c2efdf022e
It fixes CVE-2026-67289, CVE-2026-67299 and CVE-2026-68580. Resolves: RHEL-222792, RHEL-222965, RHEL-223607 Co-authored-by: Ondrej Holy <oholy@redhat.com>
61 lines
2.1 KiB
Diff
61 lines
2.1 KiB
Diff
From bc37414b55a6061995fed3ee61836aaecfb055f6 Mon Sep 17 00:00:00 2001
|
|
From: Armin Novak <armin.novak@thincast.com>
|
|
Date: Tue, 7 Jul 2026 12:58:11 +0200
|
|
Subject: [PATCH] [core,message] fix update_message_WindowIcon
|
|
|
|
---
|
|
libfreerdp/core/message.c | 17 ++++++++---------
|
|
1 file changed, 8 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/libfreerdp/core/message.c b/libfreerdp/core/message.c
|
|
index 1d61fd333..e9dda6ac2 100644
|
|
--- a/libfreerdp/core/message.c
|
|
+++ b/libfreerdp/core/message.c
|
|
@@ -1297,30 +1297,29 @@ static BOOL update_message_WindowUpdate(rdpContext* context, const WINDOW_ORDER_
|
|
static BOOL update_message_WindowIcon(rdpContext* context, const WINDOW_ORDER_INFO* orderInfo,
|
|
const WINDOW_ICON_ORDER* windowIcon)
|
|
{
|
|
- WINDOW_ORDER_INFO* wParam = nullptr;
|
|
- WINDOW_ICON_ORDER* lParam = nullptr;
|
|
- rdp_update_internal* up = nullptr;
|
|
-
|
|
if (!context || !context->update || !orderInfo || !windowIcon)
|
|
return FALSE;
|
|
|
|
- wParam = (WINDOW_ORDER_INFO*)malloc(sizeof(WINDOW_ORDER_INFO));
|
|
+ WINDOW_ORDER_INFO* wParam = (WINDOW_ORDER_INFO*)malloc(sizeof(WINDOW_ORDER_INFO));
|
|
|
|
if (!wParam)
|
|
return FALSE;
|
|
|
|
- CopyMemory(wParam, orderInfo, sizeof(WINDOW_ORDER_INFO));
|
|
- lParam = (WINDOW_ICON_ORDER*)calloc(1, sizeof(WINDOW_ICON_ORDER));
|
|
+ *wParam = *orderInfo;
|
|
+
|
|
+ WINDOW_ICON_ORDER* lParam = (WINDOW_ICON_ORDER*)calloc(1, sizeof(WINDOW_ICON_ORDER));
|
|
|
|
if (!lParam)
|
|
goto out_fail;
|
|
|
|
+ *lParam = *windowIcon;
|
|
lParam->iconInfo = calloc(1, sizeof(ICON_INFO));
|
|
|
|
if (!lParam->iconInfo)
|
|
goto out_fail;
|
|
|
|
- CopyMemory(lParam, windowIcon, sizeof(WINDOW_ICON_ORDER));
|
|
+ *lParam->iconInfo = *windowIcon->iconInfo;
|
|
+
|
|
WLog_VRB(TAG, "update_message_WindowIcon");
|
|
|
|
if (windowIcon->iconInfo->cbBitsColor > 0)
|
|
@@ -1356,7 +1355,7 @@ static BOOL update_message_WindowIcon(rdpContext* context, const WINDOW_ORDER_IN
|
|
windowIcon->iconInfo->cbColorTable);
|
|
}
|
|
|
|
- up = update_cast(context->update);
|
|
+ rdp_update_internal* up = update_cast(context->update);
|
|
return MessageQueue_Post(up->queue, (void*)context, MakeMessageId(WindowUpdate, WindowIcon),
|
|
(void*)wParam, (void*)lParam);
|
|
out_fail:
|