File freerdp-CVE-2026-24684.patch of Package freerdp.42840

From 622bb7b4402491ca003f47472d0e478132673696 Mon Sep 17 00:00:00 2001
From: akallabeth <akallabeth@posteo.net>
Date: Mon, 26 Jan 2026 10:48:14 +0100
Subject: [PATCH] [channels,rdpsnd] terminate thread before free

Ensure that the optional rdpsnd thread is terminated and the message
queue freed up before releasing the channel context memory
---
 channels/rdpsnd/client/rdpsnd_main.c | 28 +++++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff -urp FreeRDP-2.4.0.orig/channels/rdpsnd/client/rdpsnd_main.c FreeRDP-2.4.0/channels/rdpsnd/client/rdpsnd_main.c
--- FreeRDP-2.4.0.orig/channels/rdpsnd/client/rdpsnd_main.c	2021-07-27 04:58:27.000000000 -0500
+++ FreeRDP-2.4.0/channels/rdpsnd/client/rdpsnd_main.c	2026-02-18 17:11:30.613415353 -0600
@@ -1214,6 +1214,23 @@ fail:
 	return CHANNEL_RC_NO_MEMORY;
 }
 
+static void rdpsnd_terminate_thread(rdpsndPlugin* rdpsnd)
+{
+	WINPR_ASSERT(rdpsnd);
+	if (rdpsnd->queue)
+		MessageQueue_PostQuit(rdpsnd->queue, 0);
+
+	if (rdpsnd->thread)
+	{
+		(void)WaitForSingleObject(rdpsnd->thread, INFINITE);
+		(void)CloseHandle(rdpsnd->thread);
+	}
+
+	MessageQueue_Free(rdpsnd->queue);
+	rdpsnd->thread = NULL;
+	rdpsnd->queue = NULL;
+}
+
 /**
  * Function description
  *
@@ -1321,13 +1338,7 @@ static void rdpsnd_virtual_channel_event
 {
 	if (rdpsnd)
 	{
-		MessageQueue_PostQuit(rdpsnd->queue, 0);
-		if (rdpsnd->thread)
-		{
-			WaitForSingleObject(rdpsnd->thread, INFINITE);
-			CloseHandle(rdpsnd->thread);
-		}
-		MessageQueue_Free(rdpsnd->queue);
+		rdpsnd_terminate_thread(rdpsnd);
 
 		audio_formats_free(rdpsnd->fixed_format, 1);
 		free(rdpsnd->subsystem);