From 4594d4ed9198f5fa6c1f2eb03fac96110a4e0ebb Mon Sep 17 00:00:00 2001
From: matt335672 <30179339+matt335672@users.noreply.github.com>
Date: Fri, 6 Mar 2026 11:03:48 +0000
Subject: [PATCH] CVE-2026-32624: buffer overflow if domain sep used

Check the username buffer is not overflowed if the domain separator
feature is used.

(cherry picked from commit f1a2bec41560ccc420931d94f07a18c31141c069)
---
 libxrdp/xrdp_sec.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

--- a/libxrdp/xrdp_sec.c
+++ b/libxrdp/xrdp_sec.c
@@ -1055,10 +1055,23 @@ xrdp_sec_process_logon_info(struct xrdp_
     if (self->rdp_layer->client_info.domain_user_separator[0] != '\0'
             && self->rdp_layer->client_info.domain[0] != '\0')
     {
-        LOG(LOG_LEVEL_DEBUG, "Client supplied domain with user name. Overwriting user name with user name parsed from domain.");
-        int size = sizeof(self->rdp_layer->client_info.username);
-        g_strncat(self->rdp_layer->client_info.username, self->rdp_layer->client_info.domain_user_separator, size - 1 - g_strlen(self->rdp_layer->client_info.domain_user_separator));
-        g_strncat(self->rdp_layer->client_info.username, self->rdp_layer->client_info.domain, size - 1 - g_strlen(self->rdp_layer->client_info.domain));
+        // Check the composite string is not too long
+        unsigned int size =
+            g_strlen(self->rdp_layer->client_info.username) +
+            g_strlen(self->rdp_layer->client_info.domain_user_separator) +
+            g_strlen(self->rdp_layer->client_info.domain);
+
+        if (size >= sizeof(self->rdp_layer->client_info.username))
+        {
+            LOG(LOG_LEVEL_ERROR, "Username/domain is too long");
+            return 1;
+        }
+        LOG(LOG_LEVEL_DEBUG, "Client supplied domain with user name."
+            " Overwriting user name with user name parsed from domain.");
+        g_strcat(self->rdp_layer->client_info.username,
+                 self->rdp_layer->client_info.domain_user_separator);
+        g_strcat(self->rdp_layer->client_info.username,
+                 self->rdp_layer->client_info.domain);
     }
 
     if (unicode_utf16_in(s, len_program, self->rdp_layer->client_info.program, sizeof(self->rdp_layer->client_info.program) - 1) != 0)