From e42951868bcd2da2088da58fa20b31c1e2268c06 Mon Sep 17 00:00:00 2001
From: matt335672 <30179339+matt335672@users.noreply.github.com>
Date: Wed, 6 May 2026 11:40:08 +0100
Subject: [PATCH] CVE-2026-44978: Check FIPS PDU padding value before use

---
 libxrdp/xrdp_sec.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/libxrdp/xrdp_sec.c b/libxrdp/xrdp_sec.c
index 62f551ec..4dae09d6 100644
--- a/libxrdp/xrdp_sec.c
+++ b/libxrdp/xrdp_sec.c
@@ -1173,7 +1173,14 @@ xrdp_sec_recv_fastpath(struct xrdp_sec *self, struct stream *s)
 
             /* remainder of TS_FP_INPUT_PDU */
             in_uint8a(s, data_signature, sizeof(data_signature));
+            // Decrypt the packet, and subtract the padding length,
+            // after checking the validity
             xrdp_sec_fips_decrypt(self, s->p, (int)(s->end - s->p));
+            if (pad > 7 || pad > (int)(s->end - s->p))
+            {
+                LOG(LOG_LEVEL_ERROR, "Bad padding for TS_FP_FIPS_INFO PDU");
+                return 1;
+            }
             s->end -= pad;
             if (!xrdp_sec_fips_check_sig(self, data_signature, 8,
                                          s->p, (int)(s->end - s->p)))
@@ -1299,7 +1306,14 @@ xrdp_sec_recv(struct xrdp_sec *self, struct stream *s, int *chan)
                     "has unexpected version. Expected 1, actual %d", ver);
                 return 1;
             }
+            // Decrypt the packet, and subtract the padding length,
+            // after checking the validity
             xrdp_sec_fips_decrypt(self, s->p, (int)(s->end - s->p));
+            if (pad > 7 || pad > (int)(s->end - s->p))
+            {
+                LOG(LOG_LEVEL_ERROR, "Bad padding for TS_SECURITY_HEADER2 PDU");
+                return 1;
+            }
             s->end -= pad;
             if (!xrdp_sec_fips_check_sig(self, data_signature, 8,
                                          s->p, (int)(s->end - s->p)))