 
- 		/* keep track of which window has focus so that we can apply pointer updates */
- 		xfc->appWindow = appWindow;
--		xf_rail_return_window(appWindow);
-+		xf_rail_return_window(appWindow, FALSE);
- 	}
- 
- 	return TRUE;
-@@ -683,7 +683,7 @@ static BOOL xf_event_LeaveNotify(xfContext* xfc, const XLeaveWindowEvent* event,
- 		/* keep track of which window has focus so that we can apply pointer updates */
- 		if (xfc->appWindow == appWindow)
- 			xfc->appWindow = NULL;
--		xf_rail_return_window(appWindow);
-+		xf_rail_return_window(appWindow, FALSE);
- 	}
- 	return TRUE;
- }
-@@ -774,7 +774,7 @@ static BOOL xf_event_ConfigureNotify(xfContext* xfc, const XConfigureEvent* even
- 					xf_rail_adjust_position(xfc, appWindow);
- 			}
- 		}
--		xf_rail_return_window(appWindow);
-+		xf_rail_return_window(appWindow, FALSE);
- 	}
- 	return xf_pointer_update_scale(xfc);
- }
-@@ -799,7 +799,7 @@ static BOOL xf_event_MapNotify(xfContext* xfc, const XMapEvent* event, BOOL app)
- 			// xf_rail_send_client_system_command(xfc, appWindow->windowId, SC_RESTORE);
- 			appWindow->is_mapped = TRUE;
- 		}
--		xf_rail_return_window(appWindow);
-+		xf_rail_return_window(appWindow, FALSE);
- 	}
- 
- 	return TRUE;
-@@ -822,7 +822,7 @@ static BOOL xf_event_UnmapNotify(xfContext* xfc, const XUnmapEvent* event, BOOL
- 
- 		if (appWindow)
- 			appWindow->is_mapped = FALSE;
--		xf_rail_return_window(appWindow);
-+		xf_rail_return_window(appWindow, FALSE);
- 	}
- 
- 	return TRUE;
-@@ -954,7 +954,7 @@ static BOOL xf_event_PropertyNotify(xfContext* xfc, const XPropertyEvent* event,
- 			rc = gdi_send_suppress_output(xfc->context.gdi, minimized);
- 
- 	fail:
--		xf_rail_return_window(appWindow);
-+		xf_rail_return_window(appWindow, FALSE);
- 	}
- 
- 	return rc;
-@@ -1066,7 +1066,7 @@ BOOL xf_event_process(freerdp* instance, const XEvent* event)
- 			xfc->appWindow = appWindow;
- 
- 			BOOL suppress = xf_event_suppress_events(xfc, appWindow, event);
--			xf_rail_return_window(appWindow);
-+			xf_rail_return_window(appWindow, FALSE);
- 			if (suppress)
- 				return TRUE;
- 		}
-diff --git a/client/X11/xf_rail.c b/client/X11/xf_rail.c
-index 1e57046..d42b864 100644
---- a/client/X11/xf_rail.c
-+++ b/client/X11/xf_rail.c
-@@ -101,7 +101,7 @@ void xf_rail_send_activate(xfContext* xfc, Window xwindow, BOOL enabled)
- 		xf_SetWindowStyle(xfc, appWindow, 0, 0);
- 
- 	activate.windowId = appWindow->windowId;
--	xf_rail_return_window(appWindow);
-+	xf_rail_return_window(appWindow, FALSE);
- 
- 	activate.enabled = enabled;
- 	xfc->rail->ClientActivate(xfc->rail, &activate);
-@@ -213,7 +213,7 @@ static void xf_rail_invalidate_region(xfContext* xfc, REGION16* invalidRegion)
- 
- 	for (index = 0; index < count; index++)
- 	{
--		appWindow = xf_rail_get_window(xfc, *(UINT64*)pKeys[index]);
-+		appWindow = xf_rail_get_window(xfc, *(UINT64*)pKeys[index], FALSE);
- 
- 		if (appWindow)
- 		{
-@@ -265,7 +265,7 @@ static BOOL xf_rail_window_common(rdpContext* context, const WINDOW_ORDER_INFO*
- 	xfContext* xfc = (xfContext*)context;
- 	UINT32 fieldFlags = orderInfo->fieldFlags;
- 	BOOL position_or_size_updated = FALSE;
--	xfAppWindow* appWindow = xf_rail_get_window(xfc, orderInfo->windowId);
-+	xfAppWindow* appWindow = xf_rail_get_window(xfc, orderInfo->windowId, FALSE);
- 
- 	if (fieldFlags & WINDOW_ORDER_STATE_NEW)
- 	{
-@@ -526,7 +526,7 @@ static BOOL xf_rail_window_common(rdpContext* context, const WINDOW_ORDER_INFO*
- 	}*/
- 	rc = TRUE;
- fail:
--	xf_rail_return_window(appWindow);
-+	xf_rail_return_window(appWindow, FALSE);
- 	return rc;
- }
- 
-@@ -667,7 +667,7 @@ static BOOL xf_rail_window_icon(rdpContext* context, const WINDOW_ORDER_INFO* or
- 	BOOL rc = FALSE;
- 	xfContext* xfc = (xfContext*)context;
- 	BOOL replaceIcon = 0;
--	xfAppWindow* railWindow = xf_rail_get_window(xfc, orderInfo->windowId);
-+	xfAppWindow* railWindow = xf_rail_get_window(xfc, orderInfo->windowId, FALSE);
- 
- 	if (!railWindow)
- 		return TRUE;
-@@ -690,7 +690,7 @@ static BOOL xf_rail_window_icon(rdpContext* context, const WINDOW_ORDER_INFO* or
- 		xf_rail_set_window_icon(xfc, railWindow, icon, replaceIcon);
- 		rc = TRUE;
- 	}
--	xf_rail_return_window(railWindow);
-+	xf_rail_return_window(railWindow, FALSE);
- 	return rc;
- }
- 
-@@ -700,7 +700,7 @@ static BOOL xf_rail_window_cached_icon(rdpContext* context, const WINDOW_ORDER_I
- 	BOOL rc = FALSE;
- 	xfContext* xfc = (xfContext*)context;
- 	BOOL replaceIcon = 0;
--	xfAppWindow* railWindow = xf_rail_get_window(xfc, orderInfo->windowId);
-+	xfAppWindow* railWindow = xf_rail_get_window(xfc, orderInfo->windowId, FALSE);
- 
- 	if (!railWindow)
- 		return TRUE;
-@@ -719,7 +719,7 @@ static BOOL xf_rail_window_cached_icon(rdpContext* context, const WINDOW_ORDER_I
- 		xf_rail_set_window_icon(xfc, railWindow, icon, replaceIcon);
- 		rc = TRUE;
- 	}
--	xf_rail_return_window(railWindow);
-+	xf_rail_return_window(railWindow, FALSE);
- 	return rc;
- }
- 
-@@ -939,7 +939,7 @@ static UINT xf_rail_server_local_move_size(RailClientContext* context,
- 	int direction = 0;
- 	Window child_window;
- 	xfContext* xfc = (xfContext*)context->custom;
--	xfAppWindow* appWindow = xf_rail_get_window(xfc, localMoveSize->windowId);
-+	xfAppWindow* appWindow = xf_rail_get_window(xfc, localMoveSize->windowId, FALSE);
- 
- 	if (!appWindow)
- 		return ERROR_INTERNAL_ERROR;
-@@ -1020,7 +1020,7 @@ static UINT xf_rail_server_local_move_size(RailClientContext* context,
- 	else
- 		xf_EndLocalMoveSize(xfc, appWindow);
- 
--	xf_rail_return_window(appWindow);
-+	xf_rail_return_window(appWindow, FALSE);
- 	return CHANNEL_RC_OK;
- }
- 
-@@ -1033,7 +1033,7 @@ static UINT xf_rail_server_min_max_info(RailClientContext* context,
-                                         const RAIL_MINMAXINFO_ORDER* minMaxInfo)
- {
- 	xfContext* xfc = (xfContext*)context->custom;
--	xfAppWindow* appWindow = xf_rail_get_window(xfc, minMaxInfo->windowId);
-+	xfAppWindow* appWindow = xf_rail_get_window(xfc, minMaxInfo->windowId, FALSE);
- 
- 	if (appWindow)
- 	{
-@@ -1042,7 +1042,7 @@ static UINT xf_rail_server_min_max_info(RailClientContext* context,
- 		                       minMaxInfo->minTrackHeight, minMaxInfo->maxTrackWidth,
- 		                       minMaxInfo->maxTrackHeight);
- 	}
--	xf_rail_return_window(appWindow);
-+	xf_rail_return_window(appWindow, FALSE);
- 
- 	return CHANNEL_RC_OK;
- }
-@@ -1199,13 +1199,20 @@ BOOL xf_rail_del_window(xfContext* xfc, UINT64 id)
- 	if (!xfc->railWindows)
- 		return FALSE;
- 
--	return HashTable_Remove(xfc->railWindows, &id);
-+	xf_lock_x11(xfc);
-+	const BOOL res = HashTable_Remove(xfc->railWindows, &id);
-+	xf_unlock_x11(xfc);
-+	return res;
- }
- 
--void xf_rail_return_windowFrom(xfAppWindow* window, const char* file, const char* fkt, size_t line)
-+void xf_rail_return_windowFrom(xfAppWindow* window, BOOL alreadyLocked, const char* file,
-+                               const char* fkt, size_t line)
- {
- 	if (!window)
- 		return;
- 
-+	if (alreadyLocked)
-+		return;
-+
- 	xfAppWindowsUnlockFrom(window->xfc, file, fkt, line);
- }
-diff --git a/client/X11/xf_rail.h b/client/X11/xf_rail.h
-index 83d5fff..a91c1bf 100644
---- a/client/X11/xf_rail.h
-+++ b/client/X11/xf_rail.h
-@@ -36,14 +36,16 @@ void xf_rail_disable_remoteapp_mode(xfContext* xfc);
- xfAppWindow* xf_rail_add_window(xfContext* xfc, UINT64 id, UINT32 x, UINT32 y, UINT32 width,
-                                 UINT32 height, UINT32 surfaceId);
- 
--#define xf_rail_return_window(window) \
--	xf_rail_return_windowFrom((window), __FILE__, __func__, __LINE__)
--void xf_rail_return_windowFrom(xfAppWindow* window, const char* file, const char* fkt, size_t line);
-+#define xf_rail_return_window(window, alreadyLocked) \
-+	xf_rail_return_windowFrom((window), (alreadyLocked), __FILE__, __func__, __LINE__)
-+void xf_rail_return_windowFrom(xfAppWindow* window, BOOL alreadyLocked, const char* file,
-+                               const char* fkt, size_t line);
- 
--#define xf_rail_get_window(xfc, id) \
--	xf_rail_get_windowFrom((xfc), (id), __FILE__, __func__, __LINE__)
-+#define xf_rail_get_window(xfc, id, alreadyLocked) \
-+	xf_rail_get_windowFrom((xfc), (id), (alreadyLocked), __FILE__, __func__, __LINE__)
- 
--xfAppWindow* xf_rail_get_windowFrom(xfContext* xfc, UINT64 id, const char* file, const char* fkt,
-+xfAppWindow* xf_rail_get_windowFrom(xfContext* xfc, UINT64 id, BOOL alreadyLocked, const char* file,
-+                                    const char* fkt,
-                                     size_t line);
- 
- BOOL xf_rail_del_window(xfContext* xfc, UINT64 id);
-diff --git a/client/X11/xf_window.c b/client/X11/xf_window.c
-index 09b4a81..8d09ced 100644
---- a/client/X11/xf_window.c
-+++ b/client/X11/xf_window.c
-@@ -1070,8 +1070,6 @@ void xf_UpdateWindowArea(xfContext* xfc, xfAppWindow* appWindow, int x, int y, i
- 	if (ay + height > appWindow->windowOffsetY + appWindow->height)
- 		height = (appWindow->windowOffsetY + appWindow->height - 1) - ay;
- 
--	xf_lock_x11(xfc);
--
- 	if (xfc->context.settings->SoftwareGdi)
- 	{
- 		XPutImage(xfc->display, xfc->primary, appWindow->gc, xfc->image, ax, ay, ax, ay, width,
-@@ -1081,7 +1079,6 @@ void xf_UpdateWindowArea(xfContext* xfc, xfAppWindow* appWindow, int x, int y, i
- 	XCopyArea(xfc->display, xfc->primary, appWindow->handle, appWindow->gc, ax, ay, width, height,
- 	          x, y);
- 	XFlush(xfc->display);
--	xf_unlock_x11(xfc);
- }
- 
- void xf_DestroyWindow(xfContext* xfc, xfAppWindow* appWindow)
-@@ -1122,8 +1119,8 @@ static xfAppWindow* get_windowUnlocked(xfContext* xfc, UINT64 id)
- 	return HashTable_GetItemValue(xfc->railWindows, &id);
- }
- 
--xfAppWindow* xf_rail_get_windowFrom(xfContext* xfc, UINT64 id, const char* file, const char* fkt,
--                                    size_t line)
-+xfAppWindow* xf_rail_get_windowFrom(xfContext* xfc, UINT64 id, BOOL alreadyLocked, const char* file,
-+                                    const char* fkt, size_t line)
- {
- 	if (!xfc)
- 		return NULL;
-@@ -1131,9 +1128,12 @@ xfAppWindow* xf_rail_get_windowFrom(xfContext* xfc, UINT64 id, const char* file,
- 	if (!xfc->railWindows)
- 		return NULL;
- 
--	xfAppWindowsLockFrom(xfc, file, fkt, line);
-+	if (!alreadyLocked)
-+		xfAppWindowsLockFrom(xfc, file, fkt, line);
-+
- 	xfAppWindow* window = get_windowUnlocked(xfc, id);
--	if (!window)
-+
-+	if (!window && !alreadyLocked)
- 		xfAppWindowsUnlockFrom(xfc, file, fkt, line);
- 
- 	return window;
-@@ -1176,6 +1176,7 @@ xfAppWindow* xf_AppWindowFromX11WindowFrom(xfContext* xfc, Window wnd, const cha
- void xfAppWindowsLockFrom(xfContext* xfc, const char* file, const char* fkt, size_t line)
- {
- 	WINPR_ASSERT(xfc);
-+	xf_lock_x11(xfc);
- 	EnterCriticalSection(&xfc->railWindows->lock);
- }
- 
-@@ -1183,4 +1184,5 @@ void xfAppWindowsUnlockFrom(xfContext* xfc, const char* file, const char* fkt, s
- {
- 	WINPR_ASSERT(xfc);
- 	LeaveCriticalSection(&xfc->railWindows->lock);
-+	xf_unlock_x11(xfc);
- }
--- 
-2.53.0
-

SOURCES/codec-clear-check-clear_decomress-glyphData.patch

@@ -1,76 +0,0 @@
-From 3a4ee3f0020977320066b99da16456b6364c1365 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 22 Jan 2026 12:50:22 +0100
-Subject: [PATCH] [codec,clear] check clear_decomress glyphData
-
-Backport of commit 243ecf804bb122e8e643a5c142ad5a49d7aa19ee.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
----
- libfreerdp/codec/clear.c | 50 +++++++++++++++++++++++++++++++++++++++-
- 1 file changed, 49 insertions(+), 1 deletion(-)
-
-diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
-index 4f0aead10..fcafb9235 100644
---- a/libfreerdp/codec/clear.c
-+++ b/libfreerdp/codec/clear.c
-@@ -1145,7 +1145,55 @@ INT32 clear_decompress(CLEAR_CONTEXT* clear, const BYTE* pSrcData, UINT32 SrcSiz
- 
- 	if (glyphData)
- 	{
--		if (!freerdp_image_copy(glyphData, clear->format, 0, 0, 0, nWidth, nHeight, pDstData,
-+		uint32_t w = MIN(nWidth, nDstWidth);
-+		if (nXDst > nDstWidth)
-+		{
-+			WLog_WARN(TAG, "glyphData copy area x exceeds destination: x=%" PRIu32 " > %" PRIu32,
-+			          nXDst, nDstWidth);
-+			w = 0;
-+		}
-+		else if (nXDst + w > nDstWidth)
-+		{
-+			WLog_WARN(TAG,
-+			          "glyphData copy area x + width exceeds destination: x=%" PRIu32 " + %" PRIu32
-+			          " > %" PRIu32,
-+			          nXDst, w, nDstWidth);
-+			w = nDstWidth - nXDst;
-+		}
-+
-+		if (w != nWidth)
-+		{
-+			WLog_WARN(TAG,
-+			          "glyphData copy area width truncated: requested=%" PRIu32
-+			          ", truncated to %" PRIu32,
-+			          nWidth, w);
-+		}
-+
-+		uint32_t h = MIN(nHeight, nDstHeight);
-+		if (nYDst > nDstHeight)
-+		{
-+			WLog_WARN(TAG, "glyphData copy area y exceeds destination: y=%" PRIu32 " > %" PRIu32,
-+			          nYDst, nDstHeight);
-+			h = 0;
-+		}
-+		else if (nYDst + h > nDstHeight)
-+		{
-+			WLog_WARN(TAG,
-+			          "glyphData copy area y + height exceeds destination: x=%" PRIu32 " + %" PRIu32
-+			          " > %" PRIu32,
-+			          nYDst, h, nDstHeight);
-+			h = nDstHeight - nYDst;
-+		}
-+
-+		if (h != nHeight)
-+		{
-+			WLog_WARN(TAG,
-+			          "glyphData copy area height truncated: requested=%" PRIu32
-+			          ", truncated to %" PRIu32,
-+			          nHeight, h);
-+		}
-+
-+		if (!freerdp_image_copy(glyphData, clear->format, 0, 0, 0, w, h, pDstData,
- 		                        DstFormat, nDstStep, nXDst, nYDst, palette, FREERDP_FLIP_NONE))
- 			goto fail;
- 	}
--- 
-2.52.0
-

SOURCES/codec-clear-fix-clear_resize_buffer-checks.patch

@@ -1,61 +0,0 @@
-From 00a593f9eda67212539e4dcac68ea5a699eb3e93 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 22 Jan 2026 12:48:37 +0100
-Subject: [PATCH] [codec,clear] fix clear_resize_buffer checks
-
-Backport of commit c4391827d7facfc874ca7f61a92afb82232a5748.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
----
- libfreerdp/codec/clear.c | 17 +++++++++--------
- 1 file changed, 9 insertions(+), 8 deletions(-)
-
-diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
-index e38fa0dcf..299acef2e 100644
---- a/libfreerdp/codec/clear.c
-+++ b/libfreerdp/codec/clear.c
-@@ -62,7 +62,7 @@ struct _CLEAR_CONTEXT
- 	NSC_CONTEXT* nsc;
- 	UINT32 seqNumber;
- 	BYTE* TempBuffer;
--	UINT32 TempSize;
-+	size_t TempSize;
- 	UINT32 nTempStep;
- 	UINT32 TempFormat;
- 	UINT32 format;
-@@ -313,24 +313,25 @@ static BOOL clear_decompress_subcode_rlex(wStream* s, UINT32 bitmapDataByteCount
- 
- static BOOL clear_resize_buffer(CLEAR_CONTEXT* clear, UINT32 width, UINT32 height)
- {
--	UINT32 size;
--
- 	if (!clear)
- 		return FALSE;
- 
--	size = ((width + 16) * (height + 16) * GetBytesPerPixel(clear->format));
-+	const UINT64 size = 1ull * (width + 16ull) * (height + 16ull);
-+	const size_t bpp = GetBytesPerPixel(clear->format);
-+	if (size > UINT32_MAX / bpp)
-+		return FALSE;
- 
--	if (size > clear->TempSize)
-+	if (size > clear->TempSize / bpp)
- 	{
--		BYTE* tmp = (BYTE*)realloc(clear->TempBuffer, size);
-+		BYTE* tmp = (BYTE*)realloc(clear->TempBuffer, size * bpp);
- 
- 		if (!tmp)
- 		{
--			WLog_ERR(TAG, "clear->TempBuffer realloc failed for %" PRIu32 " bytes", size);
-+			WLog_ERR(TAG, "clear->TempBuffer realloc failed for %" PRIu64 " bytes", size);
- 			return FALSE;
- 		}
- 
--		clear->TempSize = size;
-+		clear->TempSize = size * bpp;
- 		clear->TempBuffer = tmp;
- 	}
- 
--- 
-2.52.0
-

SOURCES/codec-clear-fix-destination-checks.patch

@@ -1,41 +0,0 @@
-From 7178a5554d7147a47fb7a85bba8c681f59e2a714 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 9 Mar 2026 13:55:29 +0100
-Subject: [PATCH] [codec,clear] fix destination checks
-
-Backport of commit 7d8fdce2d0ef337cb86cb37fc0c436c905e04d77.
-
-Made-with: Cursor
----
- libfreerdp/codec/clear.c | 11 ++++++-----
- 1 file changed, 6 insertions(+), 5 deletions(-)
-
-diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
-index a989a9bff..4dbe72376 100644
---- a/libfreerdp/codec/clear.c
-+++ b/libfreerdp/codec/clear.c
-@@ -494,15 +494,16 @@ static BOOL clear_decompress_subcodecs_data(CLEAR_CONTEXT* clear, wStream* s,
- 		nXDstRel = nXDst + xStart;
- 		nYDstRel = nYDst + yStart;
- 
--		if (width > nWidth)
-+		if (1ull * nXDstRel + width > nDstWidth)
- 		{
--			WLog_ERR(TAG, "width %" PRIu16 " > nWidth %" PRIu32 "", width, nWidth);
-+			WLog_ERR(TAG, "nXDstRel %" PRIu32 " + width %" PRIu16 " > nDstWidth %" PRIu32 "",
-+			         nXDstRel, width, nDstWidth);
- 			return FALSE;
- 		}
--
--		if (height > nHeight)
-+		if (1ull * nYDstRel + height > nDstHeight)
- 		{
--			WLog_ERR(TAG, "height %" PRIu16 " > nHeight %" PRIu32 "", height, nHeight);
-+			WLog_ERR(TAG, "nYDstRel %" PRIu32 " + height %" PRIu16 " > nDstHeight %" PRIu32 "",
-+			         nYDstRel, height, nDstHeight);
- 			return FALSE;
- 		}
- 
--- 
-2.53.0
-

SOURCES/codec-clear-fix-off-by-one-length-check.patch

@@ -1,35 +0,0 @@
-From 5b03db3926bd7bc1bf5819de068ed71a73b25236 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 22 Jan 2026 12:49:28 +0100
-Subject: [PATCH] [codec,clear] fix off by one length check
-
-Backport of commit f8688b57f6cfad9a0b05475a6afbde355ffab720.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
----
- libfreerdp/codec/clear.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
-index 09f5dad6d..4f0aead10 100644
---- a/libfreerdp/codec/clear.c
-+++ b/libfreerdp/codec/clear.c
-@@ -881,11 +881,14 @@ static BOOL clear_decompress_bands_data(CLEAR_CONTEXT* clear, wStream* s, UINT32
- 				if (count > nHeight)
- 					count = nHeight;
- 
--				if (nXDstRel + i > nDstWidth)
-+				if (nXDstRel + i >= nDstWidth)
- 					return FALSE;
- 
- 				for (UINT32 y = 0; y < count; y++)
- 				{
-+					if (nYDstRel + y >= nDstHeight)
-+						return FALSE;
-+
- 					BYTE* pDstPixel8 = &pDstData[((nYDstRel + y) * nDstStep) +
- 					                             ((nXDstRel + i) * GetBytesPerPixel(DstFormat))];
- 					UINT32 color = ReadColor(cpSrcPixel, clear->format);
--- 
-2.52.0
-

SOURCES/codec-clear-update-CLEAR_VBAR_ENTRY-size-after-alloc.patch

@@ -1,35 +0,0 @@
-From a2dde6d9832cb032e8cf12cab3da84dafbab9006 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Fri, 10 Apr 2026 11:32:09 +0200
-Subject: [PATCH] [codec,clear] update CLEAR_VBAR_ENTRY::size after alloc
-
-Backport of commit a2dde6d9832cb032e8cf12cab3da84dafbab9006.
-
-Made-with: Cursor
----
- libfreerdp/codec/clear.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
-index e38fa0d..eda30ad 100644
---- a/libfreerdp/codec/clear.c
-+++ b/libfreerdp/codec/clear.c
-@@ -565,7 +565,6 @@ static BOOL resize_vbar_entry(CLEAR_CONTEXT* clear, CLEAR_VBAR_ENTRY* vBarEntry)
- 		const UINT32 oldPos = vBarEntry->size * bpp;
- 		const UINT32 diffSize = (vBarEntry->count - vBarEntry->size) * bpp;
- 		BYTE* tmp;
--		vBarEntry->size = vBarEntry->count;
- 		tmp = (BYTE*)realloc(vBarEntry->pixels, 1ull * vBarEntry->count * bpp);
- 
- 		if (!tmp)
-@@ -576,6 +575,7 @@ static BOOL resize_vbar_entry(CLEAR_CONTEXT* clear, CLEAR_VBAR_ENTRY* vBarEntry)
- 
- 		memset(&tmp[oldPos], 0, diffSize);
- 		vBarEntry->pixels = tmp;
-+		vBarEntry->size = vBarEntry->count;
- 	}
- 
- 	if (!vBarEntry->pixels && vBarEntry->size)
--- 
-2.49.0
-

SOURCES/codec-clear-update-clear_glyph_entry-count-after-alloc.patch

@@ -1,57 +0,0 @@
-From 947feeadfddf01d30dda5aa16ebc335bfcc23ae0 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 29 Apr 2026 13:42:00 +0000
-Subject: [PATCH] [codec,clear] Update CLEAR_GLYPH_ENTRY::count after alloc
-
-Backport of commit c49d1ad43b8c7b32794d0250f2623c2dccd7ef25.
-
-Adapted for 2.11.7: uses GetBytesPerPixel instead of FreeRDPGetBytesPerPixel,
-plain realloc instead of winpr_aligned_recalloc; overflow checks match upstream
-(size_t count, hlimit / exceeded logging); glyphEntry->count set via (UINT32)cast
-after successful realloc.
-
-Made-with: Cursor
----
- libfreerdp/codec/clear.c | 22 +++++++++++++++++-----
- 1 file changed, 17 insertions(+), 5 deletions(-)
-
-diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
---- a/libfreerdp/codec/clear.c
-+++ b/libfreerdp/codec/clear.c
-@@ -979,20 +979,31 @@
- 	{
- 		const UINT32 bpp = GetBytesPerPixel(clear->format);
- 		CLEAR_GLYPH_ENTRY* glyphEntry = &(clear->GlyphCache[glyphIndex]);
--		glyphEntry->count = nWidth * nHeight;
-+		const size_t count = 1ull * nWidth * nHeight;
-+		const size_t hlimit = SIZE_MAX / ((nWidth > 0) ? nWidth : 1);
-+		if ((nWidth == 0) || (nHeight == 0) || (hlimit < nHeight))
-+		{
-+			const char* exceeded = (hlimit < nHeight) ? "within" : "outside";
-+			WLog_ERR(TAG,
-+			         "CLEARCODEC_FLAG_GLYPH_INDEX: nWidth=%" PRIu32 ", nHeight=%" PRIu32
-+			         ", nWidth * nHeight is %s allowed range",
-+			         nWidth, nHeight, exceeded);
-+			return FALSE;
-+		}
- 
--		if (glyphEntry->count > glyphEntry->size)
-+		if (count > glyphEntry->size)
- 		{
- 			BYTE* tmp;
--			tmp = realloc(glyphEntry->pixels, 1ull * glyphEntry->count * bpp);
-+			tmp = realloc(glyphEntry->pixels, 1ull * count * bpp);
- 
- 			if (!tmp)
- 			{
--				WLog_ERR(TAG, "glyphEntry->pixels realloc %" PRIu32 " failed!",
--				         glyphEntry->count * bpp);
-+				WLog_ERR(TAG, "glyphEntry->pixels realloc %" PRIuz " failed!",
-+				         count * bpp);
- 				return FALSE;
- 			}
- 
-+			glyphEntry->count = (UINT32)count;
- 			glyphEntry->size = glyphEntry->count;
- 			glyphEntry->pixels = (UINT32*)tmp;
- 		}

SOURCES/codec-color-add-freerdp_glyph_convert_ex.patch

@@ -1,114 +0,0 @@
-From b54003ad2dcb69b3c7836ae1445c48af8b39cd4c Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Sat, 28 Mar 2026 12:13:04 +0100
-Subject: [PATCH] [codec,color] add freerdp_glyph_convert_ex
-
-Backport of commit 3bc1eeb4f63ceec9a696af194e4c1ea0e67ff60c.
-
-Made-with: Cursor
----
- libfreerdp/codec/color.c  | 12 +++++++++--
- libfreerdp/gdi/graphics.c | 45 +++++++++++++++++++++++++++++++++++++++
- 2 files changed, 55 insertions(+), 2 deletions(-)
-
-diff --git a/libfreerdp/codec/color.c b/libfreerdp/codec/color.c
-index f8467c295..4c72ee3e6 100644
---- a/libfreerdp/codec/color.c
-+++ b/libfreerdp/codec/color.c
-@@ -28,6 +28,7 @@
- #include <stdlib.h>
- 
- #include <winpr/crt.h>
-+#include <winpr/assert.h>
- 
- #include <freerdp/log.h>
- #include <freerdp/freerdp.h>
-@@ -49,13 +50,20 @@ BYTE* freerdp_glyph_convert(UINT32 width, UINT32 height, const BYTE* data)
- 	const BYTE* srcp;
- 	BYTE* dstp;
- 	BYTE* dstData;
--	UINT32 scanline;
-+	size_t scanline;
-+
- 	/*
- 	 * converts a 1-bit-per-pixel glyph to a one-byte-per-pixel glyph:
- 	 * this approach uses a little more memory, but provides faster
- 	 * means of accessing individual pixels in blitting operations
- 	 */
--	scanline = (width + 7) / 8;
-+	scanline = (width + 7ull) / 8ull;
-+
-+	if ((width == 0) || (height == 0))
-+		return NULL;
-+
-+	WINPR_ASSERT(data);
-+
- 	dstData = (BYTE*)_aligned_malloc(1ull * width * height, 16);
- 
- 	if (!dstData)
-diff --git a/libfreerdp/gdi/graphics.c b/libfreerdp/gdi/graphics.c
-index 479eac9b8..dab159c43 100644
---- a/libfreerdp/gdi/graphics.c
-+++ b/libfreerdp/gdi/graphics.c
-@@ -23,6 +23,7 @@
- #include "config.h"
- #endif
- 
-+#include <winpr/assert.h>
- #include <winpr/crt.h>
- 
- #include <freerdp/log.h>
-@@ -215,6 +216,50 @@ static BOOL gdi_Bitmap_SetSurface(rdpContext* context, rdpBitmap* bitmap, BOOL p
- }
- 
- /* Glyph Class */
-+static BYTE* freerdp_glyph_convert_ex(UINT32 width, UINT32 height, const BYTE* data, size_t len)
-+{
-+	/*
-+	 * converts a 1-bit-per-pixel glyph to a one-byte-per-pixel glyph:
-+	 * this approach uses a little more memory, but provides faster
-+	 * means of accessing individual pixels in blitting operations
-+	 */
-+	const size_t scanline = (width + 7ull) / 8ull;
-+	const size_t required = scanline * height;
-+	if (len < required)
-+		return NULL;
-+
-+	if ((len == 0) || (width == 0) || (height == 0))
-+		return NULL;
-+
-+	WINPR_ASSERT(data);
-+
-+	BYTE* dstData = (BYTE*)_aligned_malloc(1ull * width * height, 16);
-+
-+	if (!dstData)
-+		return NULL;
-+
-+	ZeroMemory(dstData, 1ULL * width * height);
-+	BYTE* dstp = dstData;
-+
-+	for (UINT32 y = 0; y < height; y++)
-+	{
-+		const BYTE* srcp = &data[1ull * y * scanline];
-+
-+		for (UINT32 x = 0; x < width; x++)
-+		{
-+			if ((*srcp & (0x80 >> (x % 8))) != 0)
-+				*dstp = 0xFF;
-+
-+			dstp++;
-+
-+			if (((x + 1) % 8 == 0) && x != 0)
-+				srcp++;
-+		}
-+	}
-+
-+	return dstData;
-+}
-+
- static BOOL gdi_Glyph_New(rdpContext* context, const rdpGlyph* glyph)
- {
- 	BYTE* data;
--- 
-2.53.0
-

SOURCES/codec-dsp-add-format-checks.patch

@@ -1,218 +0,0 @@
-From 74ff8a097c3606710327e3af2863aa52d2dac79e Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 29 Apr 2026 15:10:00 +0000
-Subject: [PATCH] [codec,dsp] add format checks
-
-Backport of commit 03b48b3601d867afccac1cdc6081de7a275edce7.
-
-Adapted for 2.11.x: uses `context->format` instead of
-`context->common.format`, no `WINPR_RESTRICT`, added
-`#include <winpr/assert.h>`. Kept C89 declaration style in
-`freerdp_dsp_decode_mp3` and `freerdp_dsp_encode_mp3`. Omitted
-LAME/mp3 variable modernization. DVI_ADPCM block in
-`freerdp_dsp_context_reset` omits FramesPerPacket sizing from upstream 3.x
-but adds `Stream_SetPosition(context->buffer, 0)` after validation (same
-intent as upstream `Stream_ResetPosition`). `freerdp_dsp_decode_ima_adpcm`
-matches upstream order: validate format before locals; `out_size` uses
-`size * 4ull`. `Stream_BufferAs` replaced with
-`Stream_Buffer` cast. `nullptr` replaced with `NULL`.
-
-Made-with: Cursor
----
- libfreerdp/codec/dsp.c | 96 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 93 insertions(+), 4 deletions(-)
-
-diff --git a/libfreerdp/codec/dsp.c b/libfreerdp/codec/dsp.c
-index a18d044..e79911d 100644
---- a/libfreerdp/codec/dsp.c
-+++ b/libfreerdp/codec/dsp.c
-@@ -27,6 +27,7 @@
- #include <string.h>
- 
- #include <winpr/crt.h>
-+#include <winpr/assert.h>
- 
- #include <freerdp/types.h>
- #include <freerdp/log.h>
-@@ -329,13 +330,30 @@
- 	return (UINT16)d;
- }
- 
-+static BOOL valid_ima_adpcm_format(const FREERDP_DSP_CONTEXT* context)
-+{
-+	WINPR_ASSERT(context);
-+	if (context->format.wFormatTag != WAVE_FORMAT_DVI_ADPCM)
-+		return FALSE;
-+	if (context->format.nBlockAlign <= 4ULL)
-+		return FALSE;
-+	if (context->format.nChannels < 1)
-+		return FALSE;
-+	if (context->format.wBitsPerSample == 0)
-+		return FALSE;
-+	return TRUE;
-+}
-+
- static BOOL freerdp_dsp_decode_ima_adpcm(FREERDP_DSP_CONTEXT* context, const BYTE* src, size_t size,
-                                          wStream* out)
- {
-+	if (!valid_ima_adpcm_format(context))
-+		return FALSE;
-+
- 	BYTE* dst;
- 	BYTE sample;
- 	UINT16 decoded;
--	size_t out_size = size * 4;
-+	size_t out_size = size * 4ull;
- 	UINT32 channel;
- 	const UINT32 block_size = context->format.nBlockAlign;
- 	const UINT32 channels = context->format.nChannels;
-@@ -464,6 +482,20 @@
- #endif
- 
- #if defined(WITH_LAME)
-+static BOOL valid_mp3_format(const FREERDP_DSP_CONTEXT* context)
-+{
-+	WINPR_ASSERT(context);
-+	if (context->format.wFormatTag != WAVE_FORMAT_MPEGLAYER3)
-+		return FALSE;
-+	if (context->format.nChannels < 1)
-+		return FALSE;
-+	if (context->format.wBitsPerSample == 0)
-+		return FALSE;
-+	if (context->format.nSamplesPerSec == 0)
-+		return FALSE;
-+	return TRUE;
-+}
-+
- static BOOL freerdp_dsp_decode_mp3(FREERDP_DSP_CONTEXT* context, const BYTE* src, size_t size,
-                                    wStream* out)
- {
-@@ -474,6 +506,8 @@
- 
- 	if (!context || !src || !out)
- 		return FALSE;
-+	if (!valid_mp3_format(context))
-+		return FALSE;
- 
- 	buffer_size = 2 * context->format.nChannels * context->format.nSamplesPerSec;
- 
-@@ -509,6 +543,9 @@
- 	if (!context || !src || !out)
- 		return FALSE;
- 
-+	if (!valid_mp3_format(context))
-+		return FALSE;
-+
- 	samples_per_channel = size / context->format.nChannels / context->format.wBitsPerSample / 8;
- 
- 	/* Ensure worst case buffer size for mp3 stream taken from LAME header */
-@@ -716,6 +753,10 @@
- 	BYTE encoded;
- 	size_t out_size;
- 	size_t align;
-+
-+	if (!valid_ima_adpcm_format(context))
-+		return FALSE;
-+
- 	out_size = size / 2;
- 
- 	if (!Stream_EnsureRemainingCapacity(out, size))
-@@ -788,6 +829,20 @@
- 
- static const INT32 ms_adpcm_coeffs2[7] = { 0, -256, 0, 64, 0, -208, -232 };
- 
-+static BOOL valid_ms_adpcm_format(const FREERDP_DSP_CONTEXT* context)
-+{
-+	WINPR_ASSERT(context);
-+	if (context->format.wFormatTag != WAVE_FORMAT_ADPCM)
-+		return FALSE;
-+	if (context->format.nBlockAlign <= 4ULL)
-+		return FALSE;
-+	if (context->format.nChannels < 1)
-+		return FALSE;
-+	if (context->format.wBitsPerSample == 0)
-+		return FALSE;
-+	return TRUE;
-+}
-+
- static INLINE INT16 freerdp_dsp_decode_ms_adpcm_sample(ADPCM* adpcm, BYTE sample, int channel)
- {
- 	INT8 nibble;
-@@ -819,6 +874,9 @@
- 	BYTE* dst;
- 	BYTE sample;
- 	const size_t out_size = size * 4;
-+
-+	if (!valid_ms_adpcm_format(context))
-+		return FALSE;
- 	const UINT32 channels = context->format.nChannels;
- 	const UINT32 block_size = context->format.nBlockAlign;
- 
-@@ -947,6 +1005,10 @@
- 	INT32 sample;
- 	size_t out_size;
- 	const size_t step = 8 + ((context->format.nChannels > 1) ? 4 : 0);
-+
-+	if (!valid_ms_adpcm_format(context))
-+		return FALSE;
-+
- 	out_size = size / 2;
- 
- 	if (!Stream_EnsureRemainingCapacity(out, size))
-@@ -1308,6 +1370,28 @@
- 		return FALSE;
- 
- 	context->format = *targetFormat;
-+
-+	switch (context->format.wFormatTag)
-+	{
-+#if defined(WITH_LAME)
-+		case WAVE_FORMAT_MPEGLAYER3:
-+			if (!valid_mp3_format(context))
-+				return FALSE;
-+			break;
-+#endif
-+		case WAVE_FORMAT_ADPCM:
-+			if (!valid_ms_adpcm_format(context))
-+				return FALSE;
-+			break;
-+		case WAVE_FORMAT_DVI_ADPCM:
-+			if (!valid_ima_adpcm_format(context))
-+				return FALSE;
-+			Stream_SetPosition(context->buffer, 0);
-+			break;
-+		default:
-+			break;
-+	}
-+
- #if defined(WITH_FAAD2)
- 	context->faadSetup = FALSE;
- #endif
-@@ -1328,19 +1412,24 @@
- 
- 		cfg = faacEncGetCurrentConfiguration(context->faac);
- 		cfg->bitRate = 10000;
--		faacEncSetConfiguration(context->faac, cfg);
-+		{
-+			const int frc = faacEncSetConfiguration(context->faac, cfg);
-+			if (frc <= 0)
-+				return FALSE;
-+		}
- 	}
- 
- #endif
- #if defined(WITH_SOXR)
- 	{
- 		soxr_io_spec_t iospec = soxr_io_spec(SOXR_INT16, SOXR_INT16);
--		soxr_error_t error;
-+		soxr_error_t error = NULL;
-+
- 		soxr_delete(context->sox);
- 		context->sox = soxr_create(context->format.nSamplesPerSec, targetFormat->nSamplesPerSec,
- 		                           targetFormat->nChannels, &error, &iospec, NULL, NULL);
- 
--		if (!context->sox || (error != 0))
-+		if (!context->sox || (error != NULL))
- 			return FALSE;
- 	}
- #endif

SOURCES/codec-dsp-fix-array-bounds-checks.patch

@@ -1,237 +0,0 @@
-From aaf333862fb54d4cfc19a1866b76500d86679719 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 28 Apr 2026 04:41:15 +0000
-Subject: [PATCH] [codec,dsp] fix array bounds checks
-
-Backport of commit 16df2300e1e3f5a51f68fb1626429e58b531b7c8.
-
-Adapted for 2.11.x: uses C89 declaration style (variables declared
-at top of scope, new variables wrapped in blocks), no
-`WINPR_RESTRICT`, kept `int channel` in decode function,
-`dsp_encode_ima_adpcm_sample` keeps `int channel`.
-
-Made-with: Cursor
----
- libfreerdp/codec/dsp.c | 91 +++++++++++++++++++++++++++++++++++++-----
- 1 file changed, 82 insertions(+), 9 deletions(-)
-
-diff --git a/libfreerdp/codec/dsp.c b/libfreerdp/codec/dsp.c
-index e79911d..6d4f780 100644
---- a/libfreerdp/codec/dsp.c
-+++ b/libfreerdp/codec/dsp.c
-@@ -297,7 +297,16 @@ static UINT16 dsp_decode_ima_adpcm_sample(ADPCM* adpcm, unsigned int channel, BY
- {
- 	INT32 ss;
- 	INT32 d;
--	ss = ima_step_size_table[adpcm->ima.last_step[channel]];
-+	INT16 offset;
-+
-+	WINPR_ASSERT(channel < ARRAYSIZE(adpcm->ima.last_step));
-+	WINPR_ASSERT(channel < ARRAYSIZE(adpcm->ima.last_sample));
-+
-+	offset = adpcm->ima.last_step[channel];
-+	WINPR_ASSERT(offset >= 0);
-+	WINPR_ASSERT(offset < ARRAYSIZE(ima_step_size_table));
-+
-+	ss = ima_step_size_table[offset];
- 	d = (ss >> 3);
- 
- 	if (sample & 1)
-@@ -320,6 +329,8 @@ static UINT16 dsp_decode_ima_adpcm_sample(ADPCM* adpcm, unsigned int channel, BY
- 		d = 32767;
- 
- 	adpcm->ima.last_sample[channel] = (INT16)d;
-+
-+	WINPR_ASSERT(sample < ARRAYSIZE(ima_step_index_table));
- 	adpcm->ima.last_step[channel] += ima_step_index_table[sample];
- 
- 	if (adpcm->ima.last_step[channel] < 0)
-@@ -368,6 +379,9 @@ static BOOL freerdp_dsp_decode_ima_adpcm(FREERDP_DSP_CONTEXT* context, const BYT
- 	{
- 		if (size % block_size == 0)
- 		{
-+			if (size < 4)
-+				return FALSE;
-+
- 			context->adpcm.ima.last_sample[0] =
- 			    (INT16)(((UINT16)(*src)) | (((UINT16)(*(src + 1))) << 8));
- 			context->adpcm.ima.last_step[0] = (INT16)(*(src + 2));
-@@ -377,6 +391,8 @@ static BOOL freerdp_dsp_decode_ima_adpcm(FREERDP_DSP_CONTEXT* context, const BYT
- 
- 			if (channels > 1)
- 			{
-+				if (size < 4)
-+					return FALSE;
- 				context->adpcm.ima.last_sample[1] =
- 				    (INT16)(((UINT16)(*src)) | (((UINT16)(*(src + 1))) << 8));
- 				context->adpcm.ima.last_step[1] = (INT16)(*(src + 2));
-@@ -388,6 +404,8 @@ static BOOL freerdp_dsp_decode_ima_adpcm(FREERDP_DSP_CONTEXT* context, const BYT
- 
- 		if (channels > 1)
- 		{
-+			if (size < 8)
-+				return FALSE;
- 			for (i = 0; i < 8; i++)
- 			{
- 				channel = (i < 4 ? 0 : 1);
-@@ -407,6 +425,8 @@ static BOOL freerdp_dsp_decode_ima_adpcm(FREERDP_DSP_CONTEXT* context, const BYT
- 		}
- 		else
- 		{
-+			if (size < 1)
-+				return FALSE;
- 			sample = ((*src) & 0x0f);
- 			decoded = dsp_decode_ima_adpcm_sample(&context->adpcm, 0, sample);
- 			*dst++ = (decoded & 0xFF);
-@@ -687,7 +707,16 @@ static BYTE dsp_encode_ima_adpcm_sample(ADPCM* adpcm, int channel, INT16 sample)
- 	INT32 ss;
- 	BYTE enc;
- 	INT32 diff;
--	ss = ima_step_size_table[adpcm->ima.last_step[channel]];
-+	INT16 offset;
-+
-+	WINPR_ASSERT(channel < ARRAYSIZE(adpcm->ima.last_step));
-+	WINPR_ASSERT(channel < ARRAYSIZE(adpcm->ima.last_sample));
-+
-+	offset = adpcm->ima.last_step[channel];
-+	WINPR_ASSERT(offset >= 0);
-+	WINPR_ASSERT(offset < ARRAYSIZE(ima_step_size_table));
-+
-+	ss = ima_step_size_table[offset];
- 	d = e = sample - adpcm->ima.last_sample[channel];
- 	diff = ss >> 3;
- 	enc = 0;
-@@ -733,6 +762,8 @@ static BYTE dsp_encode_ima_adpcm_sample(ADPCM* adpcm, int channel, INT16 sample)
- 		diff = 32767;
- 
- 	adpcm->ima.last_sample[channel] = (INT16)diff;
-+
-+	WINPR_ASSERT(enc < ARRAYSIZE(ima_step_index_table));
- 	adpcm->ima.last_step[channel] += ima_step_index_table[enc];
- 
- 	if (adpcm->ima.last_step[channel] < 0)
-@@ -847,10 +878,24 @@ static INLINE INT16 freerdp_dsp_decode_ms_adpcm_sample(ADPCM* adpcm, BYTE sample
- {
- 	INT8 nibble;
- 	INT32 presample;
-+	BYTE predictor;
-+	INT32 coeff1 = 0;
-+	INT32 coeff2 = 0;
-+
-+	WINPR_ASSERT(channel < ARRAYSIZE(adpcm->ms.sample1));
-+	WINPR_ASSERT(channel < ARRAYSIZE(adpcm->ms.sample2));
-+	WINPR_ASSERT(channel < ARRAYSIZE(adpcm->ms.delta));
-+	WINPR_ASSERT(channel < ARRAYSIZE(adpcm->ms.predictor));
-+
- 	nibble = (sample & 0x08 ? (INT8)sample - 16 : (INT8)sample);
--	presample = ((adpcm->ms.sample1[channel] * ms_adpcm_coeffs1[adpcm->ms.predictor[channel]]) +
--	             (adpcm->ms.sample2[channel] * ms_adpcm_coeffs2[adpcm->ms.predictor[channel]])) /
--	            256;
-+	predictor = adpcm->ms.predictor[channel];
-+	if (predictor < ARRAYSIZE(ms_adpcm_coeffs1))
-+		coeff1 = ms_adpcm_coeffs1[predictor];
-+
-+	if (predictor < ARRAYSIZE(ms_adpcm_coeffs2))
-+		coeff2 = ms_adpcm_coeffs2[predictor];
-+	presample =
-+	    ((adpcm->ms.sample1[channel] * coeff1) + (adpcm->ms.sample2[channel] * coeff2)) / 256;
- 	presample += nibble * adpcm->ms.delta[channel];
- 
- 	if (presample > 32767)
-@@ -860,7 +905,14 @@ static INLINE INT16 freerdp_dsp_decode_ms_adpcm_sample(ADPCM* adpcm, BYTE sample
- 
- 	adpcm->ms.sample2[channel] = adpcm->ms.sample1[channel];
- 	adpcm->ms.sample1[channel] = presample;
--	adpcm->ms.delta[channel] = adpcm->ms.delta[channel] * ms_adpcm_adaptation_table[sample] / 256;
-+
-+	{
-+		INT32 tableval = 0;
-+		if (sample < ARRAYSIZE(ms_adpcm_adaptation_table))
-+			tableval = ms_adpcm_adaptation_table[sample];
-+
-+		adpcm->ms.delta[channel] = adpcm->ms.delta[channel] * tableval / 256;
-+	}
- 
- 	if (adpcm->ms.delta[channel] < 16)
- 		adpcm->ms.delta[channel] = 16;
-@@ -891,6 +943,9 @@ static BOOL freerdp_dsp_decode_ms_adpcm(FREERDP_DSP_CONTEXT* context, const BYTE
- 		{
- 			if (channels > 1)
- 			{
-+				if (size < 14)
-+					return FALSE;
-+
- 				context->adpcm.ms.predictor[0] = *src++;
- 				context->adpcm.ms.predictor[1] = *src++;
- 				context->adpcm.ms.delta[0] = read_int16(src);
-@@ -917,6 +972,9 @@ static BOOL freerdp_dsp_decode_ms_adpcm(FREERDP_DSP_CONTEXT* context, const BYTE
- 			}
- 			else
- 			{
-+				if (size < 7)
-+					return FALSE;
-+
- 				context->adpcm.ms.predictor[0] = *src++;
- 				context->adpcm.ms.delta[0] = read_int16(src);
- 				src += 2;
-@@ -934,12 +992,16 @@ static BOOL freerdp_dsp_decode_ms_adpcm(FREERDP_DSP_CONTEXT* context, const BYTE
- 
- 		if (channels > 1)
- 		{
-+			if (size < 1)
-+				return FALSE;
- 			sample = *src++;
- 			size--;
- 			write_int16(dst, freerdp_dsp_decode_ms_adpcm_sample(&context->adpcm, sample >> 4, 0));
- 			dst += 2;
- 			write_int16(dst, freerdp_dsp_decode_ms_adpcm_sample(&context->adpcm, sample & 0x0F, 1));
- 			dst += 2;
-+			if (size < 1)
-+				return FALSE;
- 			sample = *src++;
- 			size--;
- 			write_int16(dst, freerdp_dsp_decode_ms_adpcm_sample(&context->adpcm, sample >> 4, 0));
-@@ -949,6 +1011,8 @@ static BOOL freerdp_dsp_decode_ms_adpcm(FREERDP_DSP_CONTEXT* context, const BYTE
- 		}
- 		else
- 		{
-+			if (size < 1)
-+				return FALSE;
- 			sample = *src++;
- 			size--;
- 			write_int16(dst, freerdp_dsp_decode_ms_adpcm_sample(&context->adpcm, sample >> 4, 0));
-@@ -962,10 +1026,16 @@ static BOOL freerdp_dsp_decode_ms_adpcm(FREERDP_DSP_CONTEXT* context, const BYTE
- 	return TRUE;
- }
- 
--static BYTE freerdp_dsp_encode_ms_adpcm_sample(ADPCM* adpcm, INT32 sample, int channel)
-+static BYTE freerdp_dsp_encode_ms_adpcm_sample(ADPCM* adpcm, INT32 sample, size_t channel)
- {
- 	INT32 presample;
- 	INT32 errordelta;
-+
-+	WINPR_ASSERT(channel < ARRAYSIZE(adpcm->ms.sample1));
-+	WINPR_ASSERT(channel < ARRAYSIZE(adpcm->ms.sample2));
-+	WINPR_ASSERT(channel < ARRAYSIZE(adpcm->ms.delta));
-+	WINPR_ASSERT(channel < ARRAYSIZE(adpcm->ms.predictor));
-+
- 	presample = ((adpcm->ms.sample1[channel] * ms_adpcm_coeffs1[adpcm->ms.predictor[channel]]) +
- 	             (adpcm->ms.sample2[channel] * ms_adpcm_coeffs2[adpcm->ms.predictor[channel]])) /
- 	            256;
-@@ -988,8 +1058,11 @@ static BYTE freerdp_dsp_encode_ms_adpcm_sample(ADPCM* adpcm, INT32 sample, int c
- 
- 	adpcm->ms.sample2[channel] = adpcm->ms.sample1[channel];
- 	adpcm->ms.sample1[channel] = presample;
--	adpcm->ms.delta[channel] =
--	    adpcm->ms.delta[channel] * ms_adpcm_adaptation_table[(((BYTE)errordelta) & 0x0F)] / 256;
-+	{
-+		const size_t offset = (((BYTE)errordelta) & 0x0F);
-+		WINPR_ASSERT(offset < ARRAYSIZE(ms_adpcm_adaptation_table));
-+		adpcm->ms.delta[channel] = adpcm->ms.delta[channel] * ms_adpcm_adaptation_table[offset] / 256;
-+	}
- 
- 	if (adpcm->ms.delta[channel] < 16)
- 		adpcm->ms.delta[channel] = 16;
--- 
-2.53.0
-

SOURCES/codec-nsc-fix-use-of-nsc_process_message.patch

@@ -1,90 +0,0 @@
-From 21cb0e2b96e4e86b4ed8b7a76d819808b898e93e Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 31 Mar 2026 07:08:04 +0200
-Subject: [PATCH] [codec,nsc] fix use of nsc_process_message
-
-Backport of commit 169971607cece48384cb94632b829bd57336af0f.
-
-Made-with: Cursor
----
- libfreerdp/codec/clear.c | 10 ++++++----
- libfreerdp/codec/nsc.c   |  9 ++++++++-
- libfreerdp/gdi/gdi.c     |  4 ++--
- 3 files changed, 16 insertions(+), 7 deletions(-)
-
-diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
-index 4dbe72376..6627b21d6 100644
---- a/libfreerdp/codec/clear.c
-+++ b/libfreerdp/codec/clear.c
-@@ -103,7 +103,8 @@ static BOOL convert_color(BYTE* dst, UINT32 nDstStep, UINT32 DstFormat, UINT32 n
- 
- static BOOL clear_decompress_nscodec(NSC_CONTEXT* nsc, UINT32 width, UINT32 height, wStream* s,
-                                      UINT32 bitmapDataByteCount, BYTE* pDstData, UINT32 DstFormat,
--                                     UINT32 nDstStep, UINT32 nXDstRel, UINT32 nYDstRel)
-+                                     UINT32 nDstStep, UINT32 nXDstRel, UINT32 nYDstRel,
-+                                     UINT32 nDstWidth, UINT32 nDstHeight)
- {
- 	BOOL rc;
- 
-@@ -115,8 +116,8 @@ static BOOL clear_decompress_nscodec(NSC_CONTEXT* nsc, UINT32 width, UINT32 heig
- 	}
- 
- 	rc = nsc_process_message(nsc, 32, width, height, Stream_Pointer(s), bitmapDataByteCount,
--	                         pDstData, DstFormat, nDstStep, nXDstRel, nYDstRel, width, height,
--	                         FREERDP_FLIP_NONE);
-+	                         pDstData, DstFormat, nDstStep, nXDstRel, nYDstRel, nDstWidth,
-+	                         nDstHeight, FREERDP_FLIP_NONE);
- 	Stream_Seek(s, bitmapDataByteCount);
- 	return rc;
- }
-@@ -535,7 +536,8 @@ static BOOL clear_decompress_subcodecs_data(CLEAR_CONTEXT* clear, wStream* s,
- 
- 			case 1: /* NSCodec */
- 				if (!clear_decompress_nscodec(clear->nsc, width, height, s, bitmapDataByteCount,
--				                              pDstData, DstFormat, nDstStep, nXDstRel, nYDstRel))
-+				                              pDstData, DstFormat, nDstStep, nXDstRel, nYDstRel,
-+				                              nDstWidth, nDstHeight))
- 					return FALSE;
- 
- 				break;
-diff --git a/libfreerdp/codec/nsc.c b/libfreerdp/codec/nsc.c
-index a257ae24a..f50a1ae89 100644
---- a/libfreerdp/codec/nsc.c
-+++ b/libfreerdp/codec/nsc.c
-@@ -447,10 +447,17 @@ BOOL nsc_process_message(NSC_CONTEXT* context, UINT16 bpp, UINT32 width, UINT32
-                          UINT32 nDstStride, UINT32 nXDst, UINT32 nYDst, UINT32 nWidth,
-                          UINT32 nHeight, UINT32 flip)
- {
-+	WINPR_ASSERT(context);
-+	WINPR_ASSERT(context->priv);
-+
- 	wStream* s;
- 	BOOL ret;
--	if (!context || !data || !pDstData)
-+	if (!data || !pDstData)
-+	{
-+		WLog_Print(context->priv->log, WLOG_ERROR, "Invalid argument: data=%p, pDstData=%p",
-+		           (const void*)data, (void*)pDstData);
- 		return FALSE;
-+	}
- 
- 	s = Stream_New((BYTE*)data, length);
- 
-diff --git a/libfreerdp/gdi/gdi.c b/libfreerdp/gdi/gdi.c
-index 37a010431..8c5e4bf34 100644
---- a/libfreerdp/gdi/gdi.c
-+++ b/libfreerdp/gdi/gdi.c
-@@ -1074,8 +1074,8 @@ static BOOL gdi_surface_bits(rdpContext* context, const SURFACE_BITS_COMMAND* cm
- 			if (!nsc_process_message(
- 			        context->codecs->nsc, cmd->bmp.bpp, cmd->bmp.width, cmd->bmp.height,
- 			        cmd->bmp.bitmapData, cmd->bmp.bitmapDataLength, gdi->primary_buffer, format,
--			        gdi->stride, cmdRect.left, cmdRect.top, cmdRect.right - cmdRect.left,
--			        cmdRect.bottom - cmdRect.top, FREERDP_FLIP_VERTICAL))
-+			        gdi->stride, cmdRect.left, cmdRect.top, (UINT32)gdi->width, (UINT32)gdi->height,
-+			        FREERDP_FLIP_VERTICAL))
- 			{
- 				WLog_ERR(TAG, "Failed to process NSCodec message");
- 				goto out;
--- 
-2.53.0
-

SOURCES/codec-nsc-limit-copy-area-in-nsc_process_message.patch

@@ -1,44 +0,0 @@
-From 9a9e00529b1b04718370a1d8e2d8b6768c9ee913 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 16 Mar 2026 14:59:12 +0100
-Subject: [PATCH] [codec,nsc] limit copy area in nsc_process_message
-
-Backport of commit 83d9aedea278a74af3e490ff5eeb889c016dbb2b.
-
-Made-with: Cursor
----
- libfreerdp/codec/nsc.c | 11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/libfreerdp/codec/nsc.c b/libfreerdp/codec/nsc.c
-index 5dd2646ea..a257ae24a 100644
---- a/libfreerdp/codec/nsc.c
-+++ b/libfreerdp/codec/nsc.c
-@@ -24,6 +24,7 @@
- #include "config.h"
- #endif
- 
-+#include <stdint.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <string.h>
-@@ -515,7 +516,15 @@ BOOL nsc_process_message(NSC_CONTEXT* context, UINT16 bpp, UINT32 width, UINT32
- 			return FALSE;
- 	}
- 
--	if (!freerdp_image_copy(pDstData, DstFormat, nDstStride, nXDst, nYDst, width, height,
-+	uint32_t cwidth = width;
-+	if (1ull * nXDst + width > nWidth)
-+		cwidth = nWidth - nXDst;
-+
-+	uint32_t cheight = height;
-+	if (1ull * nYDst + height > nHeight)
-+		cheight = nHeight - nYDst;
-+
-+	if (!freerdp_image_copy(pDstData, DstFormat, nDstStride, nXDst, nYDst, cwidth, cheight,
- 	                        context->BitmapData, PIXEL_FORMAT_BGRA32, 0, 0, 0, NULL, flip))
- 		return FALSE;
- 
--- 
-2.53.0
-

SOURCES/codec-planar-fix-bounds-checks.patch

@@ -1,31 +0,0 @@
-From 836d5b6f6d305ba6542fac8ba2d16b2e4e8b13a7 Mon Sep 17 00:00:00 2001
-From: Armin Novak <armin.novak@thincast.com>
-Date: Thu, 30 Apr 2026 15:03:21 +0200
-Subject: [PATCH] [codec,planar] fix bounds checks
-
----
- libfreerdp/codec/planar.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/libfreerdp/codec/planar.c b/libfreerdp/codec/planar.c
-index 9b4d13057..67fc4212e 100644
---- a/libfreerdp/codec/planar.c
-+++ b/libfreerdp/codec/planar.c
-@@ -841,12 +841,12 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
- 				return FALSE;
- 			}
- 
--			if ((nXDst + nSrcWidth) * bpp > nDstStep)
-+			if ((nXDst + nSrcWidth) * bpp > nTempStep)
- 			{
- 				WLog_ERR(TAG,
- 				         "planar plane destination (X %" PRIu32 " + width %" PRIu32
- 				         ") * bpp %" PRIu32 " exceeds stride %" PRIu32,
--				         nXDst, nSrcWidth, bpp, nDstStep);
-+				         nXDst, nSrcWidth, bpp, nTempStep);
- 				return FALSE;
- 			}
- 
--- 
-2.52.0
-

SOURCES/codec-planar-fix-decoder-length-checks.patch

@@ -1,31 +0,0 @@
-From 2d656eb6b29a68de7f19e8a1cce169259e7506b4 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 27 Jan 2026 14:35:43 +0100
-Subject: [PATCH] [codec,planar] fix decoder length checks
-
-Backport of commit 1bab198a2edd0d0e6e1627d21a433151ea190.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
----
- libfreerdp/codec/planar.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/libfreerdp/codec/planar.c b/libfreerdp/codec/planar.c
-index fe27011e1..1cb2e22bc 100644
---- a/libfreerdp/codec/planar.c
-+++ b/libfreerdp/codec/planar.c
-@@ -616,6 +616,11 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
- 	WINPR_ASSERT(planar);
- 	WINPR_ASSERT(prims);
- 
-+	if (planar->maxWidth < nSrcWidth)
-+		return FALSE;
-+	if (planar->maxHeight < nSrcHeight)
-+		return FALSE;
-+
- 	if (nDstStep <= 0)
- 		nDstStep = nDstWidth * GetBytesPerPixel(DstFormat);
- 
--- 
-2.52.0
-

SOURCES/codec-planar-fix-missing-destination-bounds-checks.patch

@@ -1,55 +0,0 @@
-From eca8a1a876b77de5da60b18793e35e5c0714ef97 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 9 Mar 2026 12:56:11 +0100
-Subject: [PATCH] [codec,planar]: fix missing destination bounds checks
-
-Backport of commit a0be5cb87d760bb1c803ad1bb835aa1e73e62abc.
-
-Made-with: Cursor
----
- libfreerdp/codec/planar.c | 21 ++++++++++++++++++++-
- 1 file changed, 20 insertions(+), 1 deletion(-)
-
-diff --git a/libfreerdp/codec/planar.c b/libfreerdp/codec/planar.c
-index 1cb2e22bc..9b4d13057 100644
---- a/libfreerdp/codec/planar.c
-+++ b/libfreerdp/codec/planar.c
-@@ -621,8 +621,9 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
- 	if (planar->maxHeight < nSrcHeight)
- 		return FALSE;
- 
-+	const UINT32 bpp = GetBytesPerPixel(DstFormat);
- 	if (nDstStep <= 0)
--		nDstStep = nDstWidth * GetBytesPerPixel(DstFormat);
-+		nDstStep = nDstWidth * bpp;
- 
- 	srcp = pSrcData;
- 
-@@ -831,6 +832,24 @@ BOOL planar_decompress(BITMAP_PLANAR_CONTEXT* planar, const BYTE* pSrcData, UINT
- 		}
- 		else /* RLE */
- 		{
-+			if (nYDst + nSrcHeight > nTotalHeight)
-+			{
-+				WLog_ERR(TAG,
-+				         "planar plane destination Y %" PRIu32 " + height %" PRIu32
-+				         " exceeds totalHeight %" PRIu32,
-+				         nYDst, nSrcHeight, nTotalHeight);
-+				return FALSE;
-+			}
-+
-+			if ((nXDst + nSrcWidth) * bpp > nDstStep)
-+			{
-+				WLog_ERR(TAG,
-+				         "planar plane destination (X %" PRIu32 " + width %" PRIu32
-+				         ") * bpp %" PRIu32 " exceeds stride %" PRIu32,
-+				         nXDst, nSrcWidth, bpp, nDstStep);
-+				return FALSE;
-+			}
-+
- 			status =
- 			    planar_decompress_plane_rle(planes[0], rleSizes[0], pTempData, nTempStep, nXDst,
- 			                                nYDst, nSrcWidth, nSrcHeight, 2, vFlip); /* RedPlane */
--- 
-2.53.0
-

SOURCES/codec-progressive-fail-progressive_rfx_quant_sub-on-invalid-values.patch

@@ -1,89 +0,0 @@
-From 78188ab479c8e6eb9ba2475b3732c76b4bbe5425 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 13 Apr 2026 14:00:00 +0200
-Subject: [PATCH] [codec,progressive] Fail progressive_rfx_quant_sub on invalid
- values
-
-Backport of commit 78188ab479c8e6eb9ba2475b3732c76b4bbe5425.
-
-Made-with: Cursor
----
- libfreerdp/codec/progressive.c | 42 ++++++++++++++++++++++++++++++----
- 1 file changed, 38 insertions(+), 4 deletions(-)
-
-diff --git a/libfreerdp/codec/progressive.c b/libfreerdp/codec/progressive.c
-index 8894b35..bbcc921 100644
---- a/libfreerdp/codec/progressive.c
-+++ b/libfreerdp/codec/progressive.c
-@@ -155,20 +155,51 @@ static INLINE void progressive_rfx_quant_lsub(RFX_COMPONENT_CODEC_QUANT* q, int
- 	q->LL3 -= val; /* LL3 */
- }
- 
--static INLINE void progressive_rfx_quant_sub(const RFX_COMPONENT_CODEC_QUANT* q1,
-+static INLINE BOOL progressive_rfx_quant_sub(const RFX_COMPONENT_CODEC_QUANT* q1,
-                                              const RFX_COMPONENT_CODEC_QUANT* q2,
-                                              RFX_COMPONENT_CODEC_QUANT* dst)
- {
-+	if (q1->HH1 < q2->HL1)
-+		return FALSE;
- 	dst->HL1 = q1->HL1 - q2->HL1; /* HL1 */
-+
-+	if (q1->LH1 < q2->LH1)
-+		return FALSE;
- 	dst->LH1 = q1->LH1 - q2->LH1; /* LH1 */
-+
-+	if (q1->HH1 < q2->HH1)
-+		return FALSE;
- 	dst->HH1 = q1->HH1 - q2->HH1; /* HH1 */
-+
-+	if (q1->HL2 < q2->HL2)
-+		return FALSE;
- 	dst->HL2 = q1->HL2 - q2->HL2; /* HL2 */
-+
-+	if (q1->LH2 < q2->LH2)
-+		return FALSE;
- 	dst->LH2 = q1->LH2 - q2->LH2; /* LH2 */
-+
-+	if (q1->HH2 < q2->HH2)
-+		return FALSE;
- 	dst->HH2 = q1->HH2 - q2->HH2; /* HH2 */
-+
-+	if (q1->HL3 < q2->HL3)
-+		return FALSE;
- 	dst->HL3 = q1->HL3 - q2->HL3; /* HL3 */
-+
-+	if (q1->LH3 < q2->LH3)
-+		return FALSE;
- 	dst->LH3 = q1->LH3 - q2->LH3; /* LH3 */
-+
-+	if (q1->HH3 < q2->HH3)
-+		return FALSE;
- 	dst->HH3 = q1->HH3 - q2->HH3; /* HH3 */
-+
-+	if (q1->LL3 < q2->LL3)
-+		return FALSE;
- 	dst->LL3 = q1->LL3 - q2->LL3; /* LL3 */
-+
-+	return TRUE;
- }
- 
- static INLINE BOOL progressive_rfx_quant_lcmp_less_equal(const RFX_COMPONENT_CODEC_QUANT* q,
-@@ -1433,9 +1464,12 @@ static INLINE int progressive_decompress_tile_upgrade(PROGRESSIVE_CONTEXT* progr
- 	progressive_rfx_quant_add(quantY, quantProgY, &yBitPos);
- 	progressive_rfx_quant_add(quantCb, quantProgCb, &cbBitPos);
- 	progressive_rfx_quant_add(quantCr, quantProgCr, &crBitPos);
--	progressive_rfx_quant_sub(&(tile->yBitPos), &yBitPos, &yNumBits);
--	progressive_rfx_quant_sub(&(tile->cbBitPos), &cbBitPos, &cbNumBits);
--	progressive_rfx_quant_sub(&(tile->crBitPos), &crBitPos, &crNumBits);
-+	if (!progressive_rfx_quant_sub(&(tile->yBitPos), &yBitPos, &yNumBits))
-+		goto fail;
-+	if (!progressive_rfx_quant_sub(&(tile->cbBitPos), &cbBitPos, &cbNumBits))
-+		goto fail;
-+	if (!progressive_rfx_quant_sub(&(tile->crBitPos), &crBitPos, &crNumBits))
-+		goto fail;
- 	progressive_rfx_quant_add(quantY, quantProgY, &shiftY);
- 	progressive_rfx_quant_lsub(&shiftY, 1); /* -6 + 5 = -1 */
- 	progressive_rfx_quant_add(quantCb, quantProgCb, &shiftCb);
--- 
-2.49.0
-

SOURCES/codec-progressive-fix-underflow-guard-in-progressive_rfx_quant_sub.patch

@@ -1,29 +0,0 @@
-From 78677dc6e262f46937d00c3aa52381e4bb198fa5 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Mon, 13 Apr 2026 14:00:00 +0200
-Subject: [PATCH] [codec,progressive] fix underflow guard in
- progressive_rfx_quant_sub
-
-Backport of commit 78677dc6e262f46937d00c3aa52381e4bb198fa5.
-
-Made-with: Cursor
----
- libfreerdp/codec/progressive.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libfreerdp/codec/progressive.c b/libfreerdp/codec/progressive.c
-index bbcc921..1234567 100644
---- a/libfreerdp/codec/progressive.c
-+++ b/libfreerdp/codec/progressive.c
-@@ -158,7 +158,7 @@ static INLINE BOOL progressive_rfx_quant_sub(const RFX_COMPONENT_CODEC_QUANT* q1
-                                              const RFX_COMPONENT_CODEC_QUANT* q2,
-                                              RFX_COMPONENT_CODEC_QUANT* dst)
- {
--	if (q1->HH1 < q2->HL1)
-+	if (q1->HL1 < q2->HL1)
- 		return FALSE;
- 	dst->HL1 = q1->HL1 - q2->HL1; /* HL1 */
- 
--- 
-2.49.0
-

SOURCES/core-gateway-ensure-buffer-size-for-current-write.patch

@@ -1,22 +0,0 @@
-From 6a86f00d7c20de8eb4255f0450c4ddccb009fdef Mon Sep 17 00:00:00 2001
-From: Armin Novak <armin.novak@thincast.com>
-Date: Thu, 11 Jun 2026 08:22:26 +0200
-Subject: [PATCH] [core,gateway] ensure buffer size for current write
-
----
- libfreerdp/core/gateway/rpc_client.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libfreerdp/core/gateway/rpc_client.c b/libfreerdp/core/gateway/rpc_client.c
-index 1ef0c04a6..f96ea6507 100644
---- a/libfreerdp/core/gateway/rpc_client.c
-+++ b/libfreerdp/core/gateway/rpc_client.c
-@@ -400,7 +400,7 @@ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment)
- 		{
- 			const rpcconn_response_hdr_t* response =
- 			    (const rpcconn_response_hdr_t*)&header.response;
--			if (!Stream_EnsureCapacity(pdu->s, response->alloc_hint))
-+			if (!Stream_EnsureRemainingCapacity(pdu->s, StubLength))
- 				goto fail;
- 
- 			if (Stream_Length(fragment) < StubOffset + StubLength)

SOURCES/core-info-fix-missing-NULL-check.patch

@@ -1,71 +0,0 @@
-From 6a329a9a1352c9461a3a85e55d84230106b19500 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 10 Mar 2026 14:53:29 +0100
-Subject: [PATCH] [core,info] fix missing NULL check
-
-Backport of commit 4d44e3c097656a8b9ec696353647b0888ca45860.
-
-Made-with: Cursor
----
- libfreerdp/core/info.c | 17 +++++++++++------
- 1 file changed, 11 insertions(+), 6 deletions(-)
-
-diff --git a/libfreerdp/core/info.c b/libfreerdp/core/info.c
-index 9aaa6cff6..56676f0fb 100644
---- a/libfreerdp/core/info.c
-+++ b/libfreerdp/core/info.c
-@@ -24,6 +24,7 @@
- #endif
- 
- #include <winpr/crt.h>
-+#include <winpr/assert.h>
- #include <freerdp/crypto/crypto.h>
- #include <freerdp/log.h>
- #include <freerdp/session.h>
-@@ -1363,10 +1364,11 @@ static BOOL rdp_write_logon_info_v1(wStream* s, logon_info* info)
- 	return TRUE;
- }
- 
--static BOOL rdp_write_logon_info_v2(wStream* s, logon_info* info)
-+static BOOL rdp_write_logon_info_v2(wStream* s, const logon_info* info)
- {
- 	UINT32 Size = 2 + 4 + 4 + 4 + 4 + 558;
--	size_t domainLen, usernameLen;
-+	size_t domainLen = 0;
-+	size_t usernameLen = 0;
- 	int len;
- 	WCHAR* wString = NULL;
- 
-@@ -1376,11 +1378,13 @@ static BOOL rdp_write_logon_info_v2(wStream* s, logon_info* info)
- 	Stream_Write_UINT16(s, SAVE_SESSION_PDU_VERSION_ONE);
- 	Stream_Write_UINT32(s, Size);
- 	Stream_Write_UINT32(s, info->sessionId);
--	domainLen = strlen(info->domain);
-+	if (info->domain)
-+		domainLen = strlen(info->domain);
- 	if (domainLen > UINT32_MAX)
- 		return FALSE;
- 	Stream_Write_UINT32(s, (UINT32)(domainLen + 1) * 2);
--	usernameLen = strlen(info->username);
-+	if (info->username)
-+		usernameLen = strlen(info->username);
- 	if (usernameLen > UINT32_MAX)
- 		return FALSE;
- 	Stream_Write_UINT32(s, (UINT32)(usernameLen + 1) * 2);
-@@ -1457,10 +1461,11 @@ static BOOL rdp_write_logon_info_ex(wStream* s, logon_info_ex* info)
- 
- BOOL rdp_send_save_session_info(rdpContext* context, UINT32 type, void* data)
- {
--	wStream* s;
- 	BOOL status;
-+
-+	WINPR_ASSERT(context);
- 	rdpRdp* rdp = context->rdp;
--	s = rdp_data_pdu_init(rdp);
-+	wStream* s = rdp_data_pdu_init(rdp);
- 
- 	if (!s)
- 		return FALSE;
--- 
-2.53.0
-

SOURCES/core-message-fix-PolygonSC-and-PolygonCB-async-updates.patch

@@ -1,90 +0,0 @@
-From 1983c446db9f4b39134143e4ce86f998d27817e2 Mon Sep 17 00:00:00 2001
-From: Armin Novak <armin.novak@thincast.com>
-Date: Tue, 7 Jul 2026 12:12:36 +0200
-Subject: [PATCH] [core,message] fix PolygonSC and PolygonCB async updates
-
----
- libfreerdp/core/message.c | 44 +++++++++++++++++++++------------------
- 1 file changed, 24 insertions(+), 20 deletions(-)
-
-diff --git a/libfreerdp/core/message.c b/libfreerdp/core/message.c
-index 1ab0d4e4e..266c133b0 100644
---- a/libfreerdp/core/message.c
-+++ b/libfreerdp/core/message.c
-@@ -622,52 +622,56 @@ static BOOL update_message_FastGlyph(rdpContext* context, const FAST_GLYPH_ORDER
- 
- static BOOL update_message_PolygonSC(rdpContext* context, const POLYGON_SC_ORDER* polygonSC)
- {
--	POLYGON_SC_ORDER* wParam;
--
- 	if (!context || !context->update || !polygonSC)
- 		return FALSE;
- 
--	wParam = (POLYGON_SC_ORDER*)malloc(sizeof(POLYGON_SC_ORDER));
-+	POLYGON_SC_ORDER* wParam = (POLYGON_SC_ORDER*)malloc(sizeof(POLYGON_SC_ORDER));
- 
- 	if (!wParam)
- 		return FALSE;
- 
--	CopyMemory(wParam, polygonSC, sizeof(POLYGON_SC_ORDER));
--	wParam->points = (DELTA_POINT*)calloc(wParam->numPoints, sizeof(DELTA_POINT));
--
--	if (!wParam->points)
-+	*wParam = *polygonSC;
-+	if (polygonSC->numPoints > 0)
- 	{
--		free(wParam);
--		return FALSE;
-+		wParam->points = (DELTA_POINT*)calloc(polygonSC->numPoints, sizeof(DELTA_POINT));
-+
-+		if (!wParam->points)
-+		{
-+			free(wParam);
-+			return FALSE;
-+		}
-+
-+		CopyMemory(wParam->points, polygonSC->points, sizeof(DELTA_POINT) * wParam->numPoints);
- 	}
- 
--	CopyMemory(wParam->points, polygonSC, sizeof(DELTA_POINT) * wParam->numPoints);
- 	return MessageQueue_Post(context->update->queue, (void*)context,
- 	                         MakeMessageId(PrimaryUpdate, PolygonSC), (void*)wParam, NULL);
- }
- 
- static BOOL update_message_PolygonCB(rdpContext* context, POLYGON_CB_ORDER* polygonCB)
- {
--	POLYGON_CB_ORDER* wParam;
--
- 	if (!context || !context->update || !polygonCB)
- 		return FALSE;
- 
--	wParam = (POLYGON_CB_ORDER*)malloc(sizeof(POLYGON_CB_ORDER));
-+	POLYGON_CB_ORDER* wParam = (POLYGON_CB_ORDER*)malloc(sizeof(POLYGON_CB_ORDER));
- 
- 	if (!wParam)
- 		return FALSE;
- 
--	CopyMemory(wParam, polygonCB, sizeof(POLYGON_CB_ORDER));
--	wParam->points = (DELTA_POINT*)calloc(wParam->numPoints, sizeof(DELTA_POINT));
--
--	if (!wParam->points)
-+	*wParam = *polygonCB;
-+	if (polygonCB->numPoints > 0)
- 	{
--		free(wParam);
--		return FALSE;
-+		wParam->points = (DELTA_POINT*)calloc(polygonCB->numPoints, sizeof(DELTA_POINT));
-+
-+		if (!wParam->points)
-+		{
-+			free(wParam);
-+			return FALSE;
-+		}
-+
-+		CopyMemory(wParam->points, polygonCB->points, sizeof(DELTA_POINT) * wParam->numPoints);
- 	}
- 
--	CopyMemory(wParam->points, polygonCB, sizeof(DELTA_POINT) * wParam->numPoints);
- 	wParam->brush.data = (BYTE*)wParam->brush.p8x8;
- 	return MessageQueue_Post(context->update->queue, (void*)context,
- 	                         MakeMessageId(PrimaryUpdate, PolygonCB), (void*)wParam, NULL);

SOURCES/core-message-fix-update_message_WindowIcon.patch

@@ -1,37 +0,0 @@
-From 9397fbeed4b2862ae68f9556950af415163c9398 Mon Sep 17 00:00:00 2001
-From: Armin Novak <armin.novak@thincast.com>
-Date: Tue, 7 Jul 2026 12:58:11 +0200
-Subject: [PATCH] [core,message] fix update_message_WindowIcon
-
----
- libfreerdp/core/message.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/libfreerdp/core/message.c b/libfreerdp/core/message.c
-index 7af29e94d..1ab0d4e4e 100644
---- a/libfreerdp/core/message.c
-+++ b/libfreerdp/core/message.c
-@@ -1147,18 +1147,21 @@ static BOOL update_message_WindowIcon(rdpContext* context, const WINDOW_ORDER_IN
- 	if (!wParam)
- 		return FALSE;
-
--	CopyMemory(wParam, orderInfo, sizeof(WINDOW_ORDER_INFO));
-+	*wParam = *orderInfo;
-+
- 	lParam = (WINDOW_ICON_ORDER*)calloc(1, sizeof(WINDOW_ICON_ORDER));
-
- 	if (!lParam)
- 		goto out_fail;
-
-+	*lParam = *windowIcon;
- 	lParam->iconInfo = calloc(1, sizeof(ICON_INFO));
-
- 	if (!lParam->iconInfo)
- 		goto out_fail;
-
--	CopyMemory(lParam, windowIcon, sizeof(WINDOW_ICON_ORDER));
-+	*lParam->iconInfo = *windowIcon->iconInfo;
-+
- 	WLog_VRB(TAG, "update_message_WindowIcon");
-
- 	if (windowIcon->iconInfo->cbBitsColor > 0)

SOURCES/core-redirection-check-redirection-values-for-validity.patch

@@ -1,163 +0,0 @@
-From cdabc78fc50a5a1859faebc1e41a3dfbbd007341 Mon Sep 17 00:00:00 2001
-From: Armin Novak <armin.novak@thincast.com>
-Date: Thu, 9 Jul 2026 08:34:24 +0200
-Subject: [PATCH] [core,redirection] check redirection values for validity
-
-Add some basic validity checks for data provided by server.
----
- libfreerdp/core/redirection.c | 25 ++++++++++++++++++++-----
- libfreerdp/core/utils.c       | 33 +++++++++++++++++++++++++++++++++
- libfreerdp/core/utils.h       |  2 ++
- 3 files changed, 55 insertions(+), 5 deletions(-)
-
-diff --git a/libfreerdp/core/redirection.c b/libfreerdp/core/redirection.c
-index 59c6dbcee..b4b222eb2 100644
---- a/libfreerdp/core/redirection.c
-+++ b/libfreerdp/core/redirection.c
-@@ -406,6 +406,8 @@ static int rdp_recv_server_redirection_pdu(rdpRdp* rdp, wStream* s)
- 	{
- 		if (!rdp_redirection_read_unicode_string(s, &(redirection->TargetNetAddress), 80))
- 			return -1;
-+		if (!utils_is_valid_ip(redirection->TargetNetAddress))
-+			return -1;
- 	}
-
- 	if (redirection->flags & LB_LOAD_BALANCE_INFO)
-@@ -419,13 +421,17 @@ static int rdp_recv_server_redirection_pdu(rdpRdp* rdp, wStream* s)
- 		if (!rdp_redirection_read_data(LB_LOAD_BALANCE_INFO, s, &redirection->LoadBalanceInfoLength,
- 		                               &redirection->LoadBalanceInfo))
- 			return -1;
-+		if (!winpr_str_is_valid_urlN((const char*)redirection->LoadBalanceInfo,
-+		                             redirection->LoadBalanceInfoLength))
-+			return -1;
- 	}
-
- 	if (redirection->flags & LB_USERNAME)
- 	{
- 		if (!rdp_redirection_read_unicode_string(s, &(redirection->Username), 512))
- 			return -1;
--
-+		if (winpr_str_has_newlines(redirection->Username))
-+			return -1;
- 		WLog_DBG(TAG, "Username: %s", redirection->Username);
- 	}
-
-@@ -433,7 +439,8 @@ static int rdp_recv_server_redirection_pdu(rdpRdp* rdp, wStream* s)
- 	{
- 		if (!rdp_redirection_read_unicode_string(s, &(redirection->Domain), 52))
- 			return -1;
--
-+		if (winpr_str_has_newlines(redirection->Domain))
-+			return -1;
- 		WLog_DBG(TAG, "Domain: %s", redirection->Domain);
- 	}
-
-@@ -484,7 +491,8 @@ static int rdp_recv_server_redirection_pdu(rdpRdp* rdp, wStream* s)
- 	{
- 		if (!rdp_redirection_read_unicode_string(s, &(redirection->TargetFQDN), 512))
- 			return -1;
--
-+		if (!winpr_str_is_valid_url(redirection->TargetFQDN))
-+			return -1;
- 		WLog_DBG(TAG, "TargetFQDN: %s", redirection->TargetFQDN);
- 	}
-
-@@ -492,7 +500,8 @@ static int rdp_recv_server_redirection_pdu(rdpRdp* rdp, wStream* s)
- 	{
- 		if (!rdp_redirection_read_unicode_string(s, &(redirection->TargetNetBiosName), 32))
- 			return -1;
--
-+		if (!winpr_str_is_valid_url(redirection->TargetNetBiosName))
-+			return -1;
- 		WLog_DBG(TAG, "TargetNetBiosName: %s", redirection->TargetNetBiosName);
- 	}
-
-@@ -501,6 +510,8 @@ static int rdp_recv_server_redirection_pdu(rdpRdp* rdp, wStream* s)
- 		if (!rdp_redirection_read_data(LB_CLIENT_TSV_URL, s, &redirection->TsvUrlLength,
- 		                               &redirection->TsvUrl))
- 			return -1;
-+		if (!winpr_str_is_valid_urlN((const char*)redirection->TsvUrl, redirection->TsvUrlLength))
-+			return -1;
- 	}
-
- 	if (redirection->flags & LB_REDIRECTION_GUID)
-@@ -541,7 +552,8 @@ static int rdp_recv_server_redirection_pdu(rdpRdp* rdp, wStream* s)
- 		{
- 			if (!rdp_redirection_read_unicode_string(s, &(redirection->TargetNetAddresses[i]), 80))
- 				return -1;
--
-+			if (!utils_is_valid_ip(redirection->TargetNetAddresses[i]))
-+				return -1;
- 			WLog_DBG(TAG, "TargetNetAddresses[%" PRIuz "]: %s", i,
- 			         redirection->TargetNetAddresses[i]);
- 		}
-@@ -569,7 +581,10 @@ int rdp_recv_enhanced_security_redirection_packet(rdpRdp* rdp, wStream* s)
- 	status = rdp_recv_server_redirection_pdu(rdp, s);
-
- 	if (status < 0)
-+	{
-+		WLog_ERR(TAG, "redirection packet invalid, aborting");
- 		return status;
-+	}
-
- 	if (Stream_GetRemainingLength(s) >= 1)
- 	{
-diff --git a/libfreerdp/core/utils.c b/libfreerdp/core/utils.c
-index 139c1a433..102819915 100644
---- a/libfreerdp/core/utils.c
-+++ b/libfreerdp/core/utils.c
-@@ -22,6 +22,16 @@
- #include "config.h"
- #endif
-
-+#include <string.h>
-+
-+#ifdef _WIN32
-+#include <ws2tcpip.h>
-+#else
-+#include <sys/socket.h>
-+#include <netinet/in.h>
-+#include <arpa/inet.h>
-+#endif
-+
- #include <winpr/assert.h>
-
- #include <freerdp/freerdp.h>
-@@ -65,3 +75,26 @@ BOOL utils_str_is_empty(const char* str)
- 		return TRUE;
- 	return FALSE;
- }
-+
-+static BOOL isValidIPv4(const char* ipAddress)
-+{
-+	struct sockaddr_in sa;
-+	int result;
-+	memset(&sa, 0, sizeof(sa));
-+	result = inet_pton(AF_INET, ipAddress, &(sa.sin_addr));
-+	return result != 0;
-+}
-+
-+static BOOL isValidIPv6(const char* ipAddress)
-+{
-+	struct sockaddr_in6 sa;
-+	int result;
-+	memset(&sa, 0, sizeof(sa));
-+	result = inet_pton(AF_INET6, ipAddress, &(sa.sin6_addr));
-+	return result != 0;
-+}
-+
-+BOOL utils_is_valid_ip(const char* ipAddress)
-+{
-+	return isValidIPv4(ipAddress) || isValidIPv6(ipAddress);
-+}
-diff --git a/libfreerdp/core/utils.h b/libfreerdp/core/utils.h
-index 432951812..4b150c416 100644
---- a/libfreerdp/core/utils.h
-+++ b/libfreerdp/core/utils.h
-@@ -30,4 +30,6 @@ BOOL utils_abort_connect(rdpContext* context);
- BOOL utils_str_is_empty(const char* str);
- BOOL utils_str_copy(const char* value, char** dst);
-
-+FREERDP_LOCAL BOOL utils_is_valid_ip(const char* ipAddress);
-+
- #endif /* FREERDP_LIB_CORE_UTILS_H */

SOURCES/core-redirection-relax-checks.patch

@@ -1,34 +0,0 @@
-From b3cff65a1adbbdeda478f035218eeadc72ca0032 Mon Sep 17 00:00:00 2001
-From: Armin Novak <armin.novak@thincast.com>
-Date: Tue, 14 Jul 2026 12:30:27 +0200
-Subject: [PATCH] [core,redirection] relax checks
-
-* TsvUrl is opaque, do not assume any format
-* LoadBalanceInfo is opaque, do not assume any format
----
- libfreerdp/core/redirection.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/libfreerdp/core/redirection.c b/libfreerdp/core/redirection.c
-index b4b222eb2..773496603 100644
---- a/libfreerdp/core/redirection.c
-+++ b/libfreerdp/core/redirection.c
-@@ -421,9 +421,6 @@ static int rdp_recv_server_redirection_pdu(rdpRdp* rdp, wStream* s)
- 		if (!rdp_redirection_read_data(LB_LOAD_BALANCE_INFO, s, &redirection->LoadBalanceInfoLength,
- 		                               &redirection->LoadBalanceInfo))
- 			return -1;
--		if (!winpr_str_is_valid_urlN((const char*)redirection->LoadBalanceInfo,
--		                             redirection->LoadBalanceInfoLength))
--			return -1;
- 	}
-
- 	if (redirection->flags & LB_USERNAME)
-@@ -510,8 +507,6 @@ static int rdp_recv_server_redirection_pdu(rdpRdp* rdp, wStream* s)
- 		if (!rdp_redirection_read_data(LB_CLIENT_TSV_URL, s, &redirection->TsvUrlLength,
- 		                               &redirection->TsvUrl))
- 			return -1;
--		if (!winpr_str_is_valid_urlN((const char*)redirection->TsvUrl, redirection->TsvUrlLength))
--			return -1;
- 	}
-
- 	if (redirection->flags & LB_REDIRECTION_GUID)

SOURCES/crypto-base64-ensure-char-is-singend.patch

@@ -1,30 +0,0 @@
-From 7e1759c739002dc95d8f15672d0f700ca8dcce0e Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 17 Feb 2026 14:23:29 +0100
-Subject: [PATCH] [crypto,base64] ensure char is singend
-
-Backport of commit 62a9e787edb2cfce9858fa4ceda5461680efc590.
-
-Co-Authored-By: Cursor <cursoragent@cursor.com>
----
- libfreerdp/crypto/base64.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/libfreerdp/crypto/base64.c b/libfreerdp/crypto/base64.c
-index 5a5da89a4..c084de38e 100644
---- a/libfreerdp/crypto/base64.c
-+++ b/libfreerdp/crypto/base64.c
-@@ -93,6 +93,10 @@ char* crypto_base64_encode(const BYTE* data, int length)
- 
- static int base64_decode_char(char c)
- {
-+	/* ensure char is signed for this check */
-+	if ((int)c <= '\0')
-+		return -1;
-+
- 	if (c >= 'A' && c <= 'Z')
- 		return c - 'A';
- 
--- 
-2.52.0
-

SOURCES/gdi-gfx-properly-clamp-SurfaceToSurface.patch

@@ -1,50 +0,0 @@
-From ef99da020599a666b7d171eec6ab527b47dd33f3 Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Thu, 22 Jan 2026 12:47:42 +0100
-Subject: [PATCH] [gdi,gfx] properly clamp SurfaceToSurface
-
-Backport of commit c4a7c371342edf0d307cea728f56d3302f0ab38c.
-
-Co-Authored-By: Claude <noreply@anthropic.com>
----
- libfreerdp/gdi/gfx.c | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/libfreerdp/gdi/gfx.c b/libfreerdp/gdi/gfx.c
-index 3970715e0..968a5a17c 100644
---- a/libfreerdp/gdi/gfx.c
-+++ b/libfreerdp/gdi/gfx.c
-@@ -1175,7 +1175,6 @@ static UINT gdi_SurfaceToSurface(RdpgfxClientContext* context,
- 	UINT status = ERROR_INTERNAL_ERROR;
- 	UINT16 index;
- 	BOOL sameSurface;
--	UINT32 nWidth, nHeight;
- 	const RECTANGLE_16* rectSrc;
- 	RECTANGLE_16 invalidRect;
- 	gdiGfxSurface* surfaceSrc;
-@@ -1199,8 +1198,8 @@ static UINT gdi_SurfaceToSurface(RdpgfxClientContext* context,
- 	if (!is_rect_valid(rectSrc, surfaceSrc->width, surfaceSrc->height))
- 		goto fail;
- 
--	nWidth = rectSrc->right - rectSrc->left;
--	nHeight = rectSrc->bottom - rectSrc->top;
-+	const UINT32 nWidth = rectSrc->right - rectSrc->left;
-+	const UINT32 nHeight = rectSrc->bottom - rectSrc->top;
- 
- 	for (index = 0; index < surfaceToSurface->destPtsCount; index++)
- 	{
-@@ -1209,8 +1208,10 @@ static UINT gdi_SurfaceToSurface(RdpgfxClientContext* context,
- 		if (!is_rect_valid(&rect, surfaceDst->width, surfaceDst->height))
- 			goto fail;
- 
-+		const UINT32 rwidth = rect.right - rect.left;
-+		const UINT32 rheight = rect.bottom - rect.top;
- 		if (!freerdp_image_copy(surfaceDst->data, surfaceDst->format, surfaceDst->scanline,
--		                        destPt->x, destPt->y, nWidth, nHeight, surfaceSrc->data,
-+		                        destPt->x, destPt->y, rwidth, rheight, surfaceSrc->data,
- 		                        surfaceSrc->format, surfaceSrc->scanline, rectSrc->left,
- 		                        rectSrc->top, NULL, FREERDP_FLIP_NONE))
- 			goto fail;
--- 
-2.52.0
-

SOURCES/gdi-graphics-Use-freerdp_glyph_convert_ex.patch

@@ -1,36 +0,0 @@
-From d25ffd608bf2bd38022a3930d0b3fc1b7c873c1a Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Sat, 28 Mar 2026 12:13:06 +0100
-Subject: [PATCH] [gdi,graphics] Use freerdp_glyph_convert_ex
-
-Backport of commit 9f0eb3b7d43069a1e973464bcb43d1ef965ae65e.
-
-Made-with: Cursor
----
- libfreerdp/gdi/graphics.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/libfreerdp/gdi/graphics.c b/libfreerdp/gdi/graphics.c
-index dab159c43..b1129fb7c 100644
---- a/libfreerdp/gdi/graphics.c
-+++ b/libfreerdp/gdi/graphics.c
-@@ -262,7 +262,6 @@ static BYTE* freerdp_glyph_convert_ex(UINT32 width, UINT32 height, const BYTE* d
- 
- static BOOL gdi_Glyph_New(rdpContext* context, const rdpGlyph* glyph)
- {
--	BYTE* data;
- 	gdiGlyph* gdi_glyph;
- 
- 	if (!context || !glyph)
-@@ -275,7 +274,7 @@ static BOOL gdi_Glyph_New(rdpContext* context, const rdpGlyph* glyph)
- 		return FALSE;
- 
- 	gdi_glyph->hdc->format = PIXEL_FORMAT_MONO;
--	data = freerdp_glyph_convert(glyph->cx, glyph->cy, glyph->aj);
-+	BYTE* data = freerdp_glyph_convert_ex(glyph->cx, glyph->cy, glyph->aj, glyph->cb);
- 
- 	if (!data)
- 	{
--- 
-2.53.0
-

SOURCES/scard-handle-nullptr-for-LookupName.patch

@@ -1,40 +0,0 @@
-From 0ec0b84532ff61889b797d9c86a208ad6dcbd289 Mon Sep 17 00:00:00 2001
-From: Armin Novak <armin.novak@thincast.com>
-Date: Thu, 9 Jul 2026 08:34:21 +0200
-Subject: [PATCH] [scard] handle nullptr for LookupName
-
----
- winpr/libwinpr/smartcard/smartcard_pcsc.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/winpr/libwinpr/smartcard/smartcard_pcsc.c b/winpr/libwinpr/smartcard/smartcard_pcsc.c
-index 4cf5095ac..dd45043af 100644
---- a/winpr/libwinpr/smartcard/smartcard_pcsc.c
-+++ b/winpr/libwinpr/smartcard/smartcard_pcsc.c
-@@ -2640,6 +2640,9 @@ static LONG WINAPI PCSC_SCardDlgExtendedError(void)
- 
- static char* card_id_and_name_a(const UUID* CardIdentifier, LPCSTR LookupName)
- {
-+	if (!CardIdentifier || !LookupName)
-+		return NULL;
-+
- 	size_t len = strlen(LookupName) + 34;
- 	char* id = malloc(len);
- 	if (!id)
-@@ -2668,12 +2671,13 @@ static LONG WINAPI PCSC_SCardReadCacheA(SCARDCONTEXT hContext, UUID* CardIdentif
-                                         DWORD FreshnessCounter, LPSTR LookupName, PBYTE Data,
-                                         DWORD* DataLen)
- {
--	PCSC_CACHE_ITEM* data;
-+	PCSC_CACHE_ITEM* data = NULL;
- 	PCSC_SCARDCONTEXT* ctx = PCSC_GetCardContextData(hContext);
- 	char* id = card_id_and_name_a(CardIdentifier, LookupName);
--
--	data = HashTable_GetItemValue(ctx->cache, id);
-+	if (id)
-+		data = HashTable_GetItemValue(ctx->cache, id);
- 	free(id);
-+
- 	if (!data)
- 	{
- 		*DataLen = 0;

SOURCES/utils-smartcard-add-length-validity-checks.patch

@@ -1,79 +0,0 @@
-From 070f9e070c59a121cd93541835dc0086084bb6ad Mon Sep 17 00:00:00 2001
-From: Ondrej Holy <oholy@redhat.com>
-Date: Tue, 17 Feb 2026 11:05:59 +0100
-Subject: [PATCH] [utils,smartcard] add length validity checks
-
-Backport of commit 57c5647d98c2a026de8b681159cb188ca0439ef8.
-
-Co-Authored-By: Cursor <cursoragent@cursor.com>
----
- channels/smartcard/client/smartcard_pack.c | 27 +++++++++++++++++-----
- 1 file changed, 21 insertions(+), 6 deletions(-)
-
-diff --git a/channels/smartcard/client/smartcard_pack.c b/channels/smartcard/client/smartcard_pack.c
-index f70eb4e5d..687f1110b 100644
---- a/channels/smartcard/client/smartcard_pack.c
-+++ b/channels/smartcard/client/smartcard_pack.c
-@@ -98,13 +98,16 @@ static BOOL smartcard_ndr_pointer_read_(wStream* s, UINT32* index, UINT32* ptr,
- 	return TRUE;
- }
- 
--static LONG smartcard_ndr_read(wStream* s, BYTE** data, size_t min, size_t elementSize,
--                               ndr_ptr_t type)
-+static LONG smartcard_ndr_read_ex(wStream* s, BYTE** data, size_t min,
-+                                  size_t elementSize, ndr_ptr_t type, size_t* plen)
- {
- 	size_t len, offset, len2;
- 	void* r;
- 	size_t required;
- 
-+	if (plen)
-+		*plen = 0;
-+
- 	switch (type)
- 	{
- 		case NDR_PTR_FULL:
-@@ -181,11 +184,20 @@ static LONG smartcard_ndr_read(wStream* s, BYTE** data, size_t min, size_t eleme
- 	if (!r)
- 		return SCARD_E_NO_MEMORY;
- 	Stream_Read(s, r, len);
--	smartcard_unpack_read_size_align(NULL, s, len, 4);
-+	const LONG pad = smartcard_unpack_read_size_align(NULL, s, len, 4);
-+	len += (size_t)pad;
- 	*data = r;
-+	if (plen)
-+		*plen = len;
- 	return STATUS_SUCCESS;
- }
- 
-+static LONG smartcard_ndr_read(wStream* s, BYTE** data, size_t min, size_t elementSize,
-+                               ndr_ptr_t type)
-+{
-+	return smartcard_ndr_read_ex(s, data, min, elementSize, type, NULL);
-+}
-+
- static BOOL smartcard_ndr_pointer_write(wStream* s, UINT32* index, DWORD length)
- {
- 	const UINT32 ndrPtr = 0x20000 + (*index) * 4;
-@@ -3427,12 +3439,15 @@ LONG smartcard_unpack_set_attrib_call(SMARTCARD_DEVICE* smartcard, wStream* s, S
- 
- 	if (ndrPtr)
- 	{
--		// TODO: call->cbAttrLen was larger than the pointer value.
--		// TODO: Maybe need to refine the checks?
--		status = smartcard_ndr_read(s, &call->pbAttr, 0, 1, NDR_PTR_SIMPLE);
-+		size_t len = 0;
-+		status = smartcard_ndr_read_ex(s, &call->pbAttr, 0, 1, NDR_PTR_SIMPLE, &len);
- 		if (status != SCARD_S_SUCCESS)
- 			return status;
-+		if (call->cbAttrLen > len)
-+			call->cbAttrLen = (DWORD)len;
- 	}
-+	else
-+		call->cbAttrLen = 0;
- 	smartcard_trace_set_attrib_call(smartcard, call);
- 	return SCARD_S_SUCCESS;
- }
--- 
-2.52.0
-

SOURCES/winpr-crt-add-functions-to-test-string.patch

@@ -1,266 +0,0 @@
-From a7a47bc0bdab723b674fb05f51e93ae007ed6412 Mon Sep 17 00:00:00 2001
-From: Armin Novak <armin.novak@thincast.com>
-Date: Thu, 9 Jul 2026 08:34:23 +0200
-Subject: [PATCH] [winpr,crt] add functions to test string
-
-* winpr_str_has_newlines to check for newlines in a string
-* winpr_str_is_valid_url and winpr_str_is_valid_urlN to check if a
-  string is a valid url
----
- winpr/include/winpr/string.h         |  5 ++
- winpr/libwinpr/crt/CMakeLists.txt    |  8 +++
- winpr/libwinpr/crt/string.c          | 96 ++++++++++++++++++++++++++++
- winpr/libwinpr/crt/test/TestString.c | 82 ++++++++++++++++++++++++
- 4 files changed, 191 insertions(+)
-
-diff --git a/winpr/include/winpr/string.h b/winpr/include/winpr/string.h
-index bb98dffdc..7de9f934f 100644
---- a/winpr/include/winpr/string.h
-+++ b/winpr/include/winpr/string.h
-@@ -31,6 +31,11 @@ extern "C"
- {
- #endif
-
-+	WINPR_API BOOL winpr_str_is_valid_url(const char* str);
-+	WINPR_API BOOL winpr_str_is_valid_urlN(const char* str, size_t len);
-+	WINPR_API BOOL winpr_str_has_newlines(const char* str);
-+
-+
- 	WINPR_API BOOL winpr_str_append(const char* what, char* buffer, size_t size,
- 	                                const char* separator);
-
-diff --git a/winpr/libwinpr/crt/CMakeLists.txt b/winpr/libwinpr/crt/CMakeLists.txt
-index 5ee4bbd1e..538e74dcf 100644
---- a/winpr/libwinpr/crt/CMakeLists.txt
-+++ b/winpr/libwinpr/crt/CMakeLists.txt
-@@ -22,6 +22,14 @@ set (CRT_FILES alignment.c
- 	unicode.c
- 	string.c)
-
-+include(CheckSymbolExists)
-+check_symbol_exists(regcomp regex.h WINPR_HAVE_REGCOMP)
-+check_symbol_exists(regexec regex.h WINPR_HAVE_REGEXEC)
-+check_symbol_exists(regfree regex.h WINPR_HAVE_REGFREE)
-+if(WINPR_HAVE_REGCOMP AND WINPR_HAVE_REGEXEC AND WINPR_HAVE_REGFREE)
-+  winpr_definition_add(-DWINPR_HAVE_REGCOMP)
-+endif()
-+
- if (NOT WITH_ICU)
- 	set (CRT_FILES ${CRT_FILES}
- 		utf.c
-diff --git a/winpr/libwinpr/crt/string.c b/winpr/libwinpr/crt/string.c
-index 6596b42f5..465b8d133 100644
---- a/winpr/libwinpr/crt/string.c
-+++ b/winpr/libwinpr/crt/string.c
-@@ -29,11 +29,71 @@
- #include <winpr/assert.h>
- #include <winpr/endian.h>
-
-+#if defined(WINPR_HAVE_REGCOMP)
-+#include <regex.h>
-+#endif
-+
- /* String Manipulation (CRT): http://msdn.microsoft.com/en-us/library/f0151s4x.aspx */
-
- #include "../log.h"
- #define TAG WINPR_TAG("crt")
-
-+BOOL winpr_str_is_valid_urlN(const char* str, size_t len)
-+{
-+	if (!str || (len == 0))
-+		return FALSE;
-+
-+	char* url = strndup(str, len);
-+	if (!url)
-+		return FALSE;
-+
-+	const BOOL rc = winpr_str_is_valid_url(url);
-+	free(url);
-+	return rc;
-+}
-+
-+#if defined(_WIN32)
-+#include <shlwapi.h>
-+
-+BOOL winpr_str_is_valid_url(const char* str)
-+{
-+	if (!str)
-+		return FALSE;
-+	return PathIsURLA(str);
-+}
-+
-+#elif defined(WINPR_HAVE_REGCOMP)
-+BOOL winpr_str_is_valid_url(const char* str)
-+{
-+	regex_t regex;
-+	const char pattern[] = "^([a-z]+://)?([a-zA-Z0-9.-]+)(:[0-9]+)?(/[a-zA-Z0-9./?=&%-]*)?$";
-+	int ret;
-+
-+	if (!str)
-+		return FALSE;
-+	memset(&regex, 0, sizeof(regex));
-+
-+	ret = regcomp(&regex, pattern, REG_EXTENDED);
-+	if (ret)
-+	{
-+		printf("Could not compile regex\n");
-+		return FALSE;
-+	}
-+
-+	ret = regexec(&regex, str, 0, NULL, 0);
-+	regfree(&regex);
-+	return ret == 0;
-+}
-+
-+#else
-+BOOL winpr_str_is_valid_url(const char* str)
-+{
-+	WINPR_UNUSED(str);
-+	WLog_WARN(TAG, "URL validation not supported by your build, not performing check.");
-+	return TRUE;
-+}
-+#endif
-+
- BOOL winpr_str_append(const char* what, char* buffer, size_t size, const char* separator)
- {
- 	const size_t used = strnlen(buffer, size);
-@@ -636,3 +696,39 @@ INT64 GetLine(char** lineptr, size_t* size, FILE* stream)
- 	return -1;
- #endif
- }
-+
-+BOOL winpr_str_has_newlines(const char* str)
-+{
-+	if (!str)
-+		return FALSE;
-+	do
-+	{
-+		char c = *str++;
-+		switch (c)
-+		{
-+			case '\r':
-+			case '\n':
-+			case 0x0b:       /* VT vertical tab */
-+			case 0x0c:       /* FF form feed */
-+			case (char)0x85: /* NEL next line */
-+				return TRUE;
-+			case 0x20:
-+			{
-+				switch (*str)
-+				{
-+					case 0x28: /* LS line separator */
-+					case 0x29: /* PS paragraph separator */
-+						return TRUE;
-+					default:
-+						break;
-+				}
-+			}
-+			break;
-+
-+			case '\0':
-+				return FALSE;
-+			default:
-+				break;
-+		}
-+	} while (1);
-+}
-diff --git a/winpr/libwinpr/crt/test/TestString.c b/winpr/libwinpr/crt/test/TestString.c
-index df154fe1c..bca470bdd 100644
---- a/winpr/libwinpr/crt/test/TestString.c
-+++ b/winpr/libwinpr/crt/test/TestString.c
-@@ -27,6 +27,79 @@ static WCHAR testDelimiter[] = { '\r', '\n', '\0' };
-
- #define testDelimiter_Length ((sizeof(testDelimiter) / sizeof(WCHAR)) - 1)
-
-+static BOOL test_valid_url(void)
-+{
-+	struct test_t
-+	{
-+		char* string;
-+		size_t len;
-+		BOOL isUrl;
-+	};
-+
-+	static const struct test_t tests[] = { { "foo.bar.blabla", 15, TRUE },
-+		                                   { "somehostname", 12, TRUE },
-+		                                   { "somehostname:1234", 17, TRUE },
-+		                                   { "tsv://somehostname", 18, TRUE },
-+		                                   { "tsv://somehostname/path/foo/gaga", 32, TRUE },
-+		                                   { "tsv://somehostname:1234", 23, TRUE },
-+		                                   { "tsv://somehostname:1234/path/foo", 33, TRUE },
-+		                                   { "lala\rgaga\n", 12, FALSE },
-+		                                   { "192.168.0.1", 11, TRUE },
-+		                                   //{ "192.168.0.1:1234", 16, FALSE },
-+		                                   //{ "192.168.0.1:1234/foo/", 21, FALSE },
-+		                                   { "192.168.0.1/bar/foo/", 20, TRUE },
-+		                                   { "[::1]", 5, FALSE },
-+		                                   { "[::1]:1234", 8, FALSE },
-+		                                   { "[2001:db8:3333:4444:5555:6666:7777:8888]", 40,
-+		                                     FALSE },
-+		                                   { "[2001:db8::1]", 13, FALSE } };
-+	BOOL rc = TRUE;
-+	for (size_t x = 0; x < ARRAYSIZE(tests); x++)
-+	{
-+		const struct test_t* cur = &tests[x];
-+
-+		const BOOL rc1 = winpr_str_is_valid_url(cur->string);
-+		const BOOL rc2 = winpr_str_is_valid_urlN(cur->string, cur->len);
-+
-+#if defined(WINPR_HAVE_REGCOMP) || defined(WITH_URIPARSER)
-+		if (rc1 != rc2)
-+			rc = FALSE;
-+		if (rc1 != cur->isUrl)
-+			rc = FALSE;
-+#else
-+		fprintf(stderr, "[%s] TODO: !defined(WINPR_HAVE_REGCOMP) && !defined(WITH_URIPARSER)\n",
-+		        __func__);
-+#endif
-+	}
-+
-+	return rc;
-+}
-+
-+static BOOL test_newline(void)
-+{
-+	struct test_t
-+	{
-+		char* string;
-+		size_t len;
-+		BOOL hasNewlines;
-+	};
-+
-+	const struct test_t tests[] = { { "foo.bar.blabla", 15, FALSE },
-+		                            { "somehostname", 12, FALSE },
-+		                            { "lala\rgaga\n", 13, TRUE } };
-+
-+	for (size_t x = 0; x < ARRAYSIZE(tests); x++)
-+	{
-+		const struct test_t* cur = &tests[x];
-+
-+		const BOOL rc1 = winpr_str_has_newlines(cur->string);
-+		if (rc1 != cur->hasNewlines)
-+			return FALSE;
-+	}
-+
-+	return TRUE;
-+}
-+
- int TestString(int argc, char* argv[])
- {
- 	WCHAR* p;
-@@ -34,6 +107,15 @@ int TestString(int argc, char* argv[])
- 	size_t length;
- 	WCHAR* context;
-
-+	WINPR_UNUSED(argc);
-+	WINPR_UNUSED(argv);
-+
-+	if (!test_valid_url())
-+		return -1;
-+
-+	if (!test_newline())
-+		return -1;
-+
- #ifdef __BIG_ENDIAN__
- 	/* Be sure that we always use LE encoded string */
- 	ByteSwapUnicode(testStringW, testStringW_Length);

SPECS/freerdp.spec

@@ -1,676 +0,0 @@
-# Can be rebuilt with FFmpeg/OpenH264 support enabled by passing
-# "--with=ffmpeg", or "--with=openh264" to mock/rpmbuild; or by globally
-# setting these variables:
-# https://bugzilla.redhat.com/show_bug.cgi?id=2242028
-#global _with_ffmpeg 1
-#global _with_openh264 1
-
-# Can be rebuilt with OpenCL support enabled by passing # "--with=opencl"
-# or by globally setting:
-#global _opencl 1
-
-# Momentarily disable GSS support
-# https://github.com/FreeRDP/FreeRDP/issues/4348
-#global _with_gss 1
-
-# Disable server support in RHEL
-# https://bugzilla.redhat.com/show_bug.cgi?id=1639165
-%if 0%{?fedora} || 0%{?rhel} >= 10
-%global _with_server 1
-%endif
-
-# Disable support for missing codecs in RHEL
-%{!?rhel:%global _with_soxr 1}
-%if 0%{?fedora} || 0%{?rhel} >= 8
-%global _with_lame 1
-%endif
-
-Name:           freerdp
-Version:        2.11.7
-Release:        12%{?dist}
-Epoch:          2
-Summary:        Free implementation of the Remote Desktop Protocol (RDP)
-License:        ASL 2.0
-URL:            http://www.freerdp.com/
-
-Source0:        https://github.com/FreeRDP/FreeRDP/archive/%{version}/FreeRDP-%{version}.tar.gz
-
-# Revert changes that break API
-# https://issues.redhat.com/browse/RHEL-53081
-Patch0:	        Revert-Moved-clipboard-utils-to-core-library-fixes-6.patch
-
-# https://github.com/FreeRDP/FreeRDP/commit/c4a7c371342edf0d307cea728f56d3302f0ab38c
-Patch1:         gdi-gfx-properly-clamp-SurfaceToSurface.patch
-
-# https://github.com/FreeRDP/FreeRDP/commit/c4391827d7facfc874ca7f61a92afb82232a5748
-Patch2:         codec-clear-fix-clear_resize_buffer-checks.patch
-
-# https://github.com/FreeRDP/FreeRDP/commit/f8688b57f6cfad9a0b05475a6afbde355ffab720
-Patch3:         codec-clear-fix-off-by-one-length-check.patch
-
-# https://github.com/FreeRDP/FreeRDP/commit/1bab198a2edd0d0e6e1627d21a433151ea190500
-Patch4:         codec-planar-fix-decoder-length-checks.patch
-
-# https://github.com/FreeRDP/FreeRDP/commit/243ecf804bb122e8e643a5c142ad5a49d7aa19ee
-Patch5:         codec-clear-check-clear_decomress-glyphData.patch
-
-# https://github.com/FreeRDP/FreeRDP/commit/0421b53fcb4a80c95f51342e4a2c40c68a4101d3
-Patch6:         client-x11-fix-double-free-in-case-of-invalid-pointe.patch
-
-# https://github.com/FreeRDP/FreeRDP/commit/52106a26726a2aba77aa6d86014d2eb3507f0783
-Patch7:         cache-offscreen-invalidate-bitmap-before-free.patch
-
-# CVE-2026-22855
-# https://github.com/FreeRDP/FreeRDP/commit/57c5647d98c2a026de8b681159cb188ca0439ef8
-Patch8:         utils-smartcard-add-length-validity-checks.patch
-
-# CVE-2026-22858
-# https://github.com/FreeRDP/FreeRDP/commit/62a9e787edb2cfce9858fa4ceda5461680efc590
-Patch9:         crypto-base64-ensure-char-is-singend.patch
-
-# CVE-2026-22859
-# https://github.com/FreeRDP/FreeRDP/commit/7b7e6de8fe427a2f01d331056774aec69710590b
-Patch10:        channels-urbdrc-check-interface-indices-before-use.patch
-
-# CVE-2026-26955
-# https://github.com/FreeRDP/FreeRDP/commit/7d8fdce2d0ef337cb86cb37fc0c436c905e04d77
-Patch11:        codec-clear-fix-destination-checks.patch
-
-# CVE-2026-26965
-# https://github.com/FreeRDP/FreeRDP/commit/a0be5cb87d760bb1c803ad1bb835aa1e73e62abc
-Patch12:        codec-planar-fix-missing-destination-bounds-checks.patch
-
-# CVE-2026-22852
-# https://github.com/FreeRDP/FreeRDP/commit/cd1ffa112cfbe1b40a9fd57e299a8ea12e23df0d
-Patch13:        channels-audin-free-up-old-audio-formats.patch
-
-# CVE-2026-22854
-# https://github.com/FreeRDP/FreeRDP/commit/3da319570c8a6be0a79b3306f1ed354c4a943259
-Patch14:        channels-drive-fix-constant-type.patch
-
-# CVE-2026-22856
-# https://github.com/FreeRDP/FreeRDP/commit/b35aa3614d32bff3fc1272cd7c4617f711fca1a4
-# https://github.com/FreeRDP/FreeRDP/commit/675c20f08f32ca5ec06297108bdf30147d6e2cd9
-Patch15:        channels-serial-lock-list-dictionary.patch
-Patch16:        channels-serial-explicitly-lock-serial-IrpThreads.patch
-
-# CVE-2026-23732
-# https://github.com/FreeRDP/FreeRDP/commit/3bc1eeb4f63ceec9a696af194e4c1ea0e67ff60c
-# https://github.com/FreeRDP/FreeRDP/commit/9f0eb3b7d43069a1e973464bcb43d1ef965ae65e
-Patch17:        codec-color-add-freerdp_glyph_convert_ex.patch
-Patch18:        gdi-graphics-Use-freerdp_glyph_convert_ex.patch
-
-# CVE-2026-23948
-# https://github.com/FreeRDP/FreeRDP/commit/4d44e3c097656a8b9ec696353647b0888ca45860
-Patch19:        core-info-fix-missing-NULL-check.patch
-
-# CVE-2026-24491
-# https://github.com/FreeRDP/FreeRDP/commit/e02e052f6692550e539d10f99de9c35a23492db2
-# https://github.com/FreeRDP/FreeRDP/commit/635ae3c8193256db01774fab5ff11bcae57aed6b
-# https://github.com/FreeRDP/FreeRDP/commit/e01cd85c8003a245ef9778f0eda4b9235514c201
-Patch20:        channels-drdynvc-reset-channel_callback-before-close.patch
-Patch21:        channels-video-unify-error-handling.patch
-Patch22:        channels-video-fix-wrong-cast.patch
-
-# CVE-2026-24675
-# https://github.com/FreeRDP/FreeRDP/commit/d676518809c319eec15911c705c13536036af2ae
-Patch23:        channels-urbdrc-do-not-free-MsConfig-on-failure.patch
-
-# CVE-2026-24676
-# https://github.com/FreeRDP/FreeRDP/commit/026b81ae5831ac1598d8f7371e0d0996fac7db00
-Patch24:        channels-audin-reset-audin-format.patch
-
-# CVE-2026-24679
-# https://github.com/FreeRDP/FreeRDP/commit/2d563a50be17c1b407ca448b1321378c0726dd31
-Patch25:        channels-urbdrc-ensure-InterfaceNumber-is-within-ran.patch
-
-# CVE-2026-24681
-# https://github.com/FreeRDP/FreeRDP/commit/414f701464929c217f2509bcbd6d2c1f00f7ed73
-Patch26:        channels-urbdrc-cancel-all-usb-transfers-on-channel-.patch
-
-# CVE-2026-24683
-# https://github.com/FreeRDP/FreeRDP/commit/d9ca272dce7a776ab475e9b1a8e8c3d2968c8486
-Patch27:        channels-ainput-lock-context-when-updating-listener.patch
-
-# CVE-2026-24684
-# https://github.com/FreeRDP/FreeRDP/commit/622bb7b4402491ca003f47472d0e478132673696
-# https://github.com/FreeRDP/FreeRDP/commit/afa6851dc80835d3101e40fcef51b6c5c0f43ea5
-Patch28:        channels-rdpsnd-terminate-thread-before-free.patch
-Patch29:        channel-rdpsnd-only-clean-up-thread-before-free.patch
-
-# CVE-2026-31806
-# https://github.com/FreeRDP/FreeRDP/commit/83d9aedea278a74af3e490ff5eeb889c016dbb2b
-# https://github.com/FreeRDP/FreeRDP/commit/169971607cece48384cb94632b829bd57336af0f
-Patch30:        codec-nsc-limit-copy-area-in-nsc_process_message.patch
-Patch31:        codec-nsc-fix-use-of-nsc_process_message.patch
-
-# CVE-2026-33984
-# https://github.com/FreeRDP/FreeRDP/commit/a2dde6d9832cb032e8cf12cab3da84dafbab9006
-Patch32:        codec-clear-update-CLEAR_VBAR_ENTRY-size-after-alloc.patch
-
-# CVE-2026-33983
-# https://github.com/FreeRDP/FreeRDP/commit/78188ab479c8e6eb9ba2475b3732c76b4bbe5425
-# https://github.com/FreeRDP/FreeRDP/commit/78677dc6e262f46937d00c3aa52381e4bb198fa5
-Patch33:        codec-progressive-fail-progressive_rfx_quant_sub-on-invalid-values.patch
-Patch34:        codec-progressive-fix-underflow-guard-in-progressive_rfx_quant_sub.patch
-
-# CVE-2026-26986
-# https://github.com/FreeRDP/FreeRDP/commit/b4f0f0a18fe53aa8d47d062f91471f4e9c5e0d51
-Patch35:        client-x11-fix-xf_rail_window_common-cleanup.patch
-
-# CVE-2026-27951
-# https://github.com/FreeRDP/FreeRDP/commit/118afc0b954ba9d5632b7836ad24e454555ed113
-Patch36:        allocations-fix-growth-of-preallocated-buffers.patch
-
-# CVE-2026-29775
-# https://github.com/FreeRDP/FreeRDP/commit/ffad58fd2b329efd81a3239e9d7e3c927b8e503f
-# https://github.com/FreeRDP/FreeRDP/commit/8270e0bb3d6726c947d57c93ba9caa92a052b557
-Patch37:        cache-bitmap-overallocate-bitmap-cache.patch
-Patch38:        cache-bitmap-initialize-overallocated-bitmap-cache-extra-slot.patch
-
-# CVE-2026-31884
-# https://github.com/FreeRDP/FreeRDP/commit/03b48b3601d867afccac1cdc6081de7a275edce7
-Patch39:        codec-dsp-add-format-checks.patch
-
-# CVE-2026-31883
-# CVE-2026-31885
-# https://github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8
-Patch40:        codec-dsp-fix-array-bounds-checks.patch
-
-# CVE-2026-33985
-# https://github.com/FreeRDP/FreeRDP/commit/c49d1ad43b8c7b32794d0250f2623c2dccd7ef25
-Patch41:        codec-clear-update-clear_glyph_entry-count-after-alloc.patch
-
-# CVE-2026-25952
-# https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5
-# https://github.com/FreeRDP/FreeRDP/commit/78fd7f580d5f9e6d9d582d82e5ea96003844fbdf
-# https://github.com/FreeRDP/FreeRDP/commit/4ff57b68c2960fa414d03c78ff0e0660be1cc5bd
-# https://github.com/FreeRDP/FreeRDP/commit/a278ff74117444c635c50ffa5084ecf517171f5a
-Patch42:        client-x11-lock-appwindow.patch
-Patch43:        client-x11-improve-rails-window-locking.patch
-Patch44:        client-x11-refactor-locking.patch
-Patch45:        client-x11-fix-deadlock-on-output-expose.patch
-
-# CVE-2026-45700
-# https://github.com/FreeRDP/FreeRDP/commit/4a065a941ae134a0433d1497c03b3c3eb91b9f85
-Patch46:        codec-planar-fix-bounds-checks.patch
-
-# CVE-2026-64624
-# https://github.com/FreeRDP/FreeRDP/commit/22c5deea52404f51a13276b3abda44e1e60704cf
-Patch47:        client-common-deactivate-cli-parsing-in-rdp-files.patch
-
-# CVE-2026-67289
-# https://github.com/FreeRDP/FreeRDP/commit/f163b2d2080d922cb725800781f43f16bc2882c0
-# https://github.com/FreeRDP/FreeRDP/commit/ab5905cbada0d34cf85ffd32881cacaf8275744f
-# https://github.com/FreeRDP/FreeRDP/commit/1db16b4b121a1221c0454f7d223096cac87bf244
-Patch48:        winpr-crt-add-functions-to-test-string.patch
-Patch49:        core-redirection-check-redirection-values-for-validity.patch
-Patch50:        core-redirection-relax-checks.patch
-
-# CVE-2026-68580
-# https://github.com/FreeRDP/FreeRDP/commit/3bf07d4470bbe42faf4ef8197c8fe1b6b759b00f
-Patch51:        channels-audin-limit-FramesPerPacket.patch
-
-# CVE-2026-67299
-# https://github.com/FreeRDP/FreeRDP/commit/172edbddd24f33033b9eafae6ea1fff0641a24f4
-Patch52:        core-message-fix-update_message_WindowIcon.patch
-
-# CVE-2026-55194
-# https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a
-Patch53:        core-gateway-ensure-buffer-size-for-current-write.patch
-
-# CVE-2026-67288
-# https://github.com/FreeRDP/FreeRDP/commit/efe40e15d508f9754b7a3af851de4d2a0b1128d8
-Patch54:        scard-handle-nullptr-for-LookupName.patch
-
-# CVE-2026-67291
-# https://github.com/FreeRDP/FreeRDP/commit/649efd9326b3c5b236d39467b6e7de92d70efb59
-Patch55:        cache-glyph-tighten-bounds-checks.patch
-
-# CVE-2026-67301
-# https://github.com/FreeRDP/FreeRDP/commit/d0bf57c721b28c50d698cd5ffebea46fe86f6507
-Patch56:        core-message-fix-PolygonSC-and-PolygonCB-async-updates.patch
-
-BuildRequires:  gcc
-BuildRequires:  gcc-c++
-BuildRequires:  alsa-lib-devel
-BuildRequires:  cmake >= 2.8
-BuildRequires:  cups-devel
-BuildRequires:  gsm-devel
-%{?_with_lame:BuildRequires:  lame-devel}
-BuildRequires:  libicu-devel
-BuildRequires:  libjpeg-turbo-devel
-BuildRequires:  libX11-devel
-BuildRequires:  libXcursor-devel
-BuildRequires:  libXdamage-devel
-BuildRequires:  libXext-devel
-BuildRequires:  libXi-devel
-BuildRequires:  libXinerama-devel
-BuildRequires:  libxkbfile-devel
-BuildRequires:  libXrandr-devel
-%{?_with_server:BuildRequires:  libXtst-devel}
-BuildRequires:  libXv-devel
-%{?_with_opencl:BuildRequires: opencl-headers >= 3.0}
-%{?_with_opencl:BuildRequires: ocl-icd-devel}
-%{?_with_openh264:BuildRequires:  openh264-devel}
-%{?_with_x264:BuildRequires:  x264-devel}
-%{?_with_server:BuildRequires:  pam-devel}
-BuildRequires:  xmlto
-BuildRequires:  zlib-devel
-BuildRequires:  multilib-rpm-config
-
-BuildRequires:  pkgconfig(cairo)
-%{?_with_gss:BuildRequires:  pkgconfig(krb5) >= 1.13}
-BuildRequires:  pkgconfig(libpcsclite)
-BuildRequires:  pkgconfig(libpulse)
-BuildRequires:  pkgconfig(libsystemd)
-BuildRequires:  pkgconfig(libusb-1.0)
-BuildRequires:  pkgconfig(openssl)
-%{?_with_soxr:BuildRequires:  pkgconfig(soxr)}
-BuildRequires:  pkgconfig(wayland-client)
-BuildRequires:  pkgconfig(wayland-scanner)
-BuildRequires:  pkgconfig(xkbcommon)
-
-%{?_with_ffmpeg:
-BuildRequires:  pkgconfig(libavcodec) >= 57.48.101
-BuildRequires:  pkgconfig(libavutil)
-}
-
-Provides:       xfreerdp = %{?epoch}:%{version}-%{release}
-Requires:       %{name}-libs%{?_isa} = %{?epoch}:%{version}-%{release}
-Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
-
-%description
-The xfreerdp & wlfreerdp Remote Desktop Protocol (RDP) clients from the FreeRDP
-project.
-
-xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows
-machines, xrdp and VirtualBox.
-
-%package        libs
-Summary:        Core libraries implementing the RDP protocol
-Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
-Obsoletes:      %{name}-plugins < 1:1.1.0
-Provides:       %{name}-plugins = %{?epoch}:%{version}-%{release}
-%description    libs
-libfreerdp-core can be embedded in applications.
-
-libfreerdp-channels and libfreerdp-kbd might be convenient to use in X
-applications together with libfreerdp-core.
-
-libfreerdp-core can be extended with plugins handling RDP channels.
-
-%package        devel
-Summary:        Development files for %{name}
-Requires:       %{name}-libs%{?_isa} = %{?epoch}:%{version}-%{release}
-Requires:       pkgconfig
-Requires:       cmake >= 2.8
-
-%description    devel
-The %{name}-devel package contains libraries and header files for developing
-applications that use %{name}-libs.
-
-%{?_with_server:
-%package        server
-Summary:        Server support for %{name}
-Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
-Requires:       %{name}-libs%{?_isa} = %{?epoch}:%{version}-%{release}
-
-%description    server
-The %{name}-server package contains servers which can export a desktop via
-the RDP protocol.
-}
-
-%package -n     libwinpr
-Summary:        Windows Portable Runtime
-Provides:       %{name}-libwinpr = %{?epoch}:%{version}-%{release}
-Obsoletes:      %{name}-libwinpr < 1:1.2.0
-
-%description -n libwinpr
-WinPR provides API compatibility for applications targeting non-Windows
-environments. When on Windows, the original native API is being used instead of
-the equivalent WinPR implementation, without having to modify the code using it.
-
-%package -n     libwinpr-devel
-Summary:        Windows Portable Runtime development files
-Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
-Requires:       pkgconfig
-Requires:       cmake >= 2.8
-
-%description -n libwinpr-devel
-The %{name}-libwinpr-devel package contains libraries and header files for
-developing applications that use %{name}-libwinpr.
-
-%prep
-%autosetup -p1 -n FreeRDP-%{version}
-
-# Rpmlint fixes
-find . -name "*.h" -exec chmod 664 {} \;
-find . -name "*.c" -exec chmod 664 {} \;
-
-%build
-%cmake %{?_cmake_skip_rpath} \
-    -DCMAKE_INSTALL_LIBDIR:PATH=%{_lib} \
-    -DWITH_ALSA=ON \
-    -DWITH_CAIRO=ON \
-    -DWITH_CUPS=ON \
-    -DWITH_CHANNELS=ON -DBUILTIN_CHANNELS=OFF \
-    -DWITH_CLIENT=ON \
-    -DWITH_DIRECTFB=OFF \
-    -DWITH_DSP_FFMPEG=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
-    -DWITH_FFMPEG=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
-    -DWITH_GSM=ON \
-    -DWITH_GSSAPI=%{?_with_gss:ON}%{?!_with_gss:OFF} \
-    -DWITH_ICU=ON \
-    -DWITH_IPP=OFF \
-    -DWITH_JPEG=ON \
-    -DWITH_LAME=%{?_with_lame:ON}%{?!_with_lame:OFF} \
-    -DWITH_MANPAGES=ON \
-    -DWITH_OPENCL=%{?_with_opencl:ON}%{?!_with_opencl:OFF} \
-    -DWITH_OPENH264=%{?_with_openh264:ON}%{?!_with_openh264:OFF} \
-    -DWITH_OPENSSL=ON \
-    -DWITH_PCSC=ON \
-    -DWITH_PULSE=ON \
-    -DWITH_SERVER=%{?_with_server:ON}%{?!_with_server:OFF} \
-    -DWITH_SERVER_INTERFACE=%{?_with_server:ON}%{?!_with_server:OFF} \
-    -DWITH_SHADOW_X11=%{?_with_server:ON}%{?!_with_server:OFF} \
-    -DWITH_SHADOW_MAC=%{?_with_server:ON}%{?!_with_server:OFF} \
-    -DWITH_SOXR=%{?_with_soxr:ON}%{?!_with_soxr:OFF} \
-    -DWITH_WAYLAND=ON \
-    -DWITH_X11=ON \
-    -DWITH_XCURSOR=ON \
-    -DWITH_XEXT=ON \
-    -DWITH_XKBFILE=ON \
-    -DWITH_XI=ON \
-    -DWITH_XINERAMA=ON \
-    -DWITH_XRENDER=ON \
-    -DWITH_XTEST=%{?_with_server:ON}%{?!_with_server:OFF} \
-    -DWITH_XV=ON \
-    -DWITH_ZLIB=ON \
-%ifarch x86_64
-    -DWITH_SSE2=ON \
-    -DWITH_VAAPI=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
-%else
-    -DWITH_SSE2=OFF \
-%endif
-%ifarch armv7hl
-    -DARM_FP_ABI=hard \
-    -DWITH_NEON=OFF \
-%endif
-%ifarch armv7hnl
-    -DARM_FP_ABI=hard \
-    -DWITH_NEON=ON \
-%endif
-%ifarch armv5tel armv6l armv7l
-    -DARM_FP_ABI=soft \
-    -DWITH_NEON=OFF \
-%endif
-    %{nil}
-
-%cmake_build
-
-%install
-%cmake_install
-
-find %{buildroot} -name "*.a" -delete
-
-%multilib_fix_c_header --file %{_includedir}/freerdp2/freerdp/build-config.h
-
-%files
-%{_bindir}/winpr-hash
-%{_bindir}/winpr-makecert
-%{_bindir}/wlfreerdp
-%{_bindir}/xfreerdp
-%{_mandir}/man1/winpr-hash.1*
-%{_mandir}/man1/winpr-makecert.1*
-%{_mandir}/man1/wlfreerdp.1*
-%{_mandir}/man1/xfreerdp.1*
-
-%files libs
-%license LICENSE
-%doc README.md ChangeLog
-%{_libdir}/freerdp2/
-%{_libdir}/libfreerdp-client2.so.*
-%{?_with_server:
-%{_libdir}/libfreerdp-server2.so.*
-%{_libdir}/libfreerdp-shadow2.so.*
-%{_libdir}/libfreerdp-shadow-subsystem2.so.*
-}
-%{_libdir}/libfreerdp2.so.*
-%{_libdir}/libuwac0.so.*
-%{_mandir}/man7/wlog.*
-
-%files devel
-%{_includedir}/freerdp2
-%{_includedir}/uwac0
-%{_libdir}/cmake/FreeRDP2
-%{_libdir}/cmake/FreeRDP-Client2
-%{?_with_server:
-%{_libdir}/cmake/FreeRDP-Server2
-%{_libdir}/cmake/FreeRDP-Shadow2
-}
-%{_libdir}/cmake/uwac0
-%{_libdir}/libfreerdp-client2.so
-%{?_with_server:
-%{_libdir}/libfreerdp-server2.so
-%{_libdir}/libfreerdp-shadow2.so
-%{_libdir}/libfreerdp-shadow-subsystem2.so
-}
-%{_libdir}/libfreerdp2.so
-%{_libdir}/libuwac0.so
-%{_libdir}/pkgconfig/freerdp2.pc
-%{_libdir}/pkgconfig/freerdp-client2.pc
-%{?_with_server:
-%{_libdir}/pkgconfig/freerdp-server2.pc
-%{_libdir}/pkgconfig/freerdp-shadow2.pc
-}
-%{_libdir}/pkgconfig/uwac0.pc
-
-%{?_with_server:
-%files server
-%{_bindir}/freerdp-proxy
-%{_bindir}/freerdp-shadow-cli
-%{_mandir}/man1/freerdp-shadow-cli.1*
-}
-
-%files -n libwinpr
-%license LICENSE
-%doc README.md ChangeLog
-%{_libdir}/libwinpr2.so.*
-%{_libdir}/libwinpr-tools2.so.*
-
-%files -n libwinpr-devel
-%{_libdir}/cmake/WinPR2
-%{_includedir}/winpr2
-%{_libdir}/libwinpr2.so
-%{_libdir}/libwinpr-tools2.so
-%{_libdir}/pkgconfig/winpr2.pc
-%{_libdir}/pkgconfig/winpr-tools2.pc
-
-%changelog
-* Sat Aug 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:2.11.7-12
-- Backport several CVE fixes (CVE-2026-55194, CVE-2026-67288, CVE-2026-67291,
-  CVE-2026-67301)
-  Resolves: RHEL-225093, RHEL-227724, RHEL-236063, RHEL-246245
-
-* Tue Aug 04 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:2.11.7-11
-- Backport several CVE fixes (CVE-2026-64624, CVE-2026-67289, CVE-2026-67299,
-  CVE-2026-68580)
-  Resolves: RHEL-213173, RHEL-222796, RHEL-222972, RHEL-223606
-
-* Wed Jun 24 2026 RHEL Packaging Agent <rhel-se-jotnar@redhat.com> - 2:2.11.7-10
-- Fix incorrect bounds checks in planar codec (CVE-2026-45700)
-  Resolves: RHEL-186983
-
-* Tue May 05 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-9
-- Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952)
-  Resolves: RHEL-159850
-
-* Tue Apr 28 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-8
-- Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
-- Fix growth of preallocated buffers (CVE-2026-27951)
-- Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
-- Add DSP format checks (CVE-2026-31884)
-- Fix DSP array bounds checks (CVE-2026-31883)
-- Fix DSP array bounds checks (CVE-2026-31885)
-- Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985)
-  Resolves: RHEL-159806, RHEL-155468, RHEL-161037, RHEL-161472
-  Resolves: RHEL-161508, RHEL-161075, RHEL-167794
-
-* Fri Apr 10 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-7
-- Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
-- Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)
-  Resolves: RHEL-162949, RHEL-162965
-
-* Tue Mar 31 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-6
-- Fix use of nsc_process_message
-  Resolves: RHEL-155984
-
-* Fri Mar 27 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-5
-- Backport several CVE fixes
-  Resolves: RHEL-147954, RHEL-147955, RHEL-147970, RHEL-147977, RHEL-147980
-  Resolves: RHEL-148002, RHEL-148014, RHEL-148031, RHEL-148906, RHEL-148996
-  Resolves: RHEL-149007, RHEL-149056, RHEL-155984
-
-* Wed Mar 25 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-4
-- Backport several CVE fixes
-  Resolves: RHEL-151979, RHEL-152206
-
-* Tue Feb 17 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-3
-- Backport several CVE fixes
-  Resolves: RHEL-148825, RHEL-148865, RHEL-148982
-
-* Tue Jan 27 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-2
-- Backport several CVE fixes
-  Resolves: RHEL-142417, RHEL-142401, RHEL-142385, RHEL-142369, RHEL-142353
-  Resolves: RHEL-142337, RHEL-142321
-
-* Tue Oct 01 2024 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1
-- Update to 2.11.7 (RHEL-53081)
-
-* Tue Dec 13 2022 Ondrej Holy <oholy@redhat.com> - 2:2.2.0-10
-- Fix "implicit declaration of function" errors (#2136153, #2145139)
-
-* Thu Dec 08 2022 Ondrej Holy <oholy@redhat.com> - - 2:2.2.0-9
-- CVE-2022-39282: Fix length checks in parallel driver (#2136151)
-- CVE-2022-39283: Add missing length check in video channel (#2136153)
-- CVE-2022-39316, CVE-2022-39317: Add missing length checks in zgfx (#2145139)
-- CVE-2022-39318: Fix division by zero in urbdrc channel (#2145139)
-- CVE-2022-39319: Add missing length checks in urbdrc channel (#2145139)
-- CVE-2022-39320: Ensure urb_create_iocompletion uses size_t (#2145139)
-- CVE-2022-39347: Fix path validation in drive channel (#2145139)
-- CVE-2022-41877: Add missing length check in drive channel (#2145139)
-
-* Thu Aug 11 2022 Ondrej Holy <oholy@redhat.com> - 2:2.2.0-8
-- Fix /monitor-list output (rhbz#2108866)
-
-* Wed Nov 10 2021 Ondrej Holy <oholy@redhat.com> - 2:2.2.0-4
-- Refactored RPC gateway parser (rhbz#2017949)
-
-* Fri Nov 05 2021 Felipe Borges <feborges@redhat.com> - 2:2.2.0-3
-- Add checks for bitmap and glyph width and heigth values (rhbz#2017956)
-
-* Wed Apr 28 2021 Ondrej Holy <oholy@redhat.com> - 2:2.2.0-2
-- Fix exit codes for /help and similar options (rhbz#1910029)
-
-* Fri Nov 20 2020 Ondrej Holy <oholy@redhat.com> - 2:2.2.0-1
-- Update to 2.2.0 (rhbz#1881971)
-
-* Mon May 25 2020 Ondrej Holy <oholy@redhat.com> - 2:2.1.1-1
-- Update to 2.1.1 (rhbz#1834287).
-
-* Fri Apr 17 2020 Ondrej Holy <oholy@redhat.com> - 2:2.0.0-47.rc4
-- Fix SCARD_INSUFFICIENT_BUFFER error (rhbz#1803054)
-- Do not advertise /usb in help output (rhbz#1761144)
-
-* Wed Nov 28 2018 Ondrej Holy <oholy@redhat.com> - 2:2.0.0-46.rc4
-- Update to 2.0.0-rc4 (#1624340)
-
-* Mon Oct 15 2018 Ondrej Holy <oholy@redhat.com> - 2:2.0.0-45.rc3
-- Disable server support in RHEL (#1639165)
-
-* Wed Oct 10 2018 Ondrej Holy <oholy@redhat.com> - 2:2.0.0-44.rc3
-- Fix packaging issues found by rpmdiff (#1637487)
-
-* Tue Sep 25 2018 Ondrej Holy <oholy@redhat.com> - 2:2.0.0-43.rc3
-- Fix important defects found by covscan (#1602500)
-
-* Thu Sep 06 2018 Ondrej Holy <oholy@redhat.com> - 2:2.0.0-42.rc3
-- Update to 2.0.0-rc3 (#1624340)
-
-* Mon Apr 09 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-41.20180405gita9ecd6a
-- Update to latest snapshot.
-
-* Wed Mar 21 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-40.20180320gitde83f4d
-- Add PAM support (fixes freerdp-shadow-cli). Thanks Paolo Zeppegno.
-- Update to latest snapshot.
-
-* Thu Mar 15 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-39.20180314gitf8baeb7
-- Update to latest snapshot.
-- Fixes connection to RDP servers with the latest Microsoft patches:
-  https://github.com/FreeRDP/FreeRDP/issues/4449
-
-* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-38.20180115git8f52c7e
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
-
-* Thu Jan 18 2018 Karsten Hopp <karsten@redhat.com> - 2.0.0-37git}
-- use versioned build requirement on pkgconfig(openssl) to prevent using
-  compat-openssl10-devel instead of openssl-devel
-
-* Tue Jan 16 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-36.20180115git8f52c7e
-- Update to latest snapshot.
-- Make GSS support optional and disable it for now (#1534094 and FreeRDP #4348,
-  #1435, #4363).
-
-* Wed Dec 20 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-35.20171220gitbfe8359
-- Update to latest snapshot post 2.0.0rc1.
-
-* Mon Sep 11 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-34.20170831git3b83526
-- Update to latest snapshot.
-- Trim changelog.
-
-* Mon Aug 07 2017 Björn Esser <besser82@fedoraproject.org> - 2:2.0.0-33.20170724gitf8c9f43
-- Rebuilt for AutoReq cmake-filesystem
-
-* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-32.20170724gitf8c9f43
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
-
-* Thu Jul 27 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-31.20170724gitf8c9f43
-- Update to latest snapshot, Talos security fixes.
-
-* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-30.20170710gitf580bea
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Wed Jul 12 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-29.20170710gitf580bea
-- Update to latest snapshot.
-
-* Mon Jun 26 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-28.20170623git9904c32
-- Update to latest snapshot.
-
-* Mon May 15 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-27.20170512gitb1df835
-- Update to latest snapshot.
-
-* Thu Apr 20 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-26.20170419gitbfcf8e7
-- Update to latest 2.0 snapshot.
-
-* Thu Apr 13 2017 Orion Poplawski <orion@cora.nwra.com> - 2:2.0.0-25.20170317git8c68761
-- Install tools via make install
-
-* Wed Mar 22 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-24.20170317git8c68761
-- Update to latest snapshot.
-
-* Mon Mar 06 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-23.20170302git210de68
-- Remove shared libxfreerdp-client shared library.
-
-* Thu Mar 02 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-22.20170302git210de68
-- Move libxfreerdp-client shared object into devel subpackage.
-
-* Thu Mar 02 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-21.20170302git210de68
-- Update to latest snapshot.
-- Update build requirements, tune build options.
-
-* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-20.20161228git90877f5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
-
-* Mon Jan 09 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-19.20161228git90877f5
-- Update to latest snapshot.

Use-default-threadpool.patch

@@ -0,0 +1,321 @@
+From 00968fd6e647af286e67bbd616168c4de7a39208 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Wed, 3 Sep 2025 14:40:47 +0200
+Subject: [PATCH 067/100] [codec] use default threadpool
+
+Backported together with these commits to be applicable:
+  [codec,yuv] fix thread count calculation
+   - 17315c593655d476cccfb9a1b56e41f37030f8e1
+  [codec,yuv] fix worker object handling
+   - 1cc64eb58b2f5ce9e4ad8aa8610e085f696e578c
+  Fix YUV conversion for systems with lots of CPUs
+   - 774ee652a9c73c0bc3cdba26eba0c112f079cee4
+
+---
+ libfreerdp/codec/progressive.c |  5 ++-
+ libfreerdp/codec/rfx.c         | 56 +++++++---------------------------
+ libfreerdp/codec/rfx_types.h   |  6 ----
+ libfreerdp/codec/yuv.c         | 32 ++-----------------
+ 4 files changed, 16 insertions(+), 83 deletions(-)
+
+diff --git a/libfreerdp/codec/progressive.c b/libfreerdp/codec/progressive.c
+index 6396e0f2a..8b5200546 100644
+--- a/libfreerdp/codec/progressive.c
++++ b/libfreerdp/codec/progressive.c
+@@ -1698,9 +1698,8 @@ static INLINE SSIZE_T progressive_process_tiles(
+ 
+ 		if (progressive->rfx_context->priv->UseThreads)
+ 		{
+-			progressive->work_objects[idx] =
+-			    CreateThreadpoolWork(progressive_process_tiles_tile_work_callback, (void*)param,
+-			                         &progressive->rfx_context->priv->ThreadPoolEnv);
++			progressive->work_objects[idx] = CreateThreadpoolWork(
++			    progressive_process_tiles_tile_work_callback, (void*)param, NULL);
+ 			if (!progressive->work_objects[idx])
+ 			{
+ 				WLog_Print(progressive->log, WLOG_ERROR,
+diff --git a/libfreerdp/codec/rfx.c b/libfreerdp/codec/rfx.c
+index 8832cd740..2ec4eb521 100644
+--- a/libfreerdp/codec/rfx.c
++++ b/libfreerdp/codec/rfx.c
+@@ -205,16 +205,8 @@ RFX_CONTEXT* rfx_context_new(BOOL encoder)
+ 
+ RFX_CONTEXT* rfx_context_new_ex(BOOL encoder, UINT32 ThreadingFlags)
+ {
+-	HKEY hKey = NULL;
+-	LONG status = 0;
+-	DWORD dwType = 0;
+-	DWORD dwSize = 0;
+-	DWORD dwValue = 0;
+-	SYSTEM_INFO sysinfo;
+-	RFX_CONTEXT* context = NULL;
+-	wObject* pool = NULL;
+ 	RFX_CONTEXT_PRIV* priv = NULL;
+-	context = (RFX_CONTEXT*)winpr_aligned_calloc(1, sizeof(RFX_CONTEXT), 32);
++	RFX_CONTEXT* context = (RFX_CONTEXT*)winpr_aligned_calloc(1, sizeof(RFX_CONTEXT), 32);
+ 
+ 	if (!context)
+ 		return NULL;
+@@ -233,7 +225,7 @@ RFX_CONTEXT* rfx_context_new_ex(BOOL encoder, UINT32 ThreadingFlags)
+ 	if (!priv->TilePool)
+ 		goto fail;
+ 
+-	pool = ObjectPool_Object(priv->TilePool);
++	wObject* pool = ObjectPool_Object(priv->TilePool);
+ 	pool->fnObjectInit = rfx_tile_init;
+ 
+ 	if (context->encoder)
+@@ -267,29 +259,22 @@ RFX_CONTEXT* rfx_context_new_ex(BOOL encoder, UINT32 ThreadingFlags)
+ 
+ 	if (!(ThreadingFlags & THREADING_FLAGS_DISABLE_THREADS))
+ 	{
++		HKEY hKey = NULL;
+ 		priv->UseThreads = TRUE;
+ 
+-		GetNativeSystemInfo(&sysinfo);
+-		priv->MinThreadCount = sysinfo.dwNumberOfProcessors;
+-		priv->MaxThreadCount = 0;
+-		status = RegOpenKeyExA(HKEY_LOCAL_MACHINE, RFX_KEY, 0, KEY_READ | KEY_WOW64_64KEY, &hKey);
++		const LONG status =
++		    RegOpenKeyExA(HKEY_LOCAL_MACHINE, RFX_KEY, 0, KEY_READ | KEY_WOW64_64KEY, &hKey);
+ 
+ 		if (status == ERROR_SUCCESS)
+ 		{
+-			dwSize = sizeof(dwValue);
++			DWORD dwType = 0;
++			DWORD dwValue = 0;
++			DWORD dwSize = sizeof(dwValue);
+ 
+ 			if (RegQueryValueEx(hKey, _T("UseThreads"), NULL, &dwType, (BYTE*)&dwValue, &dwSize) ==
+ 			    ERROR_SUCCESS)
+ 				priv->UseThreads = dwValue ? 1 : 0;
+ 
+-			if (RegQueryValueEx(hKey, _T("MinThreadCount"), NULL, &dwType, (BYTE*)&dwValue,
+-			                    &dwSize) == ERROR_SUCCESS)
+-				priv->MinThreadCount = dwValue;
+-
+-			if (RegQueryValueEx(hKey, _T("MaxThreadCount"), NULL, &dwType, (BYTE*)&dwValue,
+-			                    &dwSize) == ERROR_SUCCESS)
+-				priv->MaxThreadCount = dwValue;
+-
+ 			RegCloseKey(hKey);
+ 		}
+ 	}
+@@ -304,20 +289,6 @@ RFX_CONTEXT* rfx_context_new_ex(BOOL encoder, UINT32 ThreadingFlags)
+ 		/* from multiple threads. This call will initialize all function pointers correctly     */
+ 		/* before any decoding threads are started */
+ 		primitives_get();
+-		priv->ThreadPool = CreateThreadpool(NULL);
+-
+-		if (!priv->ThreadPool)
+-			goto fail;
+-
+-		InitializeThreadpoolEnvironment(&priv->ThreadPoolEnv);
+-		SetThreadpoolCallbackPool(&priv->ThreadPoolEnv, priv->ThreadPool);
+-
+-		if (priv->MinThreadCount)
+-			if (!SetThreadpoolThreadMinimum(priv->ThreadPool, priv->MinThreadCount))
+-				goto fail;
+-
+-		if (priv->MaxThreadCount)
+-			SetThreadpoolThreadMaximum(priv->ThreadPool, priv->MaxThreadCount);
+ 	}
+ 
+ 	/* initialize the default pixel format */
+@@ -370,9 +341,6 @@ void rfx_context_free(RFX_CONTEXT* context)
+ 		ObjectPool_Free(priv->TilePool);
+ 		if (priv->UseThreads)
+ 		{
+-			if (priv->ThreadPool)
+-				CloseThreadpool(priv->ThreadPool);
+-			DestroyThreadpoolEnvironment(&priv->ThreadPoolEnv);
+ 			winpr_aligned_free((void*)priv->workObjects);
+ 			winpr_aligned_free(priv->tileWorkParams);
+ #ifdef WITH_PROFILER
+@@ -1086,9 +1054,8 @@ static INLINE BOOL rfx_process_message_tileset(RFX_CONTEXT* WINPR_RESTRICT conte
+ 				params[i].context = context;
+ 				params[i].tile = message->tiles[i];
+ 
+-				if (!(work_objects[i] =
+-				          CreateThreadpoolWork(rfx_process_message_tile_work_callback,
+-				                               (void*)&params[i], &context->priv->ThreadPoolEnv)))
++				if (!(work_objects[i] = CreateThreadpoolWork(rfx_process_message_tile_work_callback,
++				                                             (void*)&params[i], NULL)))
+ 				{
+ 					WLog_Print(context->priv->log, WLOG_ERROR, "CreateThreadpoolWork failed.");
+ 					rc = FALSE;
+@@ -1829,8 +1796,7 @@ RFX_MESSAGE* rfx_encode_message(RFX_CONTEXT* WINPR_RESTRICT context,
+ 					workParam->tile = tile;
+ 
+ 					if (!(*workObject = CreateThreadpoolWork(rfx_compose_message_tile_work_callback,
+-					                                         (void*)workParam,
+-					                                         &context->priv->ThreadPoolEnv)))
++					                                         (void*)workParam, NULL)))
+ 					{
+ 						goto skip_encoding_loop;
+ 					}
+diff --git a/libfreerdp/codec/rfx_types.h b/libfreerdp/codec/rfx_types.h
+index a9cd314da..c5a62259b 100644
+--- a/libfreerdp/codec/rfx_types.h
++++ b/libfreerdp/codec/rfx_types.h
+@@ -69,11 +69,11 @@ struct S_RFX_CONTEXT_PRIV
+ 	PTP_WORK* workObjects;
+ 	RFX_TILE_COMPOSE_WORK_PARAM* tileWorkParams;
+ 
+-	DWORD MinThreadCount;
++	DWORD MinThreadCount;              /* Kept only to silence abidiff */
+-	DWORD MaxThreadCount;
++	DWORD MaxThreadCount;              /* Kept only to silence abidiff */
+ 
+-	PTP_POOL ThreadPool;
++	PTP_POOL ThreadPool;               /* Kept only to silence abidiff */
+-	TP_CALLBACK_ENVIRON ThreadPoolEnv;
++	TP_CALLBACK_ENVIRON ThreadPoolEnv; /* Kept only to silence abidiff */
+ 
+ 	wBufferPool* BufferPool;
+ 
+diff --git a/libfreerdp/codec/yuv.c b/libfreerdp/codec/yuv.c
+index 75d8a6a89..4025782dd 100644
+--- a/libfreerdp/codec/yuv.c
++++ b/libfreerdp/codec/yuv.c
+@@ -55,11 +55,11 @@ struct S_YUV_CONTEXT
+ 	UINT32 width, height;
+ 	BOOL useThreads;
+ 	BOOL encoder;
+-	UINT32 nthreads;
++	UINT32 nthreads;                   /* Kept only to silence abidiff */
+ 	UINT32 heightStep;
+ 
+-	PTP_POOL threadPool;
++	PTP_POOL threadPool;               /* Kept only to silence abidiff */
+-	TP_CALLBACK_ENVIRON ThreadPoolEnv;
++	TP_CALLBACK_ENVIRON ThreadPoolEnv; /* Kept only to silence abidiff */
+ 
+ 	UINT32 work_object_count;
+ 	PTP_WORK* work_objects;
+@@ -166,16 +162,21 @@ BOOL yuv_context_reset(YUV_CONTEXT* WINPR_RESTRICT context, UINT32 width, UINT32
+ 
+ 	context->width = width;
+ 	context->height = height;
+-	context->heightStep = (height / context->nthreads);
++
++	context->heightStep = height;
+ 
+ 	if (context->useThreads)
+ 	{
+-		const UINT32 pw = (width + TILE_SIZE - width % TILE_SIZE) / TILE_SIZE;
+-		const UINT32 ph = (height + TILE_SIZE - height % TILE_SIZE) / TILE_SIZE;
++		context->heightStep = 16;
++		/* Preallocate workers for 16x16 tiles.
++		 * this is overallocation for most cases.
++		 *
++		 * ~2MB total for a 4k resolution, so negligible.
++		 */
++		const size_t pw = (width + TILE_SIZE - width % TILE_SIZE) / 16;
++		const size_t ph = (height + TILE_SIZE - height % TILE_SIZE) / 16;
+ 
+-		/* We´ve calculated the amount of workers for 64x64 tiles, but the decoder
+-		 * might get 16x16 tiles mixed in. */
+-		const UINT32 count = pw * ph * 16;
++		const size_t count = pw * ph;
+ 
+ 		context->work_object_count = 0;
+ 		if (context->encoder)
+@@ -237,33 +234,13 @@ YUV_CONTEXT* yuv_context_new(BOOL encoder, UINT32 ThreadingFlags)
+ 	primitives_get();
+ 
+ 	ret->encoder = encoder;
+-	ret->nthreads = 1;
+ 	if (!(ThreadingFlags & THREADING_FLAGS_DISABLE_THREADS))
+ 	{
+ 		GetNativeSystemInfo(&sysInfos);
+ 		ret->useThreads = (sysInfos.dwNumberOfProcessors > 1);
+-		if (ret->useThreads)
+-		{
+-			ret->nthreads = sysInfos.dwNumberOfProcessors;
+-			ret->threadPool = CreateThreadpool(NULL);
+-			if (!ret->threadPool)
+-			{
+-				goto error_threadpool;
+-			}
+-
+-			InitializeThreadpoolEnvironment(&ret->ThreadPoolEnv);
+-			SetThreadpoolCallbackPool(&ret->ThreadPoolEnv, ret->threadPool);
+-		}
+ 	}
+ 
+ 	return ret;
+-
+-error_threadpool:
+-	WINPR_PRAGMA_DIAG_PUSH
+-	WINPR_PRAGMA_DIAG_IGNORED_MISMATCHED_DEALLOC
+-	yuv_context_free(ret);
+-	WINPR_PRAGMA_DIAG_POP
+-	return NULL;
+ }
+ 
+ void yuv_context_free(YUV_CONTEXT* context)
+@@ -272,9 +249,6 @@ void yuv_context_free(YUV_CONTEXT* context)
+ 		return;
+ 	if (context->useThreads)
+ 	{
+-		if (context->threadPool)
+-			CloseThreadpool(context->threadPool);
+-		DestroyThreadpoolEnvironment(&context->ThreadPoolEnv);
+ 		winpr_aligned_free((void*)context->work_objects);
+ 		winpr_aligned_free(context->work_combined_params);
+ 		winpr_aligned_free(context->work_enc_params);
+@@ -330,7 +304,7 @@ static BOOL submit_object(PTP_WORK* WINPR_RESTRICT work_object, PTP_WORK_CALLBAC
+ 	if (!param || !context)
+ 		return FALSE;
+ 
+-	*work_object = CreateThreadpoolWork(cb, cnv.pv, &context->ThreadPoolEnv);
++	*work_object = CreateThreadpoolWork(cb, cnv.pv, NULL);
+ 	if (!*work_object)
+ 		return FALSE;
+ 
+@@ -439,11 +417,8 @@ static BOOL pool_decode(YUV_CONTEXT* WIN
+ 
+ 				if (context->work_object_count <= waitCount)
+ 				{
+-					WLog_ERR(TAG,
+-					         "YUV decoder: invalid number of tiles, only support less than %" PRIu32
+-					         ", got %" PRIu32,
+-					         context->work_object_count, waitCount);
+-					goto fail;
++					free_objects(context->work_objects, context->work_object_count);
++					waitCount = 0;
+ 				}
+ 
+ 				YUV_PROCESS_WORK_PARAM* cur = &context->work_dec_params[waitCount];
+@@ -586,11 +561,8 @@ static BOOL pool_decode_rect(YUV_CONTEXT
+ 
+ 		if (context->work_object_count <= waitCount)
+ 		{
+-			WLog_ERR(TAG,
+-			         "YUV rect decoder: invalid number of tiles, only support less than %" PRIu32
+-			         ", got %" PRIu32,
+-			         context->work_object_count, waitCount);
+-			goto fail;
++			free_objects(context->work_objects, context->work_object_count);
++			waitCount = 0;
+ 		}
+ 		current = &context->work_combined_params[waitCount];
+ 		*current = pool_decode_rect_param(&regionRects[waitCount], context, type, pYUVData, iStride,
+@@ -848,11 +820,8 @@ static BOOL pool_encode(YUV_CONTEXT* WIN
+ 
+ 			if (context->work_object_count <= waitCount)
+ 			{
+-				WLog_ERR(TAG,
+-				         "YUV encoder: invalid number of tiles, only support less than %" PRIu32
+-				         ", got %" PRIu32,
+-				         context->work_object_count, waitCount);
+-				goto fail;
++				free_objects(context->work_objects, context->work_object_count);
++				waitCount = 0;
+ 			}
+ 
+ 			current = &context->work_enc_params[waitCount];
+-- 
+2.51.0
+

freerdp.spec

@@ -0,0 +1,707 @@
+# Can be rebuilt with FFmpeg/OpenH264 support enabled by passing
+# "--with=ffmpeg", or "--with=openh264" to mock/rpmbuild; or by globally
+# setting these variables:
+# https://bugzilla.redhat.com/show_bug.cgi?id=2242028
+#global _with_ffmpeg 1
+#global _with_openh264 1
+
+# Can be rebuilt with OpenCL support enabled by passing # "--with=opencl"
+# or by globally setting:
+#global _opencl 1
+
+# Disable server support in RHEL
+# https://bugzilla.redhat.com/show_bug.cgi?id=1639165
+%if 0%{?fedora} || 0%{?rhel} >= 10
+%global _with_server 1
+%endif
+
+# Force uwac to be static to avoid conflicts with freerdp2
+# FIXME: Disable this once all freerdp2 consumers are ported to freerdp3
+%global _with_static_uwac 1
+
+# Disable unwanted dependencies for RHEL
+%{!?rhel:%global _with_sdl_client 1}
+%{!?rhel:%global _with_soxr 1}
+%{!?rhel:%global _with_uriparser 1}
+
+# Disable support for AAD WebView popup since it uses webkit2gtk-4.0
+#global _with_webview 1
+
+Name:           freerdp
+Epoch:          2
+Version:        3.10.3
+Release:        5%{?dist}
+Summary:        Free implementation of the Remote Desktop Protocol (RDP)
+
+# The effective license is Apache-2.0 but:
+# client/SDL/dialogs/font/* is OFL-1.1
+# uwac/libuwac/* is HPND
+# uwac/protocols/server-decoration.xml is LGPL-2.1-or-later
+# winpr/libwinpr/ncrypt/pkcs11-headers/pkcs11.h is LicenseRef-Fedora-Public-Domain
+License:        Apache-2.0 AND HPND AND LGPL-2.1-or-later AND LicenseRef-Fedora-Public-Domain AND OFL-1.1
+URL:            http://www.freerdp.com/
+
+# The license of the winpr/libwinpr/crt/unicode_builtin.c file is not allowed.
+# See: https://gitlab.com/fedora/legal/fedora-license-data/-/issues/498
+# Run the ./freerdp_download_and_repack.sh script to prepare tarball.
+Source0:        FreeRDP-%{version}-repack.tar.gz
+Source1:        freerdp_download_and_repack.sh
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2365232
+Patch0:         Initialize-function-pointers-after-resource-allocation.patch
+
+# https://issues.redhat.com/browse/RHEL-86251
+Patch1:         Limit-threadpool-to-16-threads.patch
+Patch2:         Use-default-threadpool.patch
+Patch3:         Default-minimum-thread-count.patch
+Patch4:         Limit-minimum-threadpool-size.patch
+
+BuildRequires:  gcc
+BuildRequires:  gcc-c++
+BuildRequires:  alsa-lib-devel
+BuildRequires:  cmake >= 3.13
+BuildRequires:  cups-devel
+BuildRequires:  gsm-devel
+BuildRequires:  lame-devel
+BuildRequires:  libicu-devel
+BuildRequires:  libjpeg-turbo-devel
+BuildRequires:  libX11-devel
+BuildRequires:  libXcursor-devel
+BuildRequires:  libXdamage-devel
+BuildRequires:  libXext-devel
+BuildRequires:  libXi-devel
+BuildRequires:  libXinerama-devel
+BuildRequires:  libxkbfile-devel
+BuildRequires:  libXrandr-devel
+%{?_with_server:BuildRequires:  libXtst-devel}
+BuildRequires:  libXv-devel
+%{?_with_opencl:BuildRequires: opencl-headers >= 3.0}
+%{?_with_opencl:BuildRequires: ocl-icd-devel}
+%{?_with_openh264:BuildRequires:  openh264-devel}
+%{?_with_x264:BuildRequires:  x264-devel}
+%{?_with_server:BuildRequires:  pam-devel}
+BuildRequires:  xmlto
+BuildRequires:  zlib-devel
+BuildRequires:  multilib-rpm-config
+
+BuildRequires:  cmake(json-c)
+# Packaging error led to cmake files in the wrong place
+# Fixed in https://src.fedoraproject.org/rpms/uriparser/c/1b07302bfc80983fbf84283783370e8338d36429
+%{?_with_uriparser:BuildRequires:  (cmake(uriparser) and uriparser-devel)}
+
+BuildRequires:  pkgconfig(cairo)
+BuildRequires:  pkgconfig(krb5)
+BuildRequires:  pkgconfig(fdk-aac)
+BuildRequires:  pkgconfig(fuse3)
+BuildRequires:  pkgconfig(libpcsclite)
+BuildRequires:  pkgconfig(libpulse)
+BuildRequires:  pkgconfig(libsystemd)
+BuildRequires:  pkgconfig(libusb-1.0)
+BuildRequires:  pkgconfig(libwebp)
+BuildRequires:  pkgconfig(openssl)
+BuildRequires:  pkgconfig(opus)
+%{?_with_sdl_client:BuildRequires:  pkgconfig(sdl2)}
+%{?_with_sdl_client:BuildRequires:  pkgconfig(SDL2_ttf)}
+%{?_with_soxr:BuildRequires:  pkgconfig(soxr)}
+BuildRequires:  pkgconfig(wayland-client)
+BuildRequires:  pkgconfig(wayland-scanner)
+%{?_with_webview:BuildRequires:  pkgconfig(webkit2gtk-4.0)}
+BuildRequires:  pkgconfig(xkbcommon)
+
+%{?_with_ffmpeg:
+BuildRequires:  pkgconfig(libavcodec) >= 57.48.101
+BuildRequires:  pkgconfig(libavutil)
+BuildRequires:  pkgconfig(libswscale)
+}
+
+Provides:       xfreerdp = %{?epoch}:%{version}-%{release}
+Requires:       %{name}-libs%{?_isa} = %{?epoch}:%{version}-%{release}
+Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
+
+%description
+The xfreerdp & wlfreerdp Remote Desktop Protocol (RDP) clients from the FreeRDP
+project.
+
+xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows
+machines, xrdp and VirtualBox.
+
+%package        libs
+Summary:        Core libraries implementing the RDP protocol
+Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
+Obsoletes:      %{name}-plugins < 1:1.1.0
+Provides:       %{name}-plugins = %{?epoch}:%{version}-%{release}
+%description    libs
+libfreerdp-core can be embedded in applications.
+
+libfreerdp-channels and libfreerdp-kbd might be convenient to use in X
+applications together with libfreerdp-core.
+
+libfreerdp-core can be extended with plugins handling RDP channels.
+
+%package        devel
+Summary:        Development files for %{name}
+Requires:       %{name}-libs%{?_isa} = %{?epoch}:%{version}-%{release}
+Requires:       pkgconfig
+Requires:       cmake >= 3.13
+
+%description    devel
+The %{name}-devel package contains libraries and header files for developing
+applications that use %{name}-libs.
+
+%{?_with_server:
+%package        server
+Summary:        Server support for %{name}
+Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
+Requires:       %{name}-libs%{?_isa} = %{?epoch}:%{version}-%{release}
+
+%description    server
+The %{name}-server package contains servers which can export a desktop via
+the RDP protocol.
+}
+
+%package -n     libwinpr
+Summary:        Windows Portable Runtime
+Provides:       %{name}-libwinpr = %{?epoch}:%{version}-%{release}
+Obsoletes:      %{name}-libwinpr < 1:1.2.0
+
+%description -n libwinpr
+WinPR provides API compatibility for applications targeting non-Windows
+environments. When on Windows, the original native API is being used instead of
+the equivalent WinPR implementation, without having to modify the code using it.
+
+%package -n     libwinpr-devel
+Summary:        Windows Portable Runtime development files
+Requires:       libwinpr%{?_isa} = %{?epoch}:%{version}-%{release}
+Requires:       pkgconfig
+Requires:       cmake >= 3.13
+
+%description -n libwinpr-devel
+The %{name}-libwinpr-devel package contains libraries and header files for
+developing applications that use %{name}-libwinpr.
+
+%prep
+%autosetup -p1 -n FreeRDP-%{version}
+
+# Rpmlint fixes
+find . -name "*.h" -exec chmod 664 {} \;
+find . -name "*.c" -exec chmod 664 {} \;
+
+%build
+%cmake \
+    -DBUILD_TESTING=ON \
+    -DCMAKE_SKIP_INSTALL_RPATH=ON \
+    -DCMAKE_INSTALL_LIBDIR:PATH=%{_lib} \
+    -DWITH_ALSA=ON \
+    -DWITH_AAD=ON \
+    -DWITH_CAIRO=ON \
+    -DWITH_CUPS=ON \
+    -DWITH_CHANNELS=ON \
+    -DWITH_CLIENT=ON \
+    -DWITH_CLIENT_SDL=%{?_with_sdl_client:ON}%{?!_with_sdl_client:OFF} \
+    -DWITH_DSP_FFMPEG=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
+    -DWITH_FDK_AAC=ON \
+    -DWITH_FFMPEG=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
+    -DWITH_FUSE=ON \
+    -DWITH_GSM=ON \
+    -DWITH_IPP=OFF \
+    -DWITH_JPEG=ON \
+    -DWITH_JSONC_REQUIRED=ON \
+    -DWITH_KEYBOARD_LAYOUT_FROM_FILE=ON \
+    -DWITH_KRB5=ON \
+    -DWITH_LAME=ON \
+    -DWITH_MANPAGES=ON \
+    -DWITH_OPENCL=%{?_with_opencl:ON}%{?!_with_opencl:OFF} \
+    -DWITH_OPENH264=%{?_with_openh264:ON}%{?!_with_openh264:OFF} \
+    -DWITH_OPENSSL=ON \
+    -DWITH_OPUS=ON \
+    -DWITH_PCSC=ON \
+    -DWITH_PKCS11=ON \
+    -DWITH_PULSE=ON \
+    -DWITH_SAMPLE=OFF \
+    -DWITH_SERVER=%{?_with_server:ON}%{?!_with_server:OFF} \
+    -DWITH_SERVER_INTERFACE=%{?_with_server:ON}%{?!_with_server:OFF} \
+    -DWITH_SHADOW_X11=%{?_with_server:ON}%{?!_with_server:OFF} \
+    -DWITH_SHADOW_MAC=%{?_with_server:ON}%{?!_with_server:OFF} \
+    -DWITH_SOXR=%{?_with_soxr:ON}%{?!_with_soxr:OFF} \
+    -DWITH_SWSCALE=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
+    -DWITH_TIMEZONE_COMPILED=OFF \
+    -DWITH_TIMEZONE_FROM_FILE=ON \
+    -DWITH_URIPARSER=%{?_with_uriparser:ON}%{?!_with_uriparser:OFF} \
+    -DWITH_VIDEO_FFMPEG=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
+    -DWITH_WAYLAND=ON \
+    -DWITH_WEBVIEW=%{?_with_webview:ON}%{?!_with_webview:OFF} \
+    -DWITH_X11=ON \
+    -DWITH_XCURSOR=ON \
+    -DWITH_XEXT=ON \
+    -DWITH_XKBFILE=ON \
+    -DWITH_XI=ON \
+    -DWITH_XINERAMA=ON \
+    -DWITH_XRENDER=ON \
+    -DWITH_XTEST=%{?_with_server:ON}%{?!_with_server:OFF} \
+    -DWITH_XV=ON \
+    -DWITH_ZLIB=ON \
+%ifarch x86_64
+    -DWITH_SSE2=ON \
+    -DWITH_VAAPI=%{?_with_ffmpeg:ON}%{?!_with_ffmpeg:OFF} \
+%else
+    -DWITH_SSE2=OFF \
+%endif
+%ifarch armv7hl
+    -DARM_FP_ABI=hard \
+    -DWITH_NEON=OFF \
+%endif
+%ifarch armv7hnl
+    -DARM_FP_ABI=hard \
+    -DWITH_NEON=ON \
+%endif
+%ifarch armv5tel armv6l armv7l
+    -DARM_FP_ABI=soft \
+    -DWITH_NEON=OFF \
+%endif
+    -DUWAC_FORCE_STATIC_BUILD=%{?_with_static_uwac:ON}%{?!_with_static_uwac:OFF} \
+    -DWINPR_UTILS_IMAGE_PNG=ON \
+    -DWINPR_UTILS_IMAGE_WEBP=ON \
+    -DWINPR_UTILS_IMAGE_JPEG=ON \
+    %{nil}
+
+%cmake_build
+
+%check
+export CTEST_OUTPUT_ON_FAILURE=1
+%cmake_build --target test
+
+%install
+%cmake_install
+
+find %{buildroot} -name "*.a" -delete
+
+%multilib_fix_c_header --file %{_includedir}/freerdp3/freerdp/build-config.h
+
+%files
+%{?_with_sdl_client:
+%{_bindir}/sdl-freerdp
+}
+%{_bindir}/winpr-hash
+%{_bindir}/winpr-makecert
+%{_bindir}/wlfreerdp
+%{_bindir}/xfreerdp
+%{?_with_sdl_client:
+%{_mandir}/man1/sdl-freerdp.1*
+}
+%{_mandir}/man1/winpr-hash.1*
+%{_mandir}/man1/winpr-makecert.1*
+%{_mandir}/man1/wlfreerdp.1*
+%{_mandir}/man1/xfreerdp.1*
+
+%files libs
+%license LICENSE
+%doc README.md ChangeLog
+%{_datadir}/FreeRDP/
+%{_libdir}/freerdp3/
+%{_libdir}/libfreerdp-client3.so.*
+%{?_with_server:
+%{_libdir}/libfreerdp-server3.so.*
+%{_libdir}/libfreerdp-server-proxy3.so.*
+%{_libdir}/libfreerdp-shadow3.so.*
+%{_libdir}/libfreerdp-shadow-subsystem3.so.*
+}
+%{_libdir}/libfreerdp3.so.*
+%{?!_with_static_uwac:
+%{_libdir}/libuwac0.so.*
+}
+%{_libdir}/librdtk0.so.*
+%{_mandir}/man7/wlog.*
+
+%files devel
+%{_includedir}/freerdp3/
+%{?!_with_static_uwac:
+%{_includedir}/uwac0/
+}
+%{_includedir}/rdtk0/
+%{_libdir}/cmake/FreeRDP3/
+%{_libdir}/cmake/FreeRDP-Client3/
+%{?_with_server:
+%{_libdir}/cmake/FreeRDP-Proxy3/
+%{_libdir}/cmake/FreeRDP-Server3/
+%{_libdir}/cmake/FreeRDP-Shadow3/
+}
+%{?!_with_static_uwac:
+%{_libdir}/cmake/uwac0/
+}
+%{_libdir}/cmake/rdtk0/
+%{_libdir}/libfreerdp-client3.so
+%{?_with_server:
+%{_libdir}/libfreerdp-server3.so
+%{_libdir}/libfreerdp-server-proxy3.so
+%{_libdir}/libfreerdp-shadow3.so
+%{_libdir}/libfreerdp-shadow-subsystem3.so
+}
+%{_libdir}/libfreerdp3.so
+%{?!_with_static_uwac:
+%{_libdir}/libuwac0.so
+}
+%{_libdir}/librdtk0.so
+%{_libdir}/pkgconfig/freerdp3.pc
+%{_libdir}/pkgconfig/freerdp-client3.pc
+%{?_with_server:
+%{_libdir}/pkgconfig/freerdp-server3.pc
+%{_libdir}/pkgconfig/freerdp-server-proxy3.pc
+%{_libdir}/pkgconfig/freerdp-shadow3.pc
+}
+%{?!_with_static_uwac:
+%{_libdir}/pkgconfig/uwac0.pc
+}
+%{_libdir}/pkgconfig/rdtk0.pc
+
+%{?_with_server:
+%files server
+%{_bindir}/freerdp-proxy
+%{_bindir}/freerdp-shadow-cli
+%{_mandir}/man1/freerdp-proxy.1*
+%{_mandir}/man1/freerdp-shadow-cli.1*
+}
+
+%files -n libwinpr
+%license LICENSE
+%doc README.md ChangeLog
+%{_datadir}/WinPR/
+%{_libdir}/libwinpr3.so.*
+%{_libdir}/libwinpr-tools3.so.*
+
+%files -n libwinpr-devel
+%{_libdir}/cmake/WinPR3/
+%{_libdir}/cmake/WinPR-tools3/
+%{_includedir}/winpr3/
+%{_libdir}/libwinpr3.so
+%{_libdir}/libwinpr-tools3.so
+%{_libdir}/pkgconfig/winpr3.pc
+%{_libdir}/pkgconfig/winpr-tools3.pc
+
+%changelog
+* Tue Sep 30 2025 Marek Kasik <mkasik@redhat.com> - 2:3.10.3-5
+- Silence abidiff
+- Resolves: RHEL-86251
+
+* Mon Sep 29 2025 Marek Kasik <mkasik@redhat.com> - 2:3.10.3-4
+- Limit threadpool to 16 threads
+- Resolves: RHEL-86251
+
+* Mon Jun 16 2025 Marek Kasik <mkasik@redhat.com> - 2:3.10.3-3
+- Initialize function pointers after resource allocation
+- Fixes CVE-2025-4478
+- Resolves: RHEL-91583
+
+* Tue Dec 17 2024 Ondrej Holy <oholy@redhat.com> - 2:3.10.3-1
+- Update to 3.10.3
+
+* Thu Nov 14 2024 Ondrej Holy <oholy@redhat.com> - 2:3.9.0-1
+- Update to 3.9.0
+
+* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 2:3.8.0-2
+- Bump release for October 2024 mass rebuild:
+  Resolves: RHEL-64018
+
+* Thu Sep 05 2024 Ondrej Holy <oholy@redhat.com> - 2:3.8.0-1
+- Update to 3.8.0
+
+* Thu Aug 08 2024 Neal Gompa <ngompa@fedoraproject.org> - 2:3.7.0-1
+- Update to 3.7.0
+
+* Fri Jul 26 2024 Ondrej Holy <oholy@redhat.com> - 2:3.6.3-1
+- Update to 3.6.3 (#2299253)
+
+* Tue Jul 23 2024 Neal Gompa <ngompa@fedoraproject.org> - 2:3.6.2-2
+- Include freerdp source download script in SRPM
+
+* Mon Jul 08 2024 Ondrej Holy <oholy@redhat.com> - 2:3.6.2-1
+- Update to 3.6.2
+
+* Mon Jul 08 2024 Ondrej Holy <oholy@redhat.com> - 2:3.5.1-3
+- Remove file with non-allowed license from the tarball
+
+* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 2:3.5.1-2
+- Bump release for June 2024 mass rebuild
+
+* Tue May 07 2024 Ondrej Holy <oholy@redhat.com> - 2:3.5.1-1
+- Update to 3.5.1 (CVE-2024-32039, CVE-2024-32040, CVE-2024-32041,
+  CVE-2024-32458, CVE-2024-32459, CVE-2024-32460, CVE-2024-32658,
+  CVE-2024-32659, CVE-2024-32660, CVE-2024-32661, CVE-2024-32662)
+
+* Mon Mar 25 2024 Ondrej Holy <oholy@redhat.com> - 2:3.4.0-2
+- Disable unwanted dependencies for RHEL
+
+* Fri Mar 22 2024 Ondrej Holy <oholy@redhat.com> - 2:3.4.0-1
+- Update to 3.4.0
+
+* Thu Feb 22 2024 Neal Gompa <ngompa@fedoraproject.org> - 2:3.3.0-1
+- Update to 3.3.0
+
+* Thu Feb 01 2024 Ondrej Holy <oholy@redhat.com> - 2:3.2.0-4
+- Enable KRB5 support
+
+* Wed Jan 31 2024 Pete Walter <pwalter@fedoraproject.org> - 2:3.2.0-3
+- Rebuild for ICU 74
+
+* Sat Jan 27 2024 Neal Gompa <ngompa@fedoraproject.org> - 2:3.2.0-2
+- Force static libuwac to deconflict with freerdp2
+
+* Wed Jan 24 2024 Neal Gompa <ngompa@fedoraproject.org> - 2:3.2.0-1
+- Rebase to 3.2.0
+
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.11.4-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.11.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Jan 12 2024 Ondrej Holy <oholy@redhat.com> - 2:2.11.4-1
+- Update to 2.11.4.
+
+* Wed Oct 25 2023 Ondrej Holy <oholy@redhat.com> - 2:2.11.2-3
+- Disable FFmpeg support (#2242028).
+
+* Mon Oct 09 2023 John Wiele <jwiele@redhat.com> - 2:2.11.2-2
+- Enable optional build with OpenCL support.
+
+* Wed Sep 27 2023 Ondrej Holy <oholy@redhat.com> - 2:2.11.1-2
+- Update to 2.11.2.
+
+* Tue Sep 05 2023 Ondrej Holy <oholy@redhat.com> - 2:2.11.1-1
+- Update to 2.11.1.
+
+* Fri Sep 01 2023 Ondrej Holy <oholy@redhat.com> - 2:2.11.0-1
+- Update to 2.11.0 (CVE-2023-39350, CVE-2023-39351, CVE-2023-39352,
+  CVE-2023-39353, CVE-2023-39354, CVE-2023-39356, CVE-2023-40181,
+  CVE-2023-40186, CVE-2023-40188, CVE-2023-40567, CVE-2023-40569 and
+  CVE-2023-40589).
+
+* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.10.0-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Tue Jul 11 2023 František Zatloukal <fzatlouk@redhat.com> - 2:2.10.0-3
+- Rebuilt for ICU 73.2
+
+* Thu May 11 2023 Ondrej Holy <oholy@redhat.com> - 2:2.10.0-2
+- Enable recommended FFmpeg support.
+
+* Tue Feb 21 2023 Ondrej Holy <oholy@redhat.com> - 2:2.10.0-1
+- Update to 2.10.0.
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.9.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Sat Dec 31 2022 Pete Walter <pwalter@fedoraproject.org> - 2:2.9.0-2
+- Rebuild for ICU 72
+
+* Wed Nov 30 2022 Ondrej Holy <oholy@redhat.com> - 2:2.9.0-1
+- Update to 2.9.0 (CVE-2022-39316, CVE-2022-39317, CVE-2022-39318,
+CVE-2022-39319, CVE-2022-39320, CVE-2022-41877, CVE-2022-39347).
+
+* Mon Nov 14 2022 Ondrej Holy <oholy@redhat.com> - 2:2.8.1-1
+- Update to 2.8.1 (CVE-2022-39282, CVE-2022-39283).
+
+* Mon Aug 15 2022 Simone Caronni <negativo17@gmail.com> - 2:2.8.0-1
+- Update to 2.8.0.
+
+* Wed Aug 03 2022 Ondrej Holy <oholy@redhat.com> - 2:2.7.0-4
+- Enable server support in ELN.
+
+* Mon Aug 01 2022 Frantisek Zatloukal <fzatlouk@redhat.com> - 2:2.7.0-3
+- Rebuilt for ICU 71.1
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.7.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Mon Apr 25 2022 Ondrej Holy <oholy@redhat.com> - 2:2.7.0-1
+- Update to 2.7.0.
+
+* Fri Mar 11 2022 Ondrej Holy <oholy@redhat.com> - 2:2.6.1-1
+- Update to 2.6.1.
+
+* Thu Feb 03 2022 Ondrej Holy <oholy@redhat.com> - 2:2.5.0-1
+- Update to 2.5.0.
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.4.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Fri Nov 26 2021 Ondrej Holy <oholy@redhat.com> - 2:2.4.1-2
+- Fix datatype mismatch / big-endian breakage
+- Load legacy provider when initializing OpenSSL 3.0
+
+* Wed Nov 10 2021 Ondrej Holy <oholy@redhat.com> - 2:2.4.1-1
+- Update to 2.4.1 (CVE-2021-41159, CVE-2021-41160).
+
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2:2.4.0-3
+- Rebuilt with OpenSSL 3.0.0
+
+* Wed Aug 11 2021 Ondrej Holy <oholy@redhat.com> - 2:2.4.0-2
+- Preparation for OpenSSL 3.0
+
+* Thu Jul 29 2021 Ondrej Holy <oholy@redhat.com> - 2:2.4.0-1
+- Update to 2.4.0.
+
+* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.3.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Wed May 19 2021 Pete Walter <pwalter@fedoraproject.org> - 2:2.3.2-2
+- Rebuild for ICU 69
+
+* Thu Apr 15 2021 Simone Caronni <negativo17@gmail.com> - 2:2.3.2-1
+- Update to 2.3.2.
+
+* Tue Mar 23 2021 Simone Caronni <negativo17@gmail.com> - 2:2.2.0-6
+- Explicitly enable Cairo support (#1938393).
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.2.0-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Tue Aug 11 2020 Ondrej Holy <oholy@redhat.com> - 2:2.2.0-4
+- Use %%cmake_ macros to fix out-of-source builds (#1863586)
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.2.0-3
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.2.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Thu Jul 23 2020 Simone Caronni <negativo17@gmail.com> - 2:2.2.0-1
+- Update to 2.2.0.
+
+* Tue Jun 30 2020 Simone Caronni <negativo17@gmail.com> - 2:2.1.2-1
+- Update to 2.1.2.
+
+* Thu May 21 2020 Ondrej Holy <oholy@redhat.com> - 2:2.1.1-1
+- Update to 2.1.1.
+
+* Fri May 15 2020 Ondrej Holy <oholy@redhat.com> - 2:2.1.0-1
+- Update to 2.1.0 (#1833540).
+
+* Fri May 15 2020 Pete Walter <pwalter@fedoraproject.org> - 2:2.0.0-57.20200207git245fc60
+- Rebuild for ICU 67
+
+* Fri Feb 07 2020 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-56.20200207git245fc60
+- Update to latest snapshot.
+
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-55.20190820git6015229
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Fri Nov 01 2019 Pete Walter <pwalter@fedoraproject.org> - 2:2.0.0-54.20190820git6015229
+- Rebuild for ICU 65
+
+* Tue Aug 20 2019 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-53.20190820git6015229
+- Update to latest snapshot.
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-52.20190918git5e672d4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Sun Jul 21 2019 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-51.20190918git5e672d4
+- Update to latest snapshot.
+
+* Sat May 18 2019 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-50.20190517gitb907324
+- Update to latest snapshot.
+
+* Wed Mar 06 2019 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-49.20190304git435872b
+- Fix for GFX color depth (Windows 10).
+
+* Thu Feb 28 2019 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-48.20190228gitce386c8
+- Update to latest snapshot post rc4.
+- CVE-2018-1000852 (#1661642).
+
+* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-47.rc4.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Thu Nov 29 2018 Ondrej Holy <oholy@redhat.com> - 2:2.0.0-47.rc4
+- Update to 2.0.0-rc4
+
+* Mon Oct 15 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-46.20181008git00af869
+- Enable Xtest option (#1559606).
+
+* Mon Oct 15 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-45.20181008git00af869
+- Update to last snapshot post 2.0.0-rc3.
+
+* Mon Aug 20 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-44.rc3
+- Update SPEC file.
+
+* Sat Aug 04 2018 Mike DePaulo <mikedep333@fedoraproject.org> - 2:2.0.0-43.20180801.rc3
+- Update to 2.0.0-rc3
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-42.20180405gita9ecd6a
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Mon Apr 09 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-41.20180405gita9ecd6a
+- Update to latest snapshot.
+
+* Wed Mar 21 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-40.20180320gitde83f4d
+- Add PAM support (fixes freerdp-shadow-cli). Thanks Paolo Zeppegno.
+- Update to latest snapshot.
+
+* Thu Mar 15 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-39.20180314gitf8baeb7
+- Update to latest snapshot.
+- Fixes connection to RDP servers with the latest Microsoft patches:
+  https://github.com/FreeRDP/FreeRDP/issues/4449
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-38.20180115git8f52c7e
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Thu Jan 18 2018 Karsten Hopp <karsten@redhat.com> - 2.0.0-37git}
+- use versioned build requirement on pkgconfig(openssl) to prevent using
+  compat-openssl10-devel instead of openssl-devel
+
+* Tue Jan 16 2018 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-36.20180115git8f52c7e
+- Update to latest snapshot.
+- Make GSS support optional and disable it for now (#1534094 and FreeRDP #4348,
+  #1435, #4363).
+
+* Wed Dec 20 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-35.20171220gitbfe8359
+- Update to latest snapshot post 2.0.0rc1.
+
+* Mon Sep 11 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-34.20170831git3b83526
+- Update to latest snapshot.
+- Trim changelog.
+
+* Mon Aug 07 2017 Björn Esser <besser82@fedoraproject.org> - 2:2.0.0-33.20170724gitf8c9f43
+- Rebuilt for AutoReq cmake-filesystem
+
+* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-32.20170724gitf8c9f43
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Thu Jul 27 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-31.20170724gitf8c9f43
+- Update to latest snapshot, Talos security fixes.
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-30.20170710gitf580bea
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Wed Jul 12 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-29.20170710gitf580bea
+- Update to latest snapshot.
+
+* Mon Jun 26 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-28.20170623git9904c32
+- Update to latest snapshot.
+
+* Mon May 15 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-27.20170512gitb1df835
+- Update to latest snapshot.
+
+* Thu Apr 20 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-26.20170419gitbfcf8e7
+- Update to latest 2.0 snapshot.
+
+* Thu Apr 13 2017 Orion Poplawski <orion@cora.nwra.com> - 2:2.0.0-25.20170317git8c68761
+- Install tools via make install
+
+* Wed Mar 22 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-24.20170317git8c68761
+- Update to latest snapshot.
+
+* Mon Mar 06 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-23.20170302git210de68
+- Remove shared libxfreerdp-client shared library.
+
+* Thu Mar 02 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-22.20170302git210de68
+- Move libxfreerdp-client shared object into devel subpackage.
+
+* Thu Mar 02 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-21.20170302git210de68
+- Update to latest snapshot.
+- Update build requirements, tune build options.
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.0.0-20.20161228git90877f5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Mon Jan 09 2017 Simone Caronni <negativo17@gmail.com> - 2:2.0.0-19.20161228git90877f5
+- Update to latest snapshot.

freerdp_download_and_repack.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+version=$(cat freerdp.spec | grep "Version: " | tr --squeeze-repeats " " | cut --delimiter " " --fields 2)
+
+echo "Downloading FreeRDP-$version.tar.gz"
+curl --silent --location "https://github.com/FreeRDP/FreeRDP/archive/$version/FreeRDP-$version.tar.gz" --output "FreeRDP-$version.tar.gz" || exit 1
+
+echo "Removing unicode_builtin.c"
+gzip --decompress "FreeRDP-$version.tar.gz" || exit 1
+tar --file "FreeRDP-$version.tar" --delete "*/winpr/libwinpr/crt/unicode_builtin.c" || exit 1
+gzip --best "FreeRDP-$version.tar" --stdout > FreeRDP-$version-repack.tar.gz
+rm FreeRDP-$version.tar
+
+echo "FreeRDP-$version-repack.tar.gz is prepared"
+exit 0

sources

@@ -0,0 +1 @@
+SHA512 (FreeRDP-3.10.3-repack.tar.gz) = cd007c28267e4b9ace47487f7d44061b03b029409fa167209bb1273f3d1b79fdd3ed96c855d78ccb03bdbedf452009e3a1a21189d282faffdfc3b2b504d03574