c2efdf022e
It fixes CVE-2026-67289, CVE-2026-67299 and CVE-2026-68580. Resolves: RHEL-222792, RHEL-222965, RHEL-223607 Co-authored-by: Ondrej Holy <oholy@redhat.com>
38 lines
1.5 KiB
Diff
38 lines
1.5 KiB
Diff
From 22cc4e8e563eaed5628bf510f26091d554d8533d Mon Sep 17 00:00:00 2001
|
|
From: Armin Novak <armin.novak@thincast.com>
|
|
Date: Sun, 12 Jul 2026 17:37:48 +0200
|
|
Subject: [PATCH] [channels,audin] limit FramesPerPacket
|
|
|
|
---
|
|
channels/audin/client/audin_main.c | 10 +++++++++-
|
|
1 file changed, 9 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/channels/audin/client/audin_main.c b/channels/audin/client/audin_main.c
|
|
index 4c5e7977d..697fd2848 100644
|
|
--- a/channels/audin/client/audin_main.c
|
|
+++ b/channels/audin/client/audin_main.c
|
|
@@ -487,7 +487,6 @@ static UINT audin_process_open(AUDIN_PLUGIN* audin, AUDIN_CHANNEL_CALLBACK* call
|
|
Stream_Read_UINT32(s, initialFormat);
|
|
WLog_Print(audin->log, WLOG_DEBUG, "FramesPerPacket=%" PRIu32 " initialFormat=%" PRIu32 "",
|
|
FramesPerPacket, initialFormat);
|
|
- audin->FramesPerPacket = FramesPerPacket;
|
|
|
|
if (initialFormat >= callback->formats_count)
|
|
{
|
|
@@ -496,6 +495,15 @@ static UINT audin_process_open(AUDIN_PLUGIN* audin, AUDIN_CHANNEL_CALLBACK* call
|
|
return ERROR_INVALID_DATA;
|
|
}
|
|
|
|
+ /* The RDP protocol field allows UINT32_MAX, but most backend API use INT32 as input parameter
|
|
+ * or do some math with it, so ensure that the value does not exceed reasonable limits */
|
|
+ if (FramesPerPacket >= INT32_MAX)
|
|
+ {
|
|
+ WLog_Print(audin->log, WLOG_ERROR, "invalid frames per packet %" PRIu32, FramesPerPacket);
|
|
+ return ERROR_INVALID_DATA;
|
|
+ }
|
|
+
|
|
+ audin->FramesPerPacket = FramesPerPacket;
|
|
audin->format = &callback->formats[initialFormat];
|
|
|
|
if (!audin_open_device(audin, callback))
|