[oe][meta-oe][wrynose][PATCH 13/15] freerdp3: patch CVE-2026-67288

[ankur.tyagi85@gmail.com]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit matching GitHub advisory[1] also identified by Debian[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-67288

[1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3
[2]https://security-tracker.debian.org/tracker/CVE-2026-67288

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-67288.patch     | 69 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 70 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch
new file mode 100644
index 0000000000..9be89cf276
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch
@@ -0,0 +1,69 @@
+From 833cb82a82ff59d916c86ae1ac90b84bf8e86c47 Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Thu, 9 Jul 2026 08:34:21 +0200
+Subject: [PATCH] [scard] handle nullptr for LookupName
+
+(cherry picked from commit efe40e15d508f9754b7a3af851de4d2a0b1128d8)
+
+CVE: CVE-2026-67288
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/efe40e15d508f9754b7a3af851de4d2a0b1128d8]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/emu/scard/smartcard_emulate.c  | 7 ++++---
+ winpr/libwinpr/smartcard/smartcard_pcsc.c | 9 +++++----
+ 2 files changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/libfreerdp/emu/scard/smartcard_emulate.c b/libfreerdp/emu/scard/smartcard_emulate.c
+index 0be4c4c5d..25e0ee179 100644
+--- a/libfreerdp/emu/scard/smartcard_emulate.c
++++ b/libfreerdp/emu/scard/smartcard_emulate.c
+@@ -46,8 +46,8 @@ static size_t g_ReaderNameWLen = 0;
+ 
+ static char* card_id_and_name_a(const UUID* CardIdentifier, LPCSTR LookupName)
+ {
+-	WINPR_ASSERT(CardIdentifier);
+-	WINPR_ASSERT(LookupName);
++	if (!CardIdentifier || !LookupName)
++		return nullptr;
+ 
+ 	size_t len = strlen(LookupName) + 34;
+ 	char* id = malloc(len);
+@@ -2264,7 +2264,8 @@ LONG WINAPI Emulate_SCardReadCacheA(SmartcardEmulationContext* smartcard, SCARDC
+ 		WINPR_ASSERT(value); /* Must be valid after Emulate_SCardIsValidContext */
+ 
+ 		char* id = card_id_and_name_a(CardIdentifier, LookupName);
+-		data = HashTable_GetItemValue(value->cache, id);
++		if (id)
++			data = HashTable_GetItemValue(value->cache, id);
+ 		free(id);
+ 
+ 		if (!data)
+diff --git a/winpr/libwinpr/smartcard/smartcard_pcsc.c b/winpr/libwinpr/smartcard/smartcard_pcsc.c
+index b5cf85e23..58bea94f1 100644
+--- a/winpr/libwinpr/smartcard/smartcard_pcsc.c
++++ b/winpr/libwinpr/smartcard/smartcard_pcsc.c
+@@ -2951,8 +2951,8 @@ WINPR_ATTR_NODISCARD static LONG WINAPI PCSC_SCardDlgExtendedError(void)
+ WINPR_ATTR_NODISCARD
+ static char* card_id_and_name_a(const UUID* CardIdentifier, LPCSTR LookupName)
+ {
+-	WINPR_ASSERT(CardIdentifier);
+-	WINPR_ASSERT(LookupName);
++	if (!CardIdentifier || !LookupName)
++		return nullptr;
+ 
+ 	size_t len = strlen(LookupName) + 34;
+ 	char* id = malloc(len);
+@@ -2991,9 +2991,10 @@ WINPR_ATTR_NODISCARD static LONG WINAPI PCSC_SCardReadCacheA(SCARDCONTEXT hConte
+ 		return SCARD_E_INVALID_HANDLE;
+ 
+ 	char* id = card_id_and_name_a(CardIdentifier, LookupName);
+-
+-	data = HashTable_GetItemValue(ctx->cache, id);
++	if (id)
++		data = HashTable_GetItemValue(ctx->cache, id);
+ 	free(id);
++
+ 	if (!data)
+ 	{
+ 		*DataLen = 0;
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index 7051cbeacc..edd2fddf94 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -24,6 +24,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-64620.patch \
            file://CVE-2026-64621.patch \
            file://CVE-2026-66401.patch \
+           file://CVE-2026-67288.patch \
 "