From d1323f9bb0caebdb9ca46627579954c25599ed25 Mon Sep 17 00:00:00 2001
From: matt335672 <30179339+matt335672@users.noreply.github.com>
Date: Mon, 23 Mar 2026 13:42:50 +0000
Subject: [PATCH] CVE-2026-33689: Fix length check on channel open

A check for at least two bytes remaining in a buffer should be 4 bytes.

(cherry picked from commit 3c131a9f5e2bd01fff4f5912c324ffad0fc71ab6)
---
 xrdp/xrdp_mm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/xrdp/xrdp_mm.c
+++ b/xrdp/xrdp_mm.c
@@ -1378,7 +1378,7 @@ xrdp_mm_trans_process_drdynvc_channel_op
     char name[1024 + 1];
     struct xrdp_drdynvc_procs procs;
 
-    if (!s_check_rem(s, 2))
+    if (!s_check_rem(s, 4))
     {
         return 1;
     }