From 3c131a9f5e2bd01fff4f5912c324ffad0fc71ab6 Mon Sep 17 00:00:00 2001
From: matt335672 <30179339+matt335672@users.noreply.github.com>
Date: Mon, 23 Mar 2026 13:42:50 +0000
Subject: [PATCH] CVE-2026-33689: Fix length check on channel open

A check for at least two bytes remaining in a buffer should be 4 bytes.
---
 xrdp/xrdp_mm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xrdp/xrdp_mm.c b/xrdp/xrdp_mm.c
index 08570218..72755f63 100644
--- a/xrdp/xrdp_mm.c
+++ b/xrdp/xrdp_mm.c
@@ -2243,7 +2243,7 @@ xrdp_mm_trans_process_drdynvc_channel_open(struct xrdp_mm *self,
     char name[1024 + 1];
     struct xrdp_drdynvc_procs procs;
 
-    if (!s_check_rem(s, 2))
+    if (!s_check_rem(s, 4))
     {
         return 1;
     }