Security context

Highlights

Memory Corruption: 164 prior fixes. Scrutinize any change in this area.

libfreerdp/core/orders.c: most-fixed (32 issues). Treat as high-risk during review.

528 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Integer Overflow to Buffer Overflow: Attacker-controlled values (such as point or rectangle counts) in RDP drawing orders can overflow during byte-size calculations (multiplying element counts by structure sizes), resulting in undersized heap allocations followed by out-of-bounds writes.

Out-of-bounds Write: ClearCodec decompression logic frequently lacks sufficient destination coordinate and bounds checks, allowing a malicious RDP server to perform out-of-bounds heap writes via malformed subcodec offsets and coordinate dimensions.

Out-of-bounds Write: Improper validation of destination coordinates and raw widths/heights against pre-allocated limits in the planar bitmap decoder allows remote attackers to write past the allocated heap buffers.