From 391aaf92f9f944a612b8187552c9a49dcf3a60a5 Mon Sep 17 00:00:00 2001
From: matt335672 <30179339+matt335672@users.noreply.github.com>
Date: Tue, 10 Mar 2026 20:38:50 +0000
Subject: [PATCH] security: Check HMAC on non-FIPS fastpath input

CVE-2026-32105: Add a check that the HMAC signature supplied with a
non-FIPS fastpath input PDU matches the calculated signature.

(cherry picked from commit 187d22cef89e8d60091d52e4abf64b82c49d57ee)
---
 libxrdp/xrdp_sec.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/libxrdp/xrdp_sec.c
+++ b/libxrdp/xrdp_sec.c
@@ -27,6 +27,7 @@
 #include "libxrdp.h"
 #include "ms-rdpbcgr.h"
 #include "log.h"
+#include "string.h"
 #include "string_calls.h"
 
 
@@ -1638,8 +1639,14 @@ xrdp_sec_recv_fastpath(struct xrdp_sec *
                 return 1;
             }
             /* remainder of TS_FP_INPUT_PDU */
-            in_uint8s(s, 8);  /* dataSignature (8 bytes), skip for now */
+            in_uint8p(s, data_signature, 8);
             xrdp_sec_decrypt(self, s->p, (int)(s->end - s->p));
+            if (!xrdp_sec_check_sig(self, data_signature, 8,
+                                    s->p, (int)(s->end - s->p)))
+            {
+                LOG(LOG_LEVEL_ERROR, "MAC checksum error for FP-non-FIPS PDU");
+                return 1;
+            }
         }
     }