Project: freerdp (freerdp/freerdp), language: c++
Vulnerability instance: freerdp.cve-2023-40567
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Advisory
## URL: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2w9f-8wg4-8jfp
## Description:
Advisory ID: GHSA-2w9f-8wg4-8jfp
Title: Out-Of-Bounds Write in clear_decompress_bands_data

Description:
Summary
Out-Of-Bounds Write in clear_decompress_bands_data
Affected
FreeRDP based clients only. FreeRDP proxy not affected as image decoding is not done by proxy (data passthrough)
Details
FreeRDP/libfreerdp/codec/clear.c
Lines 612 to 618 in 5be5553
 Stream_Read_UINT16(s, xStart); 
 Stream_Read_UINT16(s, xEnd); 
 Stream_Read_UINT16(s, yStart); 
 Stream_Read_UINT16(s, yEnd); 
 Stream_Read_UINT8(s, cb); 
 Stream_Read_UINT8(s, cg); 
 Stream_Read_UINT8(s, cr); 

Read xStart, yStart here
FreeRDP/libfreerdp/codec/clear.c
Lines 843 to 845 in 5be5553
 nXDstRel = nXDst + xStart; 
 nYDstRel = nYDst + yStart; 
 cpSrcPixel = vBarEntry->pixels; 

There're no offset validation.
PoC
make nXDst + xStart >= surface->width
(or) make nYDst + yStart >= surface->height
Impact
Out-Of-Bounds Write
Asan
==57618==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x00012aea3db4 at pc 0x000105370990 bp 0x00016bf91480 sp 0x00016bf91478
WRITE of size 1 at 0x00012aea3db4 thread T4
    #0 0x10537098c in FreeRDPWriteColor+0x8c (libfreerdp3.3.0.0.dylib:arm64+0xa898c) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #1 0x10531f5d4 in clear_decompress_bands_data+0x26cc (libfreerdp3.3.0.0.dylib:arm64+0x575d4) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #2 0x10531ac18 in clear_decompress+0x113c (libfreerdp3.3.0.0.dylib:arm64+0x52c18) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #3 0x105427ca0 in gdi_SurfaceCommand_ClearCodec+0x6fc (libfreerdp3.3.0.0.dylib:arm64+0x15fca0) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #4 0x10541f020 in gdi_SurfaceCommand+0x568 (libfreerdp3.3.0.0.dylib:arm64+0x157020) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #5 0x1045fe118 in rdpgfx_decode+0x288 (libfreerdp-client3.3.0.0.dylib:arm64+0xaa118) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #6 0x1045e7afc in rdpgfx_recv_wire_to_surface_1_pdu+0x1760 (libfreerdp-client3.3.0.0.dylib:arm64+0x93afc) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #7 0x1045e50e4 in rdpgfx_recv_pdu+0x5d4 (libfreerdp-client3.3.0.0.dylib:arm64+0x910e4) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #8 0x1045e3fd4 in rdpgfx_on_data_received+0x448 (libfreerdp-client3.3.0.0.dylib:arm64+0x8ffd4) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #9 0x104567428 in dvcman_call_on_receive+0x164 (libfreerdp-client3.3.0.0.dylib:arm64+0x13428) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #10 0x104567294 in dvcman_receive_channel_data+0x440 (libfreerdp-client3.3.0.0.dylib:arm64+0x13294) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #11 0x104563c7c in drdynvc_process_data+0x2c8 (libfreerdp-client3.3.0.0.dylib:arm64+0xfc7c) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #12 0x104561ef0 in drdynvc_order_recv+0x334 (libfreerdp-client3.3.0.0.dylib:arm64+0xdef0) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #13 0x104561934 in drdynvc_virtual_channel_event_data_received+0x498 (libfreerdp-client3.3.0.0.dylib:arm64+0xd934) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #14 0x10456061c in drdynvc_virtual_channel_open_event_ex+0x1ac (libfreerdp-client3.3.0.0.dylib:arm64+0xc61c) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #15 0x10551ed98 in freerdp_channels_data+0x5cc (libfreerdp3.3.0.0.dylib:arm64+0x256d98) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #16 0x1055d0764 in freerdp_channel_process+0x6e0 (libfreerdp3.3.0.0.dylib:arm64+0x308764) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #17 0x10558084c in rdp_recv_tpkt_pdu+0x11e8 (libfreerdp3.3.0.0.dylib:arm64+0x2b884c) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #18 0x10557f60c in rdp_recv_pdu+0x34 (libfreerdp3.3.0.0.dylib:arm64+0x2b760c) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #19 0x10557ae74 in rdp_recv_callback_int+0x1408 (libfreerdp3.3.0.0.dylib:arm64+0x2b2e74) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #20 0x10557999c in rdp_recv_callback+0x1d8 (libfreerdp3.3.0.0.dylib:arm64+0x2b199c) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #21 0x1055a0188 in transport_check_fds+0x51c (libfreerdp3.3.0.0.dylib:arm64+0x2d8188) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #22 0x10557b77c in rdp_check_fds+0x170 (libfreerdp3.3.0.0.dylib:arm64+0x2b377c) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #23 0x105516554 in freerdp_check_fds+0x1ac (libfreerdp3.3.0.0.dylib:arm64+0x24e554) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #24 0x105516c24 in freerdp_check_event_handles+0x70 (libfreerdp3.3.0.0.dylib:arm64+0x24ec24) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #25 0x10416f130 in mac_client_thread+0x5a4 (MacFreeRDP:arm64+0x13130) (BuildId: 3a4e43fe04f43036ab9335815490e83b32000000200000000100000000000d00)
    #26 0x105e2d4ac in thread_launcher thread.c:520
    #27 0x192413fa4 in _pthread_start+0x90 (libsystem_pthread.dylib:arm64+0x6fa4) (BuildId: 46d35233a0513f4fbba4ba56dddc4d1a32000000200000000100000000040d00)
    #28 0xe66f00019240ed9c  (<unknown module>)

0x00012aea3db4 is located 14732 bytes after 146472-byte region [0x00012ae7c800,0x00012aea0428)
allocated by thread T4 here:
    #0 0x1063b55b0 in wrap_malloc+0x8c (libclang_rt.asan_osx_dynamic.dylib:arm64+0x515b0) (BuildId: 4947f3677e4435f39b5765e7dbc19bf732000000200000000100000000000b00)
    #1 0x105e8cf18 in winpr_aligned_offset_malloc alignment.c:114
    #2 0x105e8cdf0 in winpr_aligned_malloc alignment.c:60
    #3 0x10541fbf8 in gdi_CreateSurface+0x82c (libfreerdp3.3.0.0.dylib:arm64+0x157bf8) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #4 0x1045ee15c in rdpgfx_recv_create_surface_pdu+0xab0 (libfreerdp-client3.3.0.0.dylib:arm64+0x9a15c) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #5 0x1045e5744 in rdpgfx_recv_pdu+0xc34 (libfreerdp-client3.3.0.0.dylib:arm64+0x91744) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #6 0x1045e3fd4 in rdpgfx_on_data_received+0x448 (libfreerdp-client3.3.0.0.dylib:arm64+0x8ffd4) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #7 0x104567428 in dvcman_call_on_receive+0x164 (libfreerdp-client3.3.0.0.dylib:arm64+0x13428) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #8 0x104567294 in dvcman_receive_channel_data+0x440 (libfreerdp-client3.3.0.0.dylib:arm64+0x13294) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #9 0x104563c7c in drdynvc_process_data+0x2c8 (libfreerdp-client3.3.0.0.dylib:arm64+0xfc7c) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #10 0x104561ef0 in drdynvc_order_recv+0x334 (libfreerdp-client3.3.0.0.dylib:arm64+0xdef0) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #11 0x104561934 in drdynvc_virtual_channel_event_data_received+0x498 (libfreerdp-client3.3.0.0.dylib:arm64+0xd934) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #12 0x10456061c in drdynvc_virtual_channel_open_event_ex+0x1ac (libfreerdp-client3.3.0.0.dylib:arm64+0xc61c) (BuildId: 776adf67bfdc356180bc0f4db402691032000000200000000100000000000d00)
    #13 0x10551ed98 in freerdp_channels_data+0x5cc (libfreerdp3.3.0.0.dylib:arm64+0x256d98) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #14 0x1055d0764 in freerdp_channel_process+0x6e0 (libfreerdp3.3.0.0.dylib:arm64+0x308764) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #15 0x10558084c in rdp_recv_tpkt_pdu+0x11e8 (libfreerdp3.3.0.0.dylib:arm64+0x2b884c) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #16 0x10557f60c in rdp_recv_pdu+0x34 (libfreerdp3.3.0.0.dylib:arm64+0x2b760c) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #17 0x10557ae74 in rdp_recv_callback_int+0x1408 (libfreerdp3.3.0.0.dylib:arm64+0x2b2e74) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #18 0x10557999c in rdp_recv_callback+0x1d8 (libfreerdp3.3.0.0.dylib:arm64+0x2b199c) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #19 0x1055a0188 in transport_check_fds+0x51c (libfreerdp3.3.0.0.dylib:arm64+0x2d8188) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #20 0x10557b77c in rdp_check_fds+0x170 (libfreerdp3.3.0.0.dylib:arm64+0x2b377c) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #21 0x105516554 in freerdp_check_fds+0x1ac (libfreerdp3.3.0.0.dylib:arm64+0x24e554) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #22 0x105516c24 in freerdp_check_event_handles+0x70 (libfreerdp3.3.0.0.dylib:arm64+0x24ec24) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00)
    #23 0x10416f130 in mac_client_thread+0x5a4 (MacFreeRDP:arm64+0x13130) (BuildId: 3a4e43fe04f43036ab9335815490e83b32000000200000000100000000000d00)
    #24 0x105e2d4ac in thread_launcher thread.c:520
    #25 0x192413fa4 in _pthread_start+0x90 (libsystem_pthread.dylib:arm64+0x6fa4) (BuildId: 46d35233a0513f4fbba4ba56dddc4d1a32000000200000000100000000040d00)
    #26 0xe66f00019240ed9c  (<unknown module>)

Thread T4 created by T0 here:
    #0 0x1063ae91c in wrap_pthread_create+0x50 (libclang_rt.asan_osx_dynamic.dylib:arm64+0x4a91c) (BuildId: 4947f3677e4435f39b5765e7dbc19bf732000000200000000100000000000b00)
    #1 0x105e2a52c in winpr_StartThread thread.c:568
    #2 0x105e29c00 in CreateThread thread.c:650
    #3 0x10416e894 in -[MRDPView rdpStart:]+0x964 (MacFreeRDP:arm64+0x12894) (BuildId: 3a4e43fe04f43036ab9335815490e83b32000000200000000100000000000d00)
    #4 0x10416dce4 in mfreerdp_client_start+0x488 (MacFreeRDP:arm64+0x11ce4) (BuildId: 3a4e43fe04f43036ab9335815490e83b32000000200000000100000000000d00)
    #5 0x104161bbc in freerdp_client_start+0x190 (MacFreeRDP:arm64+0x5bbc) (BuildId: 3a4e43fe04f43036ab9335815490e83b32000000200000000100000000000d00)
    #6 0x10409e78c in -[AppDelegate applicationDidFinishLaunching:]+0x53c (MacFreeRDP:arm64+0x10000678c) (BuildId: c0debf5af29834acb3c97ff2be5d5c4932000000200000000100000000000d00)
    #7 0x1924e717c in __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__+0x90 (CoreFoundation:arm64+0x7417c) (BuildId: 203e44018c2e3157a24b92f52551d43e32000000200000000100000000040d00)
    #8 0xb562000192582ee8  (<unknown module>)
    #9 0x2672800192582e30  (<unknown module>)
    #10 0x5b178001924b84c8  (<unknown module>)
    #11 0x4f6a8001934168f0  (<unknown module>)
    #12 0x1063000195719154  (<unknown module>)
    #13 0x9e24800195718f04  (<unknown module>)
    #14 0x4c62000195716fa0  (<unknown module>)
    #15 0x465800195716b9c  (<unknown module>)
    #16 0x8726000193440b60  (<unknown module>)
    #17 0x4f170001934409c0  (<unknown module>)
    #18 0xa551000198819514  (<unknown module>)
    #19 0x5d07800198818e40  (<unknown module>)
    #20 0x5039800198811f14  (<unknown module>)
    #21 0x421c00019bd4ab40  (<unknown module>)
    #22 0x8658800195712044  (<unknown module>)
    #23 0xc966000195710edc  (<unknown module>)
    #24 0x8567000195705340  (<unknown module>)
    #25 0xc1600001956dc790  (<unknown module>)
    #26 0x453080010409e020  (<unknown module>)
    #27 0x1920bbf24  (<unknown module>)
    #28 0x5553fffffffffffc  (<unknown module>)

SUMMARY: AddressSanitizer: heap-buffer-overflow (libfreerdp3.3.0.0.dylib:arm64+0xa898c) (BuildId: bf7e9ae0188530b6acf1f332537c2e9132000000200000000100000000000d00) in FreeRDPWriteColor+0x8c
Shadow bytes around the buggy address:
  0x00012aea3b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x00012aea3b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x00012aea3c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x00012aea3c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x00012aea3d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x00012aea3d80: fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa
  0x00012aea3e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x00012aea3e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x00012aea3f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x00012aea3f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x00012aea4000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==57618==ABORTING
[21:13:46:555] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [fatal_handler]: Caught signal 'Abort trap: 6' [6]
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 0: 0   libwinpr3.3.0.0.dylib               0x0000000105d8b6e4 winpr_execinfo_backtrace + 336
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 1: 1   libwinpr3.3.0.0.dylib               0x0000000105d8521c winpr_backtrace + 24
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 2: 2   libwinpr3.3.0.0.dylib               0x0000000105d85578 winpr_log_backtrace_ex + 304
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 3: 3   libwinpr3.3.0.0.dylib               0x0000000105d8543c winpr_log_backtrace + 44
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 4: 4   libfreerdp3.3.0.0.dylib             0x00000001053873c4 fatal_handler + 460
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 5: 5   libsystem_platform.dylib            0x0000000192442a24 _sigtramp + 56
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 6: 6   libsystem_pthread.dylib             0x0000000192413c28 pthread_kill + 288
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 7: 7   libsystem_c.dylib                   0x0000000192321ae8 abort + 180
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 8: 8   libclang_rt.asan_osx_dynamic.dylib  0x00000001063d89b8 _ZN11__sanitizer6AtexitEPFvvE + 0
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 9: 9   libclang_rt.asan_osx_dynamic.dylib  0x00000001063d8124 _ZN11__sanitizer22SetCheckUnwindCallbackEPFvvE + 0
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 10: 10  libclang_rt.asan_osx_dynamic.dylib  0x00000001063bd658 _ZN6__asan16ErrorDescription5PrintEv + 0
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 11: 11  libclang_rt.asan_osx_dynamic.dylib  0x00000001063bc99c _ZN6__asan18ReportGenericErrorEmmmmbmjb + 1452
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 12: 12  libclang_rt.asan_osx_dynamic.dylib  0x00000001063bdde0 __asan_report_store1 + 52
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 13: 13  libfreerdp3.3.0.0.dylib             0x0000000105370990 FreeRDPWriteColor + 144
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 14: 14  libfreerdp3.3.0.0.dylib             0x000000010531f5d8 clear_decompress_bands_data + 9936
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 15: 15  libfreerdp3.3.0.0.dylib             0x000000010531ac1c clear_decompress + 4416
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 16: 16  libfreerdp3.3.0.0.dylib             0x0000000105427ca4 gdi_SurfaceCommand_ClearCodec + 1792
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 17: 17  libfreerdp3.3.0.0.dylib             0x000000010541f024 gdi_SurfaceCommand + 1388
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 18: 18  libfreerdp-client3.3.0.0.dylib      0x00000001045fe11c rdpgfx_decode + 652
[21:13:46:556] [57618:6bf93000] [ERROR][com.freerdp.utils.signal] - [winpr_log_backtrace_ex]: 19: 19  libfreerdp-client3.3.0.0.dylib      0x00000001045e7b00 rdpgfx_recv_wire_to_surface_1_pdu + 5988


References:
https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/clear.c#L612-L618
https://github.com/FreeRDP/FreeRDP/commit/5be5553e0da72178a4b94cc1ffbdace9ceb153e5
https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/clear.c#L843-L845

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
    -DCMAKE_C_FLAGS="${CFLAGS}"
    -DCMAKE_CXX_FLAGS="${CXXFLAGS}"
    -DCMAKE_EXE_LINKER_FLAGS="${LDFLAGS}"
    -DCMAKE_MODULE_LINKER_FLAGS="${LDFLAGS}"
    -DCMAKE_SHARED_LINKER_FLAGS="${LDFLAGS}"
cmake "${cmake_args[@]}" -S . -B build -G Ninja
cmake --build build --parallel --target fuzzers

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential git-core cmake ninja-build pkg-config zlib1g-dev ccache libx11-dev libxext-dev libxinerama-dev libxcursor-dev libxkbfile-dev libxv-dev libxi-dev libxdamage-dev libxrender-dev libxrandr-dev libssl-dev libasound2-dev libcups2-dev libpulse-dev libcairo2-dev libavutil-dev libavcodec-dev libusb-1.0-0-dev libicu-dev libpkcs11-helper1-dev libpkcs11-helper1 libsdl2-ttf-dev libwayland-dev libpam0g-dev libxcb-damage0-dev ccache libxtst-dev libfuse-dev libsystemd-dev libsoxr-dev libsdl2-dev docbook-xsl libkrb5-dev krb5-multidev libcjson-dev libswscale-dev libswresample-dev libpcsclite-dev xsltproc libsdl2-dev
RUN git clone https://github.com/freerdp/freerdp freerdp
RUN git -C freerdp checkout 16047bd16f159ee4aea581854170e83c36862793
WORKDIR $SRC/freerdp
COPY build.sh $SRC/

Additional files: