From d308e77c3d115b6528e6cf9df0861838f31606ab Mon Sep 17 00:00:00 2001
From: matt335672 <30179339+matt335672@users.noreply.github.com>
Date: Wed, 6 May 2026 11:40:08 +0100
Subject: [PATCH] CVE-2026-44978: Check FIPS PDU padding value before use

(cherry picked from commit e42951868bcd2da2088da58fa20b31c1e2268c06
---
 libxrdp/xrdp_sec.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

--- a/libxrdp/xrdp_sec.c
+++ b/libxrdp/xrdp_sec.c
@@ -1610,7 +1610,14 @@ xrdp_sec_recv_fastpath(struct xrdp_sec *
 
             /* remainder of TS_FP_INPUT_PDU */
             in_uint8p(s, data_signature, 8);
+            // Decrypt the packet, and subtract the padding length,
+            // after checking the validity
             xrdp_sec_fips_decrypt(self, s->p, (int)(s->end - s->p));
+            if (pad > 7 || pad > (int)(s->end - s->p))
+            {
+                LOG(LOG_LEVEL_ERROR, "Bad padding for TS_FP_FIPS_INFO PDU");
+                return 1;
+            }
             s->end -= pad;
             if (!xrdp_sec_fips_check_sig(self, data_signature, 8,
                                          s->p, (int)(s->end - s->p)))
@@ -1731,7 +1738,14 @@ xrdp_sec_recv(struct xrdp_sec *self, str
                     "has unexpected version. Expected 1, actual %d", ver);
                 return 1;
             }
+            // Decrypt the packet, and subtract the padding length,
+            // after checking the validity
             xrdp_sec_fips_decrypt(self, s->p, (int)(s->end - s->p));
+            if (pad > 7 || pad > (int)(s->end - s->p))
+            {
+                LOG(LOG_LEVEL_ERROR, "Bad padding for TS_SECURITY_HEADER2 PDU");
+                return 1;
+            }
             s->end -= pad;
             if (!xrdp_sec_fips_check_sig(self, data_signature, 8,
                                          s->p, (int)(s->end - s->p)))