Contains many bugfixes and CVE fixes:
https://github.com/FreeRDP/FreeRDP/releases/tag/3.24.0
Added build option to use internal rc4 and md4 ciphers: this is due
to a recent change in oe-core. OpenSSL's legacy ciphers (like RC4 and MD4)
are now disabled by default (with 'legacy' PACKAGECONFIG), however
FreeRDP3 relies on them.
To ensure that the required ciphers are available, build the
recipe with this ciphers' internal implementations instead of
expecting OpenSSL to support them.
Ptests passed successfully.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-22853
The vulnerable feature was introduced in v3.9.0[1], the
recipe version is not affected. Ignore this CVE.
[1]: a4bd5ba886
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-22852
The related github advisory[1] comes with an analysis of the
vulnerability, including pointing to the vulnerable code
snippet. Backported the commit that touched the mentioned
code part in the fixed version, and is in line with the
description of the issue.
Ptests passed successfully.
[1]: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9chc-g79v-4qq4
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Ptests passed successfully.
Dropped manpages PACKAGECONFIG: when it is enabled, it requires an executable that
is compiled from the project's source, but since it is cross-compiled, it is not
usable. The cmakefile also started to explicitly disable generating this tool
when cross-compiling is enabled.
Since this recipe has no native counterpart, and the manpages can't be generated
in this state, this option was removed.
Changes:
3.22.0:
- Complete overhaul of SDL client
- Introduction of new WINPR_ATTR_NODISCARD macro wrapping compiler or C language
version specific [[nodiscard]] attributes
- Addition of WINPR_ATTR_NODISCARD to (some) public API functions so usage errors
are producing warnings now
- Add some more stringify functions for logging
- CVE fixes: CVE-2026-23948, CVE-2026-24682, CVE-2026-24683, CVE-2026-24676,
CVE-2026-24677, CVE-2026-24678, CVE-2026-24684, CVE-2026-24679,
CVE-2026-24681, CVE-2026-24675, CVE-2026-24491, CVE-2026-24680
- [core,info] fix missing NULL check
- [gateway,tsg] fix TSG_PACKET_RESPONSE parsing
- Allow querying auth identity with kerberos when running as a server
- Sspi krb heimdal
- Tsg fix idleTimeout parsing
- [channels,smartcard] revert 649f7de
- [crypto] deprecate er and der modules
- [channels,rdpei] lock full update, not only parts
- [winpr,platform] add WINPR_ATTR_NODISCARD macro
- Wlog cleanup
- new stringify functions & touch API defines
- Add support for querying SECPKG_ATTR_PACKAGE_INFO to NTLM and Kerberos
- [channels,video] measure times in ns
- [utils] Nodiscard
- Error handling fixes
- [channels,drdynvc] check pointer before reset
- Winpr api def
- [winpr,platform] drop C23 [[nodiscard]]
- [gdi] add additional checks for a valid rdpGdi
- Sdl3 high dpiv2
- peer: Disconnect if Logon() returned FALSE
- [channels,rdpecam] fix PROPERTY_DESCRIPTION parsing
- [channel,rdpsnd] only clean up thread before free
- [channels,rdpei] add RDPINPUT_CONTACT_FLAG_UP
3.21.0:
- CVE fixes: CVE-2026-23530, CVE-2026-23531, CVE-2026-23532, CVE-2026-23533,
CVE-2026-23534, CVE-2026-23732, CVE-2026-23883, CVE-2026-23884
- [client,sdl] fix monitor resolution
- [codec,progressive] fix progressive_rfx_upgrade_block
- Krb cache fix
- Rdpdr improved checks
- Codec advanced length checks
- Glyph fix length checks
- Wlog printf format string checks
- [warnings,format] fix format string warnings
- Double free fixes
- [clang-tidy] clean up code warnings
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-68118
The vulnerability is specific to the usage of Microsoft specific sprintf
implementation. Because of this, ignore this vulnerability.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Adding WITH_CAIRO=ON to fix this warning:
CMake Warning at libfreerdp/CMakeLists.txt:193 (message):
-DWITH_SWSCALE=OFF and -DWITH_CAIRO=OFF, compiling without image scaling
support!
Signed-off-by: Marc Ferland <marc.ferland@sonatest.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The WITH_ADD option does not exist. What was probably meant is
WITH_AAD (Azure AD auth).
Signed-off-by: Marc Ferland <marc.ferland@sonatest.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Make the package depend on the OpenCL virtual package rather than
the exact implementation.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* Package proxy-plugins into their own package
* Add missing dependency on json-c
* While new plugins have solib prefix .so are still
packaged for compatibility
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This is required in order to build krdp (KDE's remote desktop
integration).
The do_configure task for krdp expects both 'winpr-makecert3' and
'winpr-hash3' to be present, failure to do so results in:
| CMake Error at /path/to/krdp/6.4.4/recipe-sysroot/usr/lib/cmake/WinPR3/WinPRTargets.cmake:98 (message):
| The imported target "winpr-makecert" references the file
|
| "/path/to/krdp/6.4.4/recipe-sysroot/usr/bin/winpr-makecert3"
|
| but this file does not exist. Possible reasons include:
|
| * The file was deleted, renamed, or moved to another location.
|
| * An install or uninstall procedure did not complete successfully.
|
| * The installation package was faulty and contained
|
| "/path/to/6.4.4/recipe-sysroot/usr/lib/cmake/WinPR3/WinPRTargets.cmake"
|
| but not all the files it references.
|
| Call Stack (most recent call first):
| /path/to/krdp/6.4.4/recipe-sysroot/usr/lib/cmake/WinPR3/WinPRConfig.cmake:44 (include)
| /path/to/krdp/6.4.4/recipe-sysroot-native/usr/share/cmake-3.31/Modules/CMakeFindDependencyMacro.cmake:76 (find_package)
| /path/to/krdp/6.4.4/recipe-sysroot/usr/lib/cmake/FreeRDP3/FreeRDPConfig.cmake:2 (find_dependency)
| CMakeLists.txt:45 (find_package)
|
|
| -- Configuring incomplete, errors occurred!
Signed-off-by: Marc Ferland <marc.ferland@sonatest.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The 2.x branch of freerdp is in maintenance mode and upstream has ruled out
changes to officially support builds with CMake 4+ (see [0]). Thus, apply the
'minimum policy version' override.
[0]: https://github.com/FreeRDP/FreeRDP/issues/11707
Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Please see
https://git.yoctoproject.org/poky/commit/?id=4dd321f8b83afecd962393101b2a6861275b5265
for what changes are needed, and sed commands that can be used to make them en masse.
I've verified that bitbake -c patch world works with these, but did not run a world
build; the majority of recipes shouldn't need further fixups, but if there are
some that still fall out, they can be fixed in followups.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This will allow to disable alsa which pulls the audio stuff even if
it could be disabled.
Signed-off-by: Andrej Valek <andrej.v@skyrain.eu>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
It was fixed in freerdp3 with
https://github.com/FreeRDP/FreeRDP/pull/10553
but it doesn't apply easily in freerdp2, use gnu17 to avoid:
http://errors.yoctoproject.org/Errors/Details/852862/
TOPDIR/tmp/work/core2-64-oe-linux/freerdp/2.11.7/build/channels/client/tables.c:124:25: error: initialization of 'UINT (*)(void)' {aka 'unsigned int (*)(void)'} from incompatible pointer type 'UINT (*)(void *)' {aka 'unsigned int (*)(void *)'} [-Wincompatible-pointer-types]
124 | { "libusb", "", libusb_freerdp_urbdrc_client_subsystem_entry },
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
CPE does not contain mnajor version number, so set VE product to just
freerdp.
Without this there are no (fixed) CVEs in reports.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* bump SRCREV to get more gcc-14 fixes already merged upstream:
$ git log --oneline 2.11.7..origin/stable-2.0
efa899d3d (HEAD -> stable-2.0, origin/stable-2.0) Merge pull request #10172 from AlessandroBono/wip/abono/incompatible-pointer
7894a7dfc redirection: Fix incompatible pointer type
f3ed1f1ac redirection: Fix incompatible pointer type
4f411197d info: Fix incompatible pointer type
a383740a2 next-dev-2.11.8-dev
* fixes:
http://errors.yoctoproject.org/Errors/Details/766906/
freerdp/2.11.2/git/libfreerdp/core/redirection.c:91:31: error: passing argument 1 of 'redirection_free_data' from incompatible pointer type [-Wincompatible-pointer-types]
freerdp/2.11.2/git/libfreerdp/core/redirection.c:112:31: error: assignment to 'BYTE **' {aka 'unsigned char **'} from incompatible pointer type 'char **' [-Wincompatible-pointer-types]
freerdp/2.11.2/git/libfreerdp/core/redirection.c:139:38: error: passing argument 1 of 'redirection_copy_data' from incompatible pointer type [-Wincompatible-pointer-types]
freerdp/2.11.2/git/libfreerdp/core/info.c:88:39: error: initialization of 'const WCHAR *' {aka 'const short unsigned int *'} from incompatible pointer type 'BYTE *' {aka 'unsigned char *'} [-Wincompatible-pointer-types]
and backport one commit from master to fix:
git/channels/ainput/server/ainput_main.c:225:83: error: passing argument 3 of 'WTSVirtualChannelQuery' from incompatible pointer type [-Wincompatible-pointer-types]
git/channels/ainput/server/ainput_main.c:419:36: error: passing argument 1 of 'ainput_server_context_free' from incompatible pointer type [-Wincompatible-pointer-types]
git/channels/ainput/server/ainput_main.c:542:100: error: passing argument 3 of 'WTSVirtualChannelQuery' from incompatible pointer type [-Wincompatible-pointer-types]
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Do not delete the cmake config and target files to allow easy
integration with cmake based libraries/applications.
Signed-off-by: Andreas Cord-Landwehr <cordlandwehr@kde.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
There is new patch-status QA check in oe-core:
https://git.openembedded.org/openembedded-core/commit/?id=76a685bfcf927593eac67157762a53259089ea8a
This is temporary work around just to hide _many_ warnings from
optional patch-status (if you add it to WARN_QA).
This just added
Upstream-Status: Pending
everywhere without actually investigating what's the proper status.
This is just to hide current QA warnings and to catch new .patch files being
added without Upstream-Status, but the number of Pending patches is now terrible:
5 (26%) meta-xfce
6 (50%) meta-perl
15 (42%) meta-webserver
21 (36%) meta-gnome
25 (57%) meta-filesystems
26 (43%) meta-initramfs
45 (45%) meta-python
47 (55%) meta-multimedia
312 (63%) meta-networking
756 (61%) meta-oe
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
0001-Fix-incompatible-function-pointer-types.patch
removed since it's included in 2.10.0
Changelog:
===========
Notewhorth changes:
-------------------
* Fix android build scripts, use CMake from SDK
* Fix connection negotiation with mstsc/msrdc #8426
* [ntlm]: use rfc5929 binding hash algorithm #8430
* [channels,printer] Fixed reference counting #8433
* Fix uwac pixman #8439
* Fix Rdp security #8457
* [client,x11] Detect key autorepeat #8522
* [build] add channel path to RPATH #8551
* Fix build with BUILTIN_CHANNELS=OFF #8560
* revert changes so that the osmajortype/osminortype is not overwritten #8571
* [uwac] do not use iso C functions #8604
* [winpr,sam] fix inalid NULL arguments #8605
* Fix incompatible function pointer types #8625
Fixed issues:
-------------
* Backported #8581: Ignore data PDUs for DVCs that were not opened successfully
* Backported #8498: [channel,urbdrc] fix type of usb hotplug callback
* Backported #8537: Extended info enforce limits
* Backported #8611: [core] add missing redirection fields
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
gnome-remote-desktop requires the freerdp server as a build dependency
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
