[oe][meta-oe][wrynose][PATCH 9/15] freerdp3: patch CVE-2026-63652

[ankur.tyagi85@gmail.com]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-63652

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freerdp/freerdp3/CVE-2026-63652.patch     | 53 +++++++++++++++++++
 .../freerdp/freerdp3_3.24.2.bb                |  1 +
 2 files changed, 54 insertions(+)
 create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch
new file mode 100644
index 0000000000..2e77b09d5e
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch
@@ -0,0 +1,53 @@
+From d814e663432dcc8fb485ac91f6106c950d003d9b Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Thu, 2 Jul 2026 08:02:29 +0200
+Subject: [PATCH] [channels,rdpsnd] fix free of
+ RdpsndServerContext::client_formats
+
+(cherry picked from commit caf653c0ba1c75ec8f298d1baa59770102a5d14c)
+
+CVE: CVE-2026-63652
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/caf653c0ba1c75ec8f298d1baa59770102a5d14c]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ channels/rdpsnd/server/rdpsnd_main.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/channels/rdpsnd/server/rdpsnd_main.c b/channels/rdpsnd/server/rdpsnd_main.c
+index 8322704ff..29778bb2f 100644
+--- a/channels/rdpsnd/server/rdpsnd_main.c
++++ b/channels/rdpsnd/server/rdpsnd_main.c
+@@ -181,6 +181,14 @@ static UINT rdpsnd_server_recv_quality_mode(RdpsndServerContext* context, wStrea
+ 	return CHANNEL_RC_OK;
+ }
+ 
++static void rdpsnd_server_client_format_free(RdpsndServerContext* context)
++{
++	WINPR_ASSERT(context);
++	free(context->client_formats);
++	context->client_formats = nullptr;
++	context->num_client_formats = 0;
++}
++
+ /**
+  * Read Client Audio Formats and Version PDU (2.2.2.2)
+  *
+@@ -260,7 +268,7 @@ static UINT rdpsnd_server_recv_formats(RdpsndServerContext* context, wStream* s)
+ 
+ 	return CHANNEL_RC_OK;
+ out_free:
+-	free(context->client_formats);
++	rdpsnd_server_client_format_free(context);
+ 	return error;
+ }
+ 
+@@ -1140,7 +1148,7 @@ void rdpsnd_server_context_free(RdpsndServerContext* context)
+ 	}
+ 
+ 	free(context->server_formats);
+-	free(context->client_formats);
++	rdpsnd_server_client_format_free(context);
+ 	free(context->priv);
+ 	free(context);
+ }
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index 054d90718e..86999ffe94 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -20,6 +20,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-55564.patch \
            file://CVE-2026-55648.patch \
            file://CVE-2026-63633.patch \
+           file://CVE-2026-63652.patch \
 "