File freerdp-CVE-2026-23884.patch of Package freerdp.42881

From 52106a26726a2aba77aa6d86014d2eb3507f0783 Mon Sep 17 00:00:00 2001
From: akallabeth <akallabeth@posteo.net>
Date: Mon, 19 Jan 2026 08:58:22 +0100
Subject: [PATCH] [cache,offscreen] invalidate bitmap before free

First ensure the bitmap is no longer used for drawing before calling the
free function.
---
 libfreerdp/cache/offscreen.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

Index: FreeRDP-2.4.0/libfreerdp/cache/offscreen.c
===================================================================
--- FreeRDP-2.4.0.orig/libfreerdp/cache/offscreen.c
+++ FreeRDP-2.4.0/libfreerdp/cache/offscreen.c
@@ -23,6 +23,7 @@
 
 #include <stdio.h>
 
+#include <winpr/assert.h>
 #include <winpr/crt.h>
 
 #include <winpr/stream.h>
@@ -160,18 +161,22 @@ void offscreen_cache_put(rdpOffscreenCac
 
 void offscreen_cache_delete(rdpOffscreenCache* offscreenCache, UINT32 index)
 {
-	rdpBitmap* prevBitmap;
-
 	if (index >= offscreenCache->maxEntries)
 	{
 		WLog_ERR(TAG, "invalid offscreen bitmap index (delete): 0x%08" PRIX32 "", index);
 		return;
 	}
 
-	prevBitmap = offscreenCache->entries[index];
+	rdpBitmap* prevBitmap = offscreenCache->entries[index];
 
 	if (prevBitmap != NULL)
+	{
+		WINPR_ASSERT(offscreenCache->update->context);
+
+		/* Ensure that the bitmap is no longer used in GDI */
+		IFCALL(prevBitmap->SetSurface, offscreenCache->update->context, NULL, FALSE);
 		Bitmap_Free(offscreenCache->update->context, prevBitmap);
+    }
 
 	offscreenCache->entries[index] = NULL;
 }