File freerdp-CVE-2026-24684.patch of Package freerdp2

From 622bb7b4402491ca003f47472d0e478132673696 Mon Sep 17 00:00:00 2001
From: akallabeth <akallabeth@posteo.net>
Date: Mon, 26 Jan 2026 10:48:14 +0100
Subject: [PATCH] [channels,rdpsnd] terminate thread before free

Ensure that the optional rdpsnd thread is terminated and the message
queue freed up before releasing the channel context memory
---
 channels/rdpsnd/client/rdpsnd_main.c | 28 +++++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff -urp freerdp-2.11.7.orig/channels/rdpsnd/client/rdpsnd_main.c freerdp-2.11.7/channels/rdpsnd/client/rdpsnd_main.c
--- freerdp-2.11.7.orig/channels/rdpsnd/client/rdpsnd_main.c	2024-04-22 04:26:59.000000000 -0500
+++ freerdp-2.11.7/channels/rdpsnd/client/rdpsnd_main.c	2026-02-18 16:10:15.171328421 -0600
@@ -1244,11 +1244,29 @@ fail:
 	return CHANNEL_RC_NO_MEMORY;
 }
 
+static void rdpsnd_terminate_thread(rdpsndPlugin* rdpsnd)
+{
+	WINPR_ASSERT(rdpsnd);
+	if (rdpsnd->queue)
+		MessageQueue_PostQuit(rdpsnd->queue, 0);
+
+	if (rdpsnd->thread)
+	{
+		(void)WaitForSingleObject(rdpsnd->thread, INFINITE);
+		(void)CloseHandle(rdpsnd->thread);
+	}
+
+	MessageQueue_Free(rdpsnd->queue);
+	rdpsnd->thread = NULL;
+	rdpsnd->queue = NULL;
+}
+
 static void cleanup_internals(rdpsndPlugin* rdpsnd)
 {
 	if (!rdpsnd)
 		return;
 
+	rdpsnd_terminate_thread(rdpsnd);
 	if (rdpsnd->pool)
 		StreamPool_Return(rdpsnd->pool, rdpsnd->data_in);
 
@@ -1396,14 +1414,7 @@ void rdpsnd_virtual_channel_event_termin
 {
 	if (rdpsnd)
 	{
-		if (rdpsnd->queue)
-			MessageQueue_PostQuit(rdpsnd->queue, 0);
-		if (rdpsnd->thread)
-		{
-			WaitForSingleObject(rdpsnd->thread, INFINITE);
-			CloseHandle(rdpsnd->thread);
-		}
-		MessageQueue_Free(rdpsnd->queue);
+		rdpsnd_terminate_thread(rdpsnd);
 
 		free_internals(rdpsnd);
 		audio_formats_free(rdpsnd->fixed_format, 1);