releasing package freerdp2 version 2.11.7+dfsg1-6

Closes: #1079025

.clang-format

@@ -104,7 +104,6 @@ ForEachMacros:
 ...
 Language:        ObjC
 PointerBindsToType: false
-ObjCSpaceAfterProperty: true
 SortIncludes: false
 ObjCBlockIndentWidth: 4
 ObjCSpaceAfterProperty: false

CMakeLists.txt

@@ -34,9 +34,9 @@ if(NOT DEFINED FREERDP_VENDOR)
 	set(FREERDP_VENDOR 1)
 endif()
 
-set(CMAKE_COLOR_MAKEFILE ON)
-
-set(CMAKE_POSITION_INDEPENDENT_CODE ON)
+option(CMAKE_COLOR_MAKEFILE "colorful CMake makefile" ON)
+option(CMAKE_VERBOSE_MAKEFILE "verbose CMake makefile" ON)
+option(CMAKE_POSITION_INDEPENDENT_CODE "build with position independent code (-fPIC or -fPIE)" ON)
 
 # Include our extra modules
 set(CMAKE_MODULE_PATH ${CMAKE_SOURCE_DIR}/cmake/)
@@ -85,7 +85,7 @@ if ($ENV{BUILD_NUMBER})
 endif()
 set(WITH_LIBRARY_VERSIONING "ON")
 
-set(RAW_VERSION_STRING "2.6.1")
+set(RAW_VERSION_STRING "2.11.7")
 if(EXISTS "${CMAKE_SOURCE_DIR}/.source_tag")
 	file(READ ${CMAKE_SOURCE_DIR}/.source_tag RAW_VERSION_STRING)
 elseif(USE_VERSION_FROM_GIT_TAG)
@@ -225,7 +225,7 @@ endif()
 if(MSVC)
 	include(MSVCRuntime)
 	if(NOT DEFINED MSVC_RUNTIME)
-		set(MSVC_RUNTIME "dynamic")
+		set(MSVC_RUNTIME "dynamic" CACHE STRING "MSVC runtime type [dynamic|static]")
 	endif()
 	if(MSVC_RUNTIME STREQUAL "static")
 		if(BUILD_SHARED_LIBS)
@@ -355,7 +355,7 @@ if(NOT IOS)
 	find_package(Threads REQUIRED)
 endif()
 
-if(NOT WIN32)
+if(NOT WIN32 AND NOT IOS)
 	CHECK_SYMBOL_EXISTS(pthread_mutex_timedlock pthread.h HAVE_PTHREAD_MUTEX_TIMEDLOCK_SYMBOL)
 	if (NOT HAVE_PTHREAD_MUTEX_TIMEDLOCK_SYMBOL)
 		CHECK_LIBRARY_EXISTS(pthread pthread_mutex_timedlock "" HAVE_PTHREAD_MUTEX_TIMEDLOCK_LIB)
@@ -532,7 +532,6 @@ add_definitions(-DWINPR_EXPORTS -DFREERDP_EXPORTS)
 if(NOT IOS)
 	check_include_files(fcntl.h HAVE_FCNTL_H)
 	check_include_files(unistd.h HAVE_UNISTD_H)
-	check_include_files(execinfo.h HAVE_EXECINFO_H)
 	check_include_files(inttypes.h HAVE_INTTYPES_H)
 	check_include_files(sys/modem.h HAVE_SYS_MODEM_H)
 	check_include_files(sys/filio.h HAVE_SYS_FILIO_H)
@@ -540,6 +539,18 @@ if(NOT IOS)
 	check_include_files(sys/strtio.h HAVE_SYS_STRTIO_H)
 	check_include_files(sys/select.h HAVE_SYS_SELECT_H)
 	check_include_files(syslog.h HAVE_SYSLOG_H)
+	check_include_files(execinfo.h HAVE_EXECINFO_HEADER)
+	if (HAVE_EXECINFO_HEADER)
+		check_symbol_exists(backtrace execinfo.h HAVE_EXECINFO_BACKTRACE)
+		check_symbol_exists(backtrace_symbols execinfo.h HAVE_EXECINFO_BACKTRACE_SYMBOLS)
+		check_symbol_exists(backtrace_symbols_fd execinfo.h HAVE_EXECINFO_BACKTRACE_SYMBOLS_FD)
+
+		# Some implementations (e.g. Android NDK API < 33) provide execinfo.h but do not define
+		# the backtrace functions. Disable detection for these cases
+		if (HAVE_EXECINFO_BACKTRACE AND HAVE_EXECINFO_BACKTRACE_SYMBOLS AND HAVE_EXECINFO_BACKTRACE_SYMBOLS_FD)
+			set(HAVE_EXECINFO_H ON)
+		endif()
+	endif()
 else()
 	set(HAVE_FCNTL_H 1)
 	set(HAVE_UNISTD_H 1)
@@ -598,6 +609,11 @@ if(ANDROID)
 		set (WITH_NEON OFF)
 	endif()
 
+	if(ANDROID_ABI STREQUAL arm64-v8a)
+		# https://github.com/android/ndk/issues/910
+		set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -mfloat-abi=softfp")
+	endif()
+
 	if("${CMAKE_BUILD_TYPE}" STREQUAL "Debug")
 		add_definitions(-DNDK_DEBUG=1)
 
@@ -856,18 +872,23 @@ if (WITH_DSP_FFMPEG)
 	# Deactivate FFmpeg backend for sound, if the version is too old.
 	# See libfreerdp/codec/dsp_ffmpeg.h
 	file(STRINGS "${AVCODEC_INCLUDE_DIR}/libavcodec/version.h" AV_VERSION_FILE REGEX "LIBAVCODEC_VERSION_M[A-Z]+[\t ]*[0-9]+")
+	if (EXISTS "${AVCODEC_INCLUDE_DIR}/libavcodec/version_major.h")
+		file(STRINGS "${AVCODEC_INCLUDE_DIR}/libavcodec/version_major.h" AV_VERSION_FILE2 REGEX "LIBAVCODEC_VERSION_M[A-Z]+[\t ]*[0-9]+")
+		list(APPEND AV_VERSION_FILE ${AV_VERSION_FILE2})
+	endif()
+
 	FOREACH(item ${AV_VERSION_FILE})
 	  STRING(REGEX MATCH "LIBAVCODEC_VERSION_M[A-Z]+[\t ]*[0-9]+" litem ${item})
-	IF(litem)
-			string(REGEX REPLACE "[ \t]+" ";" VSPLIT_LINE ${litem})
-			list(LENGTH VSPLIT_LINE VSPLIT_LINE_LEN)
-			if (NOT "${VSPLIT_LINE_LEN}" EQUAL "2")
-				message(ERROR "invalid entry in libavcodec version header ${item}")
-			endif(NOT "${VSPLIT_LINE_LEN}" EQUAL "2")
-			list(GET VSPLIT_LINE 0 VNAME)
-			list(GET VSPLIT_LINE 1 VVALUE)
-			set(${VNAME} ${VVALUE})
-	ENDIF(litem)
+		IF(litem)
+				string(REGEX REPLACE "[ \t]+" ";" VSPLIT_LINE ${litem})
+				list(LENGTH VSPLIT_LINE VSPLIT_LINE_LEN)
+				if (NOT "${VSPLIT_LINE_LEN}" EQUAL "2")
+					message(ERROR "invalid entry in libavcodec version header ${item}")
+				endif(NOT "${VSPLIT_LINE_LEN}" EQUAL "2")
+				list(GET VSPLIT_LINE 0 VNAME)
+				list(GET VSPLIT_LINE 1 VVALUE)
+				set(${VNAME} ${VVALUE})
+		ENDIF(litem)
 	ENDFOREACH(item ${AV_VERSION_FILE})
 
 	set(AVCODEC_VERSION "${LIBAVCODEC_VERSION_MAJOR}.${LIBAVCODEC_VERSION_MINOR}.${LIBAVCODEC_VERSION_MICRO}")
@@ -969,7 +990,16 @@ if (APPLE)
 else (APPLE)
 	set(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE)
 	if (NOT FREEBSD)
-		set(CMAKE_INSTALL_RPATH "\$ORIGIN/../${CMAKE_INSTALL_LIBDIR}:\$ORIGIN/..")
+		if (NOT BUILTIN_CHANNELS)
+			if (NOT DEFINED WITH_PLUGIN_RPATH_ONLY)
+				set(CMAKE_INSTALL_RPATH "\$ORIGIN/../${CMAKE_INSTALL_LIBDIR}:\$ORIGIN/..:\$ORIGIN/../${FREERDP_PLUGIN_PATH}")
+			else()
+				# we need to supply this run path, even if not using RPATH in general
+				set(CMAKE_INSTALL_RPATH "\$ORIGIN/../${FREERDP_PLUGIN_PATH}")
+			endif()
+		else()
+			set(CMAKE_INSTALL_RPATH "\$ORIGIN/../${CMAKE_INSTALL_LIBDIR}:\$ORIGIN/..")
+		endif()
 	endif()
 endif(APPLE)
 
@@ -1032,15 +1062,6 @@ add_subdirectory(include)
 
 add_subdirectory(libfreerdp)
 
-if (IOS)
-	set(CMAKE_OSX_DEPLOYMENT_TARGET "10.0")
-	if (IOS_PLATFORM MATCHES "SIMULATOR")
-		set(CMAKE_OSX_SYSROOT "iphonesimulator")
-	else()
-		set(CMAKE_OSX_SYSROOT "iphoneos")
-	endif()
-endif()
-
 # RdTk
 include_directories("${CMAKE_SOURCE_DIR}/rdtk/include")
 include_directories("${CMAKE_BINARY_DIR}/rdtk/include")

ChangeLog

@@ -1,7 +1,219 @@
+# 2024-04-22 Version 2.11.7
+
+Noteworthy changes:
+* Backported oss-fuzz fixes
+
+For a complete and detailed change log since the last release run:
+git log 2.11.7...2.11.6
+
+# 2024-04-17 Version 2.11.6
+
+CVE:
+ CVE-2024-32041 [Low[ OutOfBound Read in zgfx_decompress_segment
+ CVE-2024-32039 [Moderate] Integer overflow & OutOfBound Write in clear_decompress_residual_data
+ CVE-2024-32040 [Low] integer underflow in nsc_rle_decode
+ CVE-2024-32458 [Low] OutOfBound Read in planar_skip_plane_rle
+ CVE-2024-32459 [Low] OutOfBound Read in ncrush_decompress
+ CVE-2024-32460 [Low] OutOfBound Read in interleaved_decompress
+
+Noteworthy changes:
+* Backported #10077
+
+For a complete and detailed change log since the last release run:
+git log 2.11.6...2.11.5
+
+# 2024-01-19 Version 2.11.5
+
+Noteworthy changes:
+* Fix integer overflow in progressive decoder
+* Update OpenSSL API usage for compatiblility with newer versions (#9747)
+* Prevent NULL dereference for single thread decoder (#9712)
+
+For a complete and detailed change log since the last release run:
+git log 2.11.5...2.11.4
+
+# 2023-12-14 Version 2.11.4
+
+Notworthy changes:
+* fix a typo in unicode commit (#9652)
+
+For a complete and detailed change log since the last release run:
+git log 2.11.4...2.11.3
+
+# 2023-12-14 Version 2.11.3
+
+Notworthy changes:
+* Disabled windows MEDIA FOUNDATION h264 decoder due to reported issues (#9469)
+* Fix issues with drive redirection (#9530,9554, #9586, #9617)
+* Use endian safe ICU string converter (#9631)
+* Improve AAC support (#9577)
+* Fix swiss german keyboard layout (#9560)
+* Enable rfx-mode:image (#9428)
+
+For a complete and detailed change log since the last release run:
+git log 2.11.3...2.11.2
+
+# 2023-09-20 Version 2.11.2
+
+Notworthy changes:
+* Backported #9378: backported wArrayList (optional) copy on insert
+* Backported #9360: backported certificate algorithm detection
+
+For a complete and detailed change log since the last release run:
+git log 2.11.2...2.11.1
+
+# 2023-09-04 Version 2.11.1
+
+Notworthy changes:
+* Backported #9356: Fix issues with order updates
+
+For a complete and detailed change log since the last release run:
+git log 2.11.1..2.11.0
+
+# 2023-08-28 Version 2.11.0
+
+Noteworthy changes:
+* Various input validation fixes
+* Added various CMake options #9317
+* LibreSSL build fixes #8709
+
+Fixed issues:
+* Backported #9233: Big endian support
+* Backported #9099: Mouse grabbing support
+* Backported #6851: wayland scrolling fix
+* Backported #8690: Update h264 to use new FFMPEG API
+* Backported #7306: early bail from update_read_window_state_order breaks protocol
+* Backported #8903: rdpecam/server: Remove wrong assertion
+* Backported #8994: bounds checks for gdi/gfx rectangles
+* Backported #9023: enforce rdpdr client side state checks
+* Backported #6331: deactivate mouse grabbing by default
+* Cherry-pick out of #9172: channels/cliprdr: Fix writing incorrect PDU type for unlock PDUs
+
+# 2023-02-16 Version 2.10.0
+
+Noteworthy changes:
+* Fix android build scripts, use CMake from SDK
+* Fix connection negotiation with mstsc/msrdc #8426
+* [ntlm]: use rfc5929 binding hash algorithm #8430
+* [channels,printer] Fixed reference counting #8433
+* Fix uwac pixman #8439
+* Fix Rdp security #8457
+* [client,x11] Detect key autorepeat #8522
+* [build] add channel path to RPATH #8551
+* Fix build with BUILTIN_CHANNELS=OFF #8560
+* revert changes so that the osmajortype/osminortype is not overwritten #8571
+* [uwac] do not use iso C functions #8604
+* [winpr,sam] fix inalid NULL arguments #8605
+* Fix incompatible function pointer types #8625
+
+Fixed issues:
+* Backported #8581: Ignore data PDUs for DVCs that were not opened successfully
+* Backported #8498: [channel,urbdrc] fix type of usb hotplug callback
+* Backported #8537: Extended info enforce limits
+* Backported #8611: [core] add missing redirection fields
+
+# 2022-11-16 Version 2.9.0
+
+Noteworthy changes:
+* Backported #8252: Support sending server redirection PDU
+* Backported #8406: Ensure X11 client cursor is never smaller 1x1
+* Backported #8403: Fixed multiple client side input validation issues
+  (CVE-2022-39316, CVE-2022-39317, CVE-2022-39318, CVE-2022-39319,
+	 CVE-2022-39320, CVE-2022-41877, CVE-2022-39347)
+* Backported #7282: Proxy server now discards input events sent before
+  activation was received
+* Backported #8324: Internal replacements for md4, md5 and hmac-md5
+   For the time being the RDP protocol requires these outdated hash
+   algorithms. So any distribution that wants to ship a working
+   FreeRDP should check the options WITH_INTERNAL_MD4 (and depending
+   on OpenSSL deprecation status WITH_INTERNAL_MD5)
+
+Fixed issues:
+* Backported #8341: Null checks in winpr_Digest_Free
+* Backported #8335: Missing NULL return in winpr_Digest_New
+* Backported #8192: Support for audin version 2 microphone channel
+* Backported #7282: Discard input events before activation (Fixes #8374)
+
+For a complete and detailed change log since the last release run:
+git log 2.8.1..2.9.0
+
+
+# 2022-10-12 Version 2.8.1
+
+Noteworthy changes:
+* Fixed CVE-2022-39282
+* Fixed CVE-2022-39283
+* Added missing commit for backported #8041: Remove ALAW/ULAW codecs from linux backends (unreliable)
+* Added hash checks for android build script dependencies
+
+Fixed issues:
+* Backported #8190: Fix build break with newer FFMPEG versions
+* Backported #8234: Updated flatpak with build script
+* Backported #8210: Better execinfo support check for android
+* Backported #7708: Header now defines DumpThreadHandles
+* Backported #8176: Check fullscreen state and not setting
+* Backported #8236: Send resize on window state change
+* Backported #7611: Audin macOS monterey fix
+* Backported #8291: Android build script update
+
+# 2022-07-28 Version 2.8.0
+
+Noteworthy changes:
+
+* Backported API to get peer accepted channel option flags
+* Backported API to get peer accepted channel names
+* Backported Stream_CheckAndLogRequiredLength
+* Backported #7954: Add server side handling for [MS-RDPET]
+* Backported #8010: Add server side handling for [MS-RDPECAM]
+* Backported #8041: Remove ALAW/ULAW codecs from linux backends (unreliable)
+* Backported #8051: Relieve CLIPRDR filename restriction when connecting to non-MS Windows servers
+* Backported #8048: TLS version control
+* Backported #7987: Add a new command line arg to enforce tls1.2
+
+Fixed issues:
+
+* Fixed #7837: Prevent out of bound reads for FFMPEG
+* Backported #7859 and #7861: Unwind support for backtrace generation
+* Backported #7440: wlfreerdp appid
+* Backported #7832: RAIL window restore
+* Backported #7833: Refactored WinPR thread locking
+* Backported #7893: Mac rdpsnd memory leak fixes
+* Backported #7895: Mac audin memory leak fixes
+* Backported #7898: Automatic android versioning
+* Backported #7916: GFX 10.7 capability support
+* Backported #7949: Server RDPSND API improvements
+* Backported #7957: Server DVC API improvements
+* Backported #7760: Fixed osMinorType values
+* Backported #8013: Add missing osMajorType values
+* Backported #8076: Fix wrong usage of subband diffing flag (tile artifact fix)
+
+For a complete and detailed change log since the last release run:
+git log 2.7.0..2.8.0
+
+
+# 2022-04-25 Version 2.7.0
+
+Noteworthy changes:
+* Backported OpenSSL3 gateway support (#7822)
+* Backported various NTLM fixes
+* Backported WINPR_ASSERT to ease future backports
+
+Fixed issues:
+* Backported #6786: Use /network:auto by default
+* Backported #7714: Workaround for broken surface frame marker
+* Backported #7733: Support 10bit X11 color (BGRX32 only)
+* Backported #7745: GFX progressive double free
+* Backported #7808: Disable websockets with /gt:rpc
+* Backported #7815: RAIL expect LOGON_MSG_SESSION_CONTINUE
+
+Important notes:
+
+For a complete and detailed change log since the last release run:
+git log 2.6.1..2.7.0
+
 # 2022-03-07 Version 2.6.1
 
 Noteworthy changes:
-* Decreased logging verbosity, now freerdp is much less verbose by default
 
 Fixed issues:
 * Backported freerdp_abort_connect during freerdp_connect fix (#7700)
@@ -564,4 +776,3 @@ Virtual Channels:
 * rdpsnd (Sound Redirection)
 	* alsa support
 	* pulse support
-

channels/ainput/client/ainput_main.c

@@ -26,7 +26,7 @@
 #include <stdlib.h>
 
 #include <winpr/crt.h>
-#include <assert.h>
+#include <winpr/assert.h>
 #include <winpr/stream.h>
 #include <winpr/sysinfo.h>
 
@@ -37,8 +37,6 @@
 
 #include "../common/ainput_common.h"
 
-#define WINPR_ASSERT(x) assert(x)
-
 #define TAG CHANNELS_TAG("ainput.client")
 
 typedef struct AINPUT_CHANNEL_CALLBACK_ AINPUT_CHANNEL_CALLBACK;

channels/ainput/common/ainput_common.h

@@ -21,59 +21,37 @@
 #ifndef FREERDP_INT_AINPUT_COMMON_H
 #define FREERDP_INT_AINPUT_COMMON_H
 
-#include <assert.h>
 #include <winpr/string.h>
 
 #include <freerdp/channels/ainput.h>
 
-static INLINE void ainput_append(char* buffer, size_t size, const char* what, BOOL separator)
-{
-	size_t have;
-	size_t toadd;
-
-	assert(buffer || (size == 0));
-	assert(what);
-
-	have = strnlen(buffer, size);
-	toadd = strlen(what);
-	if (have > 0)
-		toadd += 1;
-
-	if (size - have < toadd + 1)
-		return;
-
-	if (have > 0)
-		strcat(buffer, separator ? "|" : " ");
-	strcat(buffer, what);
-}
-
 static INLINE const char* ainput_flags_to_string(UINT64 flags, char* buffer, size_t size)
 {
 	char number[32] = { 0 };
 
 	if (flags & AINPUT_FLAGS_HAVE_REL)
-		ainput_append(buffer, size, "AINPUT_FLAGS_HAVE_REL", TRUE);
+		winpr_str_append("AINPUT_FLAGS_HAVE_REL", buffer, size, "|");
 	if (flags & AINPUT_FLAGS_WHEEL)
-		ainput_append(buffer, size, "AINPUT_FLAGS_WHEEL", TRUE);
+		winpr_str_append("AINPUT_FLAGS_WHEEL", buffer, size, "|");
 	if (flags & AINPUT_FLAGS_MOVE)
-		ainput_append(buffer, size, "AINPUT_FLAGS_MOVE", TRUE);
+		winpr_str_append("AINPUT_FLAGS_MOVE", buffer, size, "|");
 	if (flags & AINPUT_FLAGS_DOWN)
-		ainput_append(buffer, size, "AINPUT_FLAGS_DOWN", TRUE);
+		winpr_str_append("AINPUT_FLAGS_DOWN", buffer, size, "|");
 	if (flags & AINPUT_FLAGS_REL)
-		ainput_append(buffer, size, "AINPUT_FLAGS_REL", TRUE);
+		winpr_str_append("AINPUT_FLAGS_REL", buffer, size, "|");
 	if (flags & AINPUT_FLAGS_BUTTON1)
-		ainput_append(buffer, size, "AINPUT_FLAGS_BUTTON1", TRUE);
+		winpr_str_append("AINPUT_FLAGS_BUTTON1", buffer, size, "|");
 	if (flags & AINPUT_FLAGS_BUTTON2)
-		ainput_append(buffer, size, "AINPUT_FLAGS_BUTTON2", TRUE);
+		winpr_str_append("AINPUT_FLAGS_BUTTON2", buffer, size, "|");
 	if (flags & AINPUT_FLAGS_BUTTON3)
-		ainput_append(buffer, size, "AINPUT_FLAGS_BUTTON3", TRUE);
+		winpr_str_append("AINPUT_FLAGS_BUTTON3", buffer, size, "|");
 	if (flags & AINPUT_XFLAGS_BUTTON1)
-		ainput_append(buffer, size, "AINPUT_XFLAGS_BUTTON1", TRUE);
+		winpr_str_append("AINPUT_XFLAGS_BUTTON1", buffer, size, "|");
 	if (flags & AINPUT_XFLAGS_BUTTON2)
-		ainput_append(buffer, size, "AINPUT_XFLAGS_BUTTON2", TRUE);
+		winpr_str_append("AINPUT_XFLAGS_BUTTON2", buffer, size, "|");
 
 	_snprintf(number, sizeof(number), "[0x%08" PRIx64 "]", flags);
-	ainput_append(buffer, size, number, FALSE);
+	winpr_str_append(number, buffer, size, " ");
 
 	return buffer;
 }

channels/ainput/server/ainput_main.c

@@ -27,11 +27,12 @@
 #include <string.h>
 
 #include <winpr/crt.h>
-#include <assert.h>
+#include <winpr/assert.h>
 #include <winpr/synch.h>
 #include <winpr/thread.h>
 #include <winpr/stream.h>
 #include <winpr/sysinfo.h>
+#include <winpr/stream.h>
 
 #include <freerdp/server/ainput.h>
 #include <freerdp/channels/ainput.h>
@@ -39,8 +40,6 @@
 
 #include "../common/ainput_common.h"
 
-#define WINPR_ASSERT(x) assert(x)
-
 #define TAG CHANNELS_TAG("ainput.server")
 
 typedef enum
@@ -123,16 +122,36 @@ static UINT ainput_server_open_channel(ainput_server* ainput)
 		ainput->ainput_channel = WTSVirtualChannelOpenEx(ainput->SessionId, AINPUT_DVC_CHANNEL_NAME,
 		                                                 WTS_CHANNEL_OPTION_DYNAMIC);
 
-		if (ainput->ainput_channel)
-			break;
-
 		Error = GetLastError();
 
 		if (Error == ERROR_NOT_FOUND)
+		{
+			WLog_DBG(TAG, "Channel %s not found", AINPUT_DVC_CHANNEL_NAME);
 			break;
+		}
+
+		if (ainput->ainput_channel)
+		{
+			UINT32 channelId;
+			BOOL status = TRUE;
+
+			channelId = WTSChannelGetIdByHandle(ainput->ainput_channel);
+
+			IFCALLRET(ainput->context.ChannelIdAssigned, status, &ainput->context, channelId);
+			if (!status)
+			{
+				WLog_ERR(TAG, "context->ChannelIdAssigned failed!");
+				return ERROR_INTERNAL_ERROR;
+			}
+
+			break;
+		}
 
 		if (GetTickCount() - StartTick > 5000)
+		{
+			WLog_WARN(TAG, "Timeout opening channel %s", AINPUT_DVC_CHANNEL_NAME);
 			break;
+		}
 	}
 
 	return ainput->ainput_channel ? CHANNEL_RC_OK : ERROR_INTERNAL_ERROR;
@@ -150,7 +169,10 @@ static UINT ainput_server_send_version(ainput_server* ainput)
 
 	Stream_SetPosition(s, 0);
 	if (!Stream_EnsureCapacity(s, 10))
+	{
+		WLog_WARN(TAG, "[%s] out of memory", AINPUT_DVC_CHANNEL_NAME);
 		return ERROR_OUTOFMEMORY;
+	}
 
 	Stream_Write_UINT16(s, MSG_AINPUT_VERSION);
 	Stream_Write_UINT32(s, AINPUT_VERSION_MAJOR); /* Version (4 bytes) */
@@ -177,7 +199,7 @@ static UINT ainput_server_recv_mouse_event(ainput_server* ainput, wStream* s)
 	WINPR_ASSERT(ainput);
 	WINPR_ASSERT(s);
 
-	if (Stream_GetRemainingLength(s) < 24)
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 24))
 		return ERROR_NO_DATA;
 
 	Stream_Read_UINT64(s, time);
@@ -239,9 +261,11 @@ static DWORD WINAPI ainput_server_thread_func(LPVOID arg)
 					case WAIT_OBJECT_0 + 1:
 					case WAIT_OBJECT_0:
 						error = ainput_server_context_poll_int(&ainput->context);
+						break;
 
 					case WAIT_FAILED:
 					default:
+						WLog_WARN(TAG, "[%s] Wait for open failed", AINPUT_DVC_CHANNEL_NAME);
 						error = ERROR_INTERNAL_ERROR;
 						break;
 				}
@@ -254,9 +278,10 @@ static DWORD WINAPI ainput_server_thread_func(LPVOID arg)
 					case WAIT_OBJECT_0 + 1:
 					case WAIT_OBJECT_0:
 						error = ainput_server_context_poll_int(&ainput->context);
-
+						break;
 					case WAIT_FAILED:
 					default:
+						WLog_WARN(TAG, "[%s] Wait for version failed", AINPUT_DVC_CHANNEL_NAME);
 						error = ERROR_INTERNAL_ERROR;
 						break;
 				}
@@ -410,7 +435,7 @@ static UINT ainput_process_message(ainput_server* ainput)
 {
 	BOOL rc;
 	UINT error = ERROR_INTERNAL_ERROR;
-	ULONG BytesReturned;
+	ULONG BytesReturned, ActualBytesReturned;
 	UINT16 MessageId;
 	wStream* s;
 
@@ -439,13 +464,20 @@ static UINT ainput_process_message(ainput_server* ainput)
 	}
 
 	if (WTSVirtualChannelRead(ainput->ainput_channel, 0, (PCHAR)Stream_Buffer(s),
-	                          (ULONG)Stream_Capacity(s), &BytesReturned) == FALSE)
+	                          (ULONG)Stream_Capacity(s), &ActualBytesReturned) == FALSE)
 	{
 		WLog_ERR(TAG, "WTSVirtualChannelRead failed!");
 		goto out;
 	}
 
-	Stream_SetLength(s, BytesReturned);
+	if (BytesReturned != ActualBytesReturned)
+	{
+		WLog_ERR(TAG, "WTSVirtualChannelRead size mismatch %" PRId32 ", expected %" PRId32,
+		         ActualBytesReturned, BytesReturned);
+		goto out;
+	}
+
+	Stream_SetLength(s, ActualBytesReturned);
 	Stream_Read_UINT16(s, MessageId);
 
 	switch (MessageId)
@@ -473,9 +505,15 @@ BOOL ainput_server_context_handle(ainput_server_context* context, HANDLE* handle
 	WINPR_ASSERT(handle);
 
 	if (!ainput->externalThread)
+	{
+		WLog_WARN(TAG, "[%s] externalThread fail!", AINPUT_DVC_CHANNEL_NAME);
 		return FALSE;
+	}
 	if (ainput->state == AINPUT_INITIAL)
+	{
+		WLog_WARN(TAG, "[%s] state fail!", AINPUT_DVC_CHANNEL_NAME);
 		return FALSE;
+	}
 	*handle = ainput_server_get_channel_handle(ainput);
 	return TRUE;
 }
@@ -541,6 +579,9 @@ UINT ainput_server_context_poll(ainput_server_context* context)
 
 	WINPR_ASSERT(ainput);
 	if (!ainput->externalThread)
+	{
+		WLog_WARN(TAG, "[%s] externalThread fail!", AINPUT_DVC_CHANNEL_NAME);
 		return ERROR_INTERNAL_ERROR;
+	}
 	return ainput_server_context_poll_int(context);
 }

channels/audin/client/alsa/audin_alsa.c

@@ -242,10 +242,6 @@ static BOOL audin_alsa_format_supported(IAudinDevice* device, const AUDIO_FORMAT
 
 			break;
 
-		case WAVE_FORMAT_ALAW:
-		case WAVE_FORMAT_MULAW:
-			return TRUE;
-
 		default:
 			return FALSE;
 	}

channels/audin/client/audin_main.c

@@ -43,13 +43,18 @@
 
 #include "audin_main.h"
 
-#define MSG_SNDIN_VERSION 0x01
-#define MSG_SNDIN_FORMATS 0x02
-#define MSG_SNDIN_OPEN 0x03
-#define MSG_SNDIN_OPEN_REPLY 0x04
-#define MSG_SNDIN_DATA_INCOMING 0x05
-#define MSG_SNDIN_DATA 0x06
-#define MSG_SNDIN_FORMATCHANGE 0x07
+#define SNDIN_VERSION 0x02
+
+enum
+{
+	MSG_SNDIN_VERSION = 0x01,
+	MSG_SNDIN_FORMATS = 0x02,
+	MSG_SNDIN_OPEN = 0x03,
+	MSG_SNDIN_OPEN_REPLY = 0x04,
+	MSG_SNDIN_DATA_INCOMING = 0x05,
+	MSG_SNDIN_DATA = 0x06,
+	MSG_SNDIN_FORMATCHANGE = 0x07
+} MSG_SNDIN_CMD;
 
 typedef struct _AUDIN_LISTENER_CALLBACK AUDIN_LISTENER_CALLBACK;
 struct _AUDIN_LISTENER_CALLBACK
@@ -105,6 +110,7 @@ struct _AUDIN_PLUGIN
 	IWTSListener* listener;
 
 	BOOL initialized;
+	UINT32 version;
 };
 
 static BOOL audin_process_addin_args(AUDIN_PLUGIN* audin, ADDIN_ARGV* args);
@@ -138,7 +144,7 @@ static UINT audin_channel_write_and_free(AUDIN_CHANNEL_CALLBACK* callback, wStre
 static UINT audin_process_version(AUDIN_PLUGIN* audin, AUDIN_CHANNEL_CALLBACK* callback, wStream* s)
 {
 	wStream* out;
-	const UINT32 ClientVersion = 0x01;
+	const UINT32 ClientVersion = SNDIN_VERSION;
 	UINT32 ServerVersion;
 
 	if (Stream_GetRemainingLength(s) < 4)
@@ -149,7 +155,7 @@ static UINT audin_process_version(AUDIN_PLUGIN* audin, AUDIN_CHANNEL_CALLBACK* c
 	           ServerVersion, ClientVersion);
 
 	/* Do not answer server packet, we do not support the channel version. */
-	if (ServerVersion != ClientVersion)
+	if (ServerVersion > ClientVersion)
 	{
 		WLog_Print(audin->log, WLOG_WARN,
 		           "Incompatible channel version server=%" PRIu32
@@ -157,6 +163,7 @@ static UINT audin_process_version(AUDIN_PLUGIN* audin, AUDIN_CHANNEL_CALLBACK* c
 		           ServerVersion, ClientVersion);
 		return CHANNEL_RC_OK;
 	}
+	audin->version = ServerVersion;
 
 	out = Stream_New(NULL, 5);
 

channels/audin/client/mac/audin_mac.m

@@ -154,12 +154,16 @@ static UINT audin_mac_set_format(IAudinDevice *device, const AUDIO_FORMAT *forma
 	if (format->wBitsPerSample == 0)
 		mac->audioFormat.mBitsPerChannel = 16;
 
-	mac->audioFormat.mBytesPerFrame = 0;
-	mac->audioFormat.mBytesPerPacket = 0;
 	mac->audioFormat.mChannelsPerFrame = mac->format.nChannels;
+	mac->audioFormat.mFramesPerPacket = 1;
+
+	mac->audioFormat.mBytesPerFrame =
+	    mac->audioFormat.mChannelsPerFrame * (mac->audioFormat.mBitsPerChannel / 8);
+	mac->audioFormat.mBytesPerPacket =
+	    mac->audioFormat.mBytesPerFrame * mac->audioFormat.mFramesPerPacket;
+
 	mac->audioFormat.mFormatFlags = audin_mac_get_flags_for_format(format);
 	mac->audioFormat.mFormatID = audin_mac_get_format(format);
-	mac->audioFormat.mFramesPerPacket = 1;
 	mac->audioFormat.mReserved = 0;
 	mac->audioFormat.mSampleRate = mac->format.nSamplesPerSec;
 	return CHANNEL_RC_OK;
@@ -423,32 +427,34 @@ UINT freerdp_audin_client_subsystem_entry(PFREERDP_AUDIN_DEVICE_ENTRY_POINTS pEn
 #if defined(MAC_OS_X_VERSION_10_14)
 	if (@available(macOS 10.14, *))
 	{
-		AVAuthorizationStatus status =
-		    [AVCaptureDevice authorizationStatusForMediaType:AVMediaTypeAudio];
-		switch (status)
-		{
-			case AVAuthorizationStatusAuthorized:
-				mac->isAuthorized = TRUE;
-				break;
-			case AVAuthorizationStatusNotDetermined:
-				[AVCaptureDevice requestAccessForMediaType:AVMediaTypeAudio
-				                         completionHandler:^(BOOL granted) {
-					                         if (granted == YES)
-					                         {
-						                         mac->isAuthorized = TRUE;
-					                         }
-					                         else
-						                         WLog_WARN(TAG, "Microphone access denied by user");
-				                         }];
-				break;
-			case AVAuthorizationStatusRestricted:
-				WLog_WARN(TAG, "Microphone access restricted by policy");
-				break;
-			case AVAuthorizationStatusDenied:
-				WLog_WARN(TAG, "Microphone access denied by policy");
-				break;
-			default:
-				break;
+		@autoreleasepool {
+			AVAuthorizationStatus status =
+				[AVCaptureDevice authorizationStatusForMediaType:AVMediaTypeAudio];
+			switch (status)
+			{
+				case AVAuthorizationStatusAuthorized:
+					mac->isAuthorized = TRUE;
+					break;
+				case AVAuthorizationStatusNotDetermined:
+					[AVCaptureDevice requestAccessForMediaType:AVMediaTypeAudio
+											 completionHandler:^(BOOL granted) {
+												 if (granted == YES)
+												 {
+													 mac->isAuthorized = TRUE;
+												 }
+												 else
+													 WLog_WARN(TAG, "Microphone access denied by user");
+											 }];
+					break;
+				case AVAuthorizationStatusRestricted:
+					WLog_WARN(TAG, "Microphone access restricted by policy");
+					break;
+				case AVAuthorizationStatusDenied:
+					WLog_WARN(TAG, "Microphone access denied by policy");
+					break;
+				default:
+					break;
+			}
 		}
 	}
 #endif

channels/audin/client/opensles/audin_opensl_es.c

@@ -215,7 +215,7 @@ static UINT audin_opensles_open(IAudinDevice* device, AudinReceive receive, void
 	opensles->user_data = user_data;
 	return CHANNEL_RC_OK;
 error_out:
-	audin_opensles_close(opensles);
+	audin_opensles_close(device);
 	return ERROR_INTERNAL_ERROR;
 }
 

channels/audin/client/oss/audin_oss.c

@@ -113,10 +113,6 @@ static BOOL audin_oss_format_supported(IAudinDevice* device, const AUDIO_FORMAT*
 
 			break;
 
-		case WAVE_FORMAT_ALAW:
-		case WAVE_FORMAT_MULAW:
-			return TRUE;
-
 		default:
 			return FALSE;
 	}

channels/audin/client/pulse/audin_pulse.c

@@ -236,17 +236,6 @@ static BOOL audin_pulse_format_supported(IAudinDevice* device, const AUDIO_FORMA
 
 			break;
 
-		case WAVE_FORMAT_ALAW:  /* A-LAW */
-		case WAVE_FORMAT_MULAW: /* U-LAW */
-			if (format->cbSize == 0 && (format->nSamplesPerSec <= PA_RATE_MAX) &&
-			    (format->wBitsPerSample == 8) &&
-			    (format->nChannels >= 1 && format->nChannels <= PA_CHANNELS_MAX))
-			{
-				return TRUE;
-			}
-
-			break;
-
 		default:
 			return FALSE;
 	}

channels/audin/server/audin.c

@@ -162,9 +162,6 @@ static UINT audin_server_send_formats(audin_server* audin, wStream* s)
 	for (i = 0; i < audin->context.num_server_formats; i++)
 	{
 		AUDIO_FORMAT format = audin->context.server_formats[i];
-		// TODO: Eliminate this
-		format.nAvgBytesPerSec =
-		    format.nSamplesPerSec * format.nChannels * format.wBitsPerSample / 8;
 
 		if (!audio_format_write(s, &format))
 		{
@@ -560,6 +557,8 @@ static BOOL audin_server_open(audin_server_context* context)
 		PULONG pSessionId = NULL;
 		DWORD BytesReturned = 0;
 		audin->SessionId = WTS_CURRENT_SESSION;
+		UINT32 channelId;
+		BOOL status = TRUE;
 
 		if (WTSQuerySessionInformationA(context->vcm, WTS_CURRENT_SESSION, WTSSessionId,
 		                                (LPSTR*)&pSessionId, &BytesReturned))
@@ -577,6 +576,15 @@ static BOOL audin_server_open(audin_server_context* context)
 			return FALSE;
 		}
 
+		channelId = WTSChannelGetIdByHandle(audin->audin_channel);
+
+		IFCALLRET(context->ChannelIdAssigned, status, context, channelId);
+		if (!status)
+		{
+			WLog_ERR(TAG, "context->ChannelIdAssigned failed!");
+			return ERROR_INTERNAL_ERROR;
+		}
+
 		if (!(audin->stopEvent = CreateEvent(NULL, TRUE, FALSE, NULL)))
 		{
 			WLog_ERR(TAG, "CreateEvent failed!");

channels/cliprdr/client/cliprdr_format.c

@@ -173,198 +173,3 @@ UINT cliprdr_process_format_data_response(cliprdrPlugin* cliprdr, wStream* s, UI
 
 	return error;
 }
-
-static UINT64 filetime_to_uint64(FILETIME value)
-{
-	UINT64 converted = 0;
-	converted |= (UINT32)value.dwHighDateTime;
-	converted <<= 32;
-	converted |= (UINT32)value.dwLowDateTime;
-	return converted;
-}
-
-static FILETIME uint64_to_filetime(UINT64 value)
-{
-	FILETIME converted;
-	converted.dwLowDateTime = (UINT32)(value >> 0);
-	converted.dwHighDateTime = (UINT32)(value >> 32);
-	return converted;
-}
-
-#define CLIPRDR_FILEDESCRIPTOR_SIZE (4 + 32 + 4 + 16 + 8 + 8 + 520)
-
-/**
- * Parse a packed file list.
- *
- * The resulting array must be freed with the `free()` function.
- *
- * @param [in]  format_data            packed `CLIPRDR_FILELIST` to parse.
- * @param [in]  format_data_length     length of `format_data` in bytes.
- * @param [out] file_descriptor_array  parsed array of `FILEDESCRIPTOR` structs.
- * @param [out] file_descriptor_count  number of elements in `file_descriptor_array`.
- *
- * @returns 0 on success, otherwise a Win32 error code.
- */
-UINT cliprdr_parse_file_list(const BYTE* format_data, UINT32 format_data_length,
-                             FILEDESCRIPTORW** file_descriptor_array, UINT32* file_descriptor_count)
-{
-	UINT result = NO_ERROR;
-	UINT32 i;
-	UINT32 count = 0;
-	wStream* s = NULL;
-
-	if (!format_data || !file_descriptor_array || !file_descriptor_count)
-		return ERROR_BAD_ARGUMENTS;
-
-	s = Stream_New((BYTE*)format_data, format_data_length);
-	if (!s)
-		return ERROR_NOT_ENOUGH_MEMORY;
-
-	if (Stream_GetRemainingLength(s) < 4)
-	{
-		WLog_ERR(TAG, "invalid packed file list");
-
-		result = ERROR_INCORRECT_SIZE;
-		goto out;
-	}
-
-	Stream_Read_UINT32(s, count); /* cItems (4 bytes) */
-
-	if (Stream_GetRemainingLength(s) / CLIPRDR_FILEDESCRIPTOR_SIZE < count)
-	{
-		WLog_ERR(TAG, "packed file list is too short: expected %" PRIuz ", have %" PRIuz,
-		         ((size_t)count) * CLIPRDR_FILEDESCRIPTOR_SIZE, Stream_GetRemainingLength(s));
-
-		result = ERROR_INCORRECT_SIZE;
-		goto out;
-	}
-
-	*file_descriptor_count = count;
-	*file_descriptor_array = calloc(count, sizeof(FILEDESCRIPTORW));
-	if (!*file_descriptor_array)
-	{
-		result = ERROR_NOT_ENOUGH_MEMORY;
-		goto out;
-	}
-
-	for (i = 0; i < count; i++)
-	{
-		int c;
-		UINT64 lastWriteTime;
-		FILEDESCRIPTORW* file = &((*file_descriptor_array)[i]);
-
-		Stream_Read_UINT32(s, file->dwFlags);          /* flags (4 bytes) */
-		Stream_Seek(s, 32);                            /* reserved1 (32 bytes) */
-		Stream_Read_UINT32(s, file->dwFileAttributes); /* fileAttributes (4 bytes) */
-		Stream_Seek(s, 16);                            /* reserved2 (16 bytes) */
-		Stream_Read_UINT64(s, lastWriteTime);          /* lastWriteTime (8 bytes) */
-		file->ftLastWriteTime = uint64_to_filetime(lastWriteTime);
-		Stream_Read_UINT32(s, file->nFileSizeHigh); /* fileSizeHigh (4 bytes) */
-		Stream_Read_UINT32(s, file->nFileSizeLow);  /* fileSizeLow (4 bytes) */
-		for (c = 0; c < 260; c++)                   /* cFileName (520 bytes) */
-			Stream_Read_UINT16(s, file->cFileName[c]);
-	}
-
-	if (Stream_GetRemainingLength(s) > 0)
-		WLog_WARN(TAG, "packed file list has %" PRIuz " excess bytes",
-		          Stream_GetRemainingLength(s));
-out:
-	Stream_Free(s, FALSE);
-
-	return result;
-}
-
-#define CLIPRDR_MAX_FILE_SIZE (2U * 1024 * 1024 * 1024)
-
-/**
- * Serialize a packed file list.
- *
- * The resulting format data must be freed with the `free()` function.
- *
- * @param [in]  file_descriptor_array  array of `FILEDESCRIPTOR` structs to serialize.
- * @param [in]  file_descriptor_count  number of elements in `file_descriptor_array`.
- * @param [out] format_data            serialized CLIPRDR_FILELIST.
- * @param [out] format_data_length     length of `format_data` in bytes.
- *
- * @returns 0 on success, otherwise a Win32 error code.
- */
-UINT cliprdr_serialize_file_list(const FILEDESCRIPTORW* file_descriptor_array,
-                                 UINT32 file_descriptor_count, BYTE** format_data,
-                                 UINT32* format_data_length)
-{
-	return cliprdr_serialize_file_list_ex(CB_STREAM_FILECLIP_ENABLED, file_descriptor_array,
-	                                      file_descriptor_count, format_data, format_data_length);
-}
-
-UINT cliprdr_serialize_file_list_ex(UINT32 flags, const FILEDESCRIPTORW* file_descriptor_array,
-                                    UINT32 file_descriptor_count, BYTE** format_data,
-                                    UINT32* format_data_length)
-{
-	UINT result = NO_ERROR;
-	UINT32 i;
-	wStream* s = NULL;
-
-	if (!file_descriptor_array || !format_data || !format_data_length)
-		return ERROR_BAD_ARGUMENTS;
-
-	if ((flags & CB_STREAM_FILECLIP_ENABLED) == 0)
-	{
-		WLog_WARN(TAG, "No file clipboard support annouonced!");
-		return ERROR_BAD_ARGUMENTS;
-	}
-
-	s = Stream_New(NULL, 4 + file_descriptor_count * CLIPRDR_FILEDESCRIPTOR_SIZE);
-	if (!s)
-		return ERROR_NOT_ENOUGH_MEMORY;
-
-	Stream_Write_UINT32(s, file_descriptor_count); /* cItems (4 bytes) */
-
-	for (i = 0; i < file_descriptor_count; i++)
-	{
-		int c;
-		UINT64 lastWriteTime;
-		const FILEDESCRIPTORW* file = &file_descriptor_array[i];
-
-		/*
-		 * There is a known issue with Windows server getting stuck in
-		 * an infinite loop when downloading files that are larger than
-		 * 2 gigabytes. Do not allow clients to send such file lists.
-		 *
-		 * https://support.microsoft.com/en-us/help/2258090
-		 */
-		if ((flags & CB_HUGE_FILE_SUPPORT_ENABLED) == 0)
-		{
-			if ((file->nFileSizeHigh > 0) || (file->nFileSizeLow >= CLIPRDR_MAX_FILE_SIZE))
-			{
-				WLog_ERR(TAG, "cliprdr does not support files over 2 GB");
-				result = ERROR_FILE_TOO_LARGE;
-				goto error;
-			}
-		}
-
-		Stream_Write_UINT32(s, file->dwFlags);          /* flags (4 bytes) */
-		Stream_Zero(s, 32);                             /* reserved1 (32 bytes) */
-		Stream_Write_UINT32(s, file->dwFileAttributes); /* fileAttributes (4 bytes) */
-		Stream_Zero(s, 16);                             /* reserved2 (16 bytes) */
-		lastWriteTime = filetime_to_uint64(file->ftLastWriteTime);
-		Stream_Write_UINT64(s, lastWriteTime);       /* lastWriteTime (8 bytes) */
-		Stream_Write_UINT32(s, file->nFileSizeHigh); /* fileSizeHigh (4 bytes) */
-		Stream_Write_UINT32(s, file->nFileSizeLow);  /* fileSizeLow (4 bytes) */
-		for (c = 0; c < 260; c++)                    /* cFileName (520 bytes) */
-			Stream_Write_UINT16(s, file->cFileName[c]);
-	}
-
-	Stream_SealLength(s);
-
-	Stream_GetBuffer(s, *format_data);
-	Stream_GetLength(s, *format_data_length);
-
-	Stream_Free(s, FALSE);
-
-	return result;
-
-error:
-	Stream_Free(s, TRUE);
-
-	return result;
-}

channels/cliprdr/cliprdr_common.c

@@ -138,7 +138,7 @@ cliprdr_packet_unlock_clipdata_new(const CLIPRDR_UNLOCK_CLIPBOARD_DATA* unlockCl
 	if (!unlockClipboardData)
 		return NULL;
 
-	s = cliprdr_packet_new(CB_LOCK_CLIPDATA, 0, 4);
+	s = cliprdr_packet_new(CB_UNLOCK_CLIPDATA, 0, 4);
 
 	if (!s)
 		return NULL;

channels/disp/server/disp_main.c

@@ -378,6 +378,8 @@ static UINT disp_server_open(DispServerContext* context)
 	void* buffer;
 	buffer = NULL;
 	priv->SessionId = WTS_CURRENT_SESSION;
+	UINT32 channelId;
+	BOOL status = TRUE;
 
 	if (WTSQuerySessionInformationA(context->vcm, WTS_CURRENT_SESSION, WTSSessionId,
 	                                (LPSTR*)&pSessionId, &BytesReturned) == FALSE)
@@ -399,6 +401,16 @@ static UINT disp_server_open(DispServerContext* context)
 		goto out_close;
 	}
 
+	channelId = WTSChannelGetIdByHandle(priv->disp_channel);
+
+	IFCALLRET(context->ChannelIdAssigned, status, context, channelId);
+	if (!status)
+	{
+		WLog_ERR(TAG, "context->ChannelIdAssigned failed!");
+		rc = ERROR_INTERNAL_ERROR;
+		goto out_close;
+	}
+
 	/* Query for channel event handle */
 	if (!WTSVirtualChannelQuery(priv->disp_channel, WTSVirtualEventHandle, &buffer,
 	                            &BytesReturned) ||

channels/drive/client/drive_file.c

@@ -61,10 +61,14 @@
 	} while (0)
 #endif
 
-static void drive_file_fix_path(WCHAR* path)
+static BOOL drive_file_fix_path(WCHAR* path, size_t length)
 {
 	size_t i;
-	size_t length = _wcslen(path);
+
+	if ((length == 0) || (length > UINT32_MAX))
+		return FALSE;
+
+	WINPR_ASSERT(path);
 
 	for (i = 0; i < length; i++)
 	{
@@ -75,58 +79,82 @@ static void drive_file_fix_path(WCHAR* path)
 #ifdef WIN32
 
 	if ((length == 3) && (path[1] == L':') && (path[2] == L'/'))
-		return;
+		return FALSE;
 
 #else
 
 	if ((length == 1) && (path[0] == L'/'))
-		return;
+		return FALSE;
 
 #endif
 
 	if ((length > 0) && (path[length - 1] == L'/'))
 		path[length - 1] = L'\0';
+
+	return TRUE;
 }
 
 static WCHAR* drive_file_combine_fullpath(const WCHAR* base_path, const WCHAR* path,
-                                          size_t PathLength)
+                                          size_t PathWCharLength)
 {
-	WCHAR* fullpath;
-	size_t base_path_length;
+	BOOL ok = FALSE;
+	WCHAR* fullpath = NULL;
+	size_t length;
 
-	if (!base_path || (!path && (PathLength > 0)))
-		return NULL;
+	if (!base_path || (!path && (PathWCharLength > 0)))
+		goto fail;
 
-	base_path_length = _wcslen(base_path) * 2;
-	fullpath = (WCHAR*)calloc(1, base_path_length + PathLength + sizeof(WCHAR));
+	const size_t base_path_length = _wcsnlen(base_path, MAX_PATH);
+	length = base_path_length + PathWCharLength + 1;
+	fullpath = (WCHAR*)calloc(length, sizeof(WCHAR));
 
 	if (!fullpath)
+		goto fail;
+
+	CopyMemory(fullpath, base_path, base_path_length * sizeof(WCHAR));
+	if (path)
+		CopyMemory(&fullpath[base_path_length], path, PathWCharLength * sizeof(WCHAR));
+
+	if (!drive_file_fix_path(fullpath, length))
+		goto fail;
+
+	/* Ensure the path does not contain sequences like '..' */
+	const WCHAR dotdot[] = { '.', '.', '\0' };
+	if (_wcsstr(&fullpath[base_path_length], dotdot))
 	{
-		WLog_ERR(TAG, "malloc failed!");
-		return NULL;
+		char abuffer[MAX_PATH] = { 0 };
+		ConvertFromUnicode(CP_UTF8, 0, &fullpath[base_path_length], -1, (char**)&abuffer,
+		                   ARRAYSIZE(abuffer) - 1, NULL, NULL);
+
+		WLog_WARN(TAG, "[rdpdr] received invalid file path '%s' from server, aborting!",
+		          &abuffer[base_path_length]);
+		goto fail;
 	}
 
-	CopyMemory(fullpath, base_path, base_path_length);
-	if (path)
-		CopyMemory((char*)fullpath + base_path_length, path, PathLength);
-	drive_file_fix_path(fullpath);
+	ok = TRUE;
+fail:
+	if (!ok)
+	{
+		free(fullpath);
+		fullpath = NULL;
+	}
 	return fullpath;
 }
 
 static BOOL drive_file_remove_dir(const WCHAR* path)
 {
-	WIN32_FIND_DATAW findFileData;
+	WIN32_FIND_DATAW findFileData = { 0 };
 	BOOL ret = TRUE;
-	HANDLE dir;
-	WCHAR* fullpath;
-	WCHAR* path_slash;
-	size_t base_path_length;
+	HANDLE dir = INVALID_HANDLE_VALUE;
+	WCHAR* fullpath = NULL;
+	WCHAR* path_slash = NULL;
+	size_t base_path_length = 0;
 
 	if (!path)
 		return FALSE;
 
-	base_path_length = _wcslen(path) * 2;
-	path_slash = (WCHAR*)calloc(1, base_path_length + sizeof(WCHAR) * 3);
+	base_path_length = _wcslen(path);
+	path_slash = (WCHAR*)calloc(base_path_length + 3, sizeof(WCHAR));
 
 	if (!path_slash)
 	{
@@ -134,12 +162,11 @@ static BOOL drive_file_remove_dir(const WCHAR* path)
 		return FALSE;
 	}
 
-	CopyMemory(path_slash, path, base_path_length);
-	path_slash[base_path_length / 2] = L'/';
-	path_slash[base_path_length / 2 + 1] = L'*';
+	CopyMemory(path_slash, path, base_path_length * sizeof(WCHAR));
+	path_slash[base_path_length] = L'/';
+	path_slash[base_path_length + 1] = L'*';
 	DEBUG_WSTR("Search in %s", path_slash);
 	dir = FindFirstFileW(path_slash, &findFileData);
-	path_slash[base_path_length / 2 + 1] = 0;
 
 	if (dir == INVALID_HANDLE_VALUE)
 	{
@@ -149,7 +176,7 @@ static BOOL drive_file_remove_dir(const WCHAR* path)
 
 	do
 	{
-		size_t len = _wcslen(findFileData.cFileName);
+		const size_t len = _wcsnlen(findFileData.cFileName, ARRAYSIZE(findFileData.cFileName));
 
 		if ((len == 1 && findFileData.cFileName[0] == L'.') ||
 		    (len == 2 && findFileData.cFileName[0] == L'.' && findFileData.cFileName[1] == L'.'))
@@ -157,7 +184,7 @@ static BOOL drive_file_remove_dir(const WCHAR* path)
 			continue;
 		}
 
-		fullpath = drive_file_combine_fullpath(path_slash, findFileData.cFileName, len * 2);
+		fullpath = drive_file_combine_fullpath(path_slash, findFileData.cFileName, len);
 		DEBUG_WSTR("Delete %s", fullpath);
 
 		if (findFileData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)
@@ -333,13 +360,13 @@ static BOOL drive_file_init(DRIVE_FILE* file)
 	return file->file_handle != INVALID_HANDLE_VALUE;
 }
 
-DRIVE_FILE* drive_file_new(const WCHAR* base_path, const WCHAR* path, UINT32 PathLength, UINT32 id,
-                           UINT32 DesiredAccess, UINT32 CreateDisposition, UINT32 CreateOptions,
-                           UINT32 FileAttributes, UINT32 SharedAccess)
+DRIVE_FILE* drive_file_new(const WCHAR* base_path, const WCHAR* path, UINT32 PathWCharLength,
+                           UINT32 id, UINT32 DesiredAccess, UINT32 CreateDisposition,
+                           UINT32 CreateOptions, UINT32 FileAttributes, UINT32 SharedAccess)
 {
 	DRIVE_FILE* file;
 
-	if (!base_path || (!path && (PathLength > 0)))
+	if (!base_path || (!path && (PathWCharLength > 0)))
 		return NULL;
 
 	file = (DRIVE_FILE*)calloc(1, sizeof(DRIVE_FILE));
@@ -359,7 +386,7 @@ DRIVE_FILE* drive_file_new(const WCHAR* base_path, const WCHAR* path, UINT32 Pat
 	file->CreateDisposition = CreateDisposition;
 	file->CreateOptions = CreateOptions;
 	file->SharedAccess = SharedAccess;
-	drive_file_set_fullpath(file, drive_file_combine_fullpath(base_path, path, PathLength));
+	drive_file_set_fullpath(file, drive_file_combine_fullpath(base_path, path, PathWCharLength));
 
 	if (!drive_file_init(file))
 	{
@@ -714,13 +741,10 @@ BOOL drive_file_set_information(DRIVE_FILE* file, UINT32 FsInformationClass, UIN
 				return FALSE;
 
 			fullpath = drive_file_combine_fullpath(file->basepath, (WCHAR*)Stream_Pointer(input),
-			                                       FileNameLength);
+			                                       FileNameLength / sizeof(WCHAR));
 
 			if (!fullpath)
-			{
-				WLog_ERR(TAG, "drive_file_combine_fullpath failed!");
 				return FALSE;
-			}
 
 #ifdef _WIN32
 
@@ -759,7 +783,7 @@ BOOL drive_file_set_information(DRIVE_FILE* file, UINT32 FsInformationClass, UIN
 }
 
 BOOL drive_file_query_directory(DRIVE_FILE* file, UINT32 FsInformationClass, BYTE InitialQuery,
-                                const WCHAR* path, UINT32 PathLength, wStream* output)
+                                const WCHAR* path, UINT32 PathWCharLength, wStream* output)
 {
 	size_t length;
 	WCHAR* ent_path;
@@ -773,7 +797,7 @@ BOOL drive_file_query_directory(DRIVE_FILE* file, UINT32 FsInformationClass, BYT
 		if (file->find_handle != INVALID_HANDLE_VALUE)
 			FindClose(file->find_handle);
 
-		ent_path = drive_file_combine_fullpath(file->basepath, path, PathLength);
+		ent_path = drive_file_combine_fullpath(file->basepath, path, PathWCharLength);
 		/* open new search handle and retrieve the first entry */
 		file->find_handle = FindFirstFileW(ent_path, &file->find_data);
 		free(ent_path);

channels/drive/client/drive_file.h

@@ -51,9 +51,9 @@ struct _DRIVE_FILE
 	UINT32 CreateOptions;
 };
 
-DRIVE_FILE* drive_file_new(const WCHAR* base_path, const WCHAR* path, UINT32 PathLength, UINT32 id,
-                           UINT32 DesiredAccess, UINT32 CreateDisposition, UINT32 CreateOptions,
-                           UINT32 FileAttributes, UINT32 SharedAccess);
+DRIVE_FILE* drive_file_new(const WCHAR* base_path, const WCHAR* path, UINT32 PathWCharLength,
+                           UINT32 id, UINT32 DesiredAccess, UINT32 CreateDisposition,
+                           UINT32 CreateOptions, UINT32 FileAttributes, UINT32 SharedAccess);
 BOOL drive_file_free(DRIVE_FILE* file);
 
 BOOL drive_file_open(DRIVE_FILE* file);
@@ -64,6 +64,6 @@ BOOL drive_file_query_information(DRIVE_FILE* file, UINT32 FsInformationClass, w
 BOOL drive_file_set_information(DRIVE_FILE* file, UINT32 FsInformationClass, UINT32 Length,
                                 wStream* input);
 BOOL drive_file_query_directory(DRIVE_FILE* file, UINT32 FsInformationClass, BYTE InitialQuery,
-                                const WCHAR* path, UINT32 PathLength, wStream* output);
+                                const WCHAR* path, UINT32 PathWCharLength, wStream* output);
 
 #endif /* FREERDP_CHANNEL_DRIVE_FILE_H */

channels/drive/client/drive_main.c

@@ -184,8 +184,8 @@ static UINT drive_process_irp_create(DRIVE_DEVICE* drive, IRP* irp)
 
 	path = (const WCHAR*)Stream_Pointer(irp->input);
 	FileId = irp->devman->id_sequence++;
-	file = drive_file_new(drive->path, path, PathLength, FileId, DesiredAccess, CreateDisposition,
-	                      CreateOptions, FileAttributes, SharedAccess);
+	file = drive_file_new(drive->path, path, PathLength / sizeof(WCHAR), FileId, DesiredAccess,
+	                      CreateDisposition, CreateOptions, FileAttributes, SharedAccess);
 
 	if (!file)
 	{
@@ -629,6 +629,9 @@ static UINT drive_process_irp_query_directory(DRIVE_DEVICE* drive, IRP* irp)
 	Stream_Read_UINT32(irp->input, PathLength);
 	Stream_Seek(irp->input, 23); /* Padding */
 	path = (WCHAR*)Stream_Pointer(irp->input);
+	if (!Stream_CheckAndLogRequiredLength(TAG, irp->input, PathLength))
+		return ERROR_INVALID_DATA;
+
 	file = drive_get_file_by_id(drive, irp->FileId);
 
 	if (file == NULL)
@@ -636,8 +639,8 @@ static UINT drive_process_irp_query_directory(DRIVE_DEVICE* drive, IRP* irp)
 		irp->IoStatus = STATUS_UNSUCCESSFUL;
 		Stream_Write_UINT32(irp->output, 0); /* Length */
 	}
-	else if (!drive_file_query_directory(file, FsInformationClass, InitialQuery, path, PathLength,
-	                                     irp->output))
+	else if (!drive_file_query_directory(file, FsInformationClass, InitialQuery, path,
+	                                     PathLength / sizeof(WCHAR), irp->output))
 	{
 		irp->IoStatus = drive_map_windows_err(GetLastError());
 	}

channels/echo/server/echo_main.c

@@ -91,7 +91,21 @@ static UINT echo_server_open_channel(echo_server* echo)
 		    WTSVirtualChannelOpenEx(echo->SessionId, "ECHO", WTS_CHANNEL_OPTION_DYNAMIC);
 
 		if (echo->echo_channel)
+		{
+			UINT32 channelId;
+			BOOL status = TRUE;
+
+			channelId = WTSChannelGetIdByHandle(echo->echo_channel);
+
+			IFCALLRET(echo->context.ChannelIdAssigned, status, &echo->context, channelId);
+			if (!status)
+			{
+				WLog_ERR(TAG, "context->ChannelIdAssigned failed!");
+				return ERROR_INTERNAL_ERROR;
+			}
+
 			break;
+		}
 
 		Error = GetLastError();
 

channels/parallel/client/parallel_main.c

@@ -159,7 +159,7 @@ static UINT parallel_process_irp_read(PARALLEL_DEVICE* parallel, IRP* irp)
 		return ERROR_INVALID_DATA;
 	Stream_Read_UINT32(irp->input, Length);
 	Stream_Read_UINT64(irp->input, Offset);
-	buffer = (BYTE*)malloc(Length);
+	buffer = (BYTE*)calloc(Length, sizeof(BYTE));
 
 	if (!buffer)
 	{
@@ -178,6 +178,7 @@ static UINT parallel_process_irp_read(PARALLEL_DEVICE* parallel, IRP* irp)
 	}
 	else
 	{
+		Length = status;
 	}
 
 	Stream_Write_UINT32(irp->output, Length);

channels/printer/client/cups/printer_cups.c

@@ -403,8 +403,8 @@ FREERDP_API rdpPrinterDriver* freerdp_printer_client_subsystem_entry(void)
 		uniq_cups_driver->driver.ReleaseRef = printer_cups_release_ref_driver;
 
 		uniq_cups_driver->id_sequence = 1;
-		uniq_cups_driver->driver.AddRef(&uniq_cups_driver->driver);
 	}
+	uniq_cups_driver->driver.AddRef(&uniq_cups_driver->driver);
 
 	return &uniq_cups_driver->driver;
 }

channels/printer/client/win/printer_win.c

@@ -452,8 +452,8 @@ FREERDP_API rdpPrinterDriver* freerdp_printer_client_subsystem_entry(void)
 		win_driver->driver.ReleaseRef = printer_win_release_ref_driver;
 
 		win_driver->id_sequence = 1;
-		win_driver->driver.AddRef(&win_driver->driver);
 	}
+	win_driver->driver.AddRef(&win_driver->driver);
 
 	return &win_driver->driver;
 }

channels/rail/client/rail_orders.c

@@ -32,6 +32,8 @@
 
 #include "rail_orders.h"
 
+static BOOL rail_is_feature_supported(const rdpContext* context, UINT32 featureMask);
+
 /**
  * Function description
  *
@@ -39,6 +41,7 @@
  */
 UINT rail_send_pdu(railPlugin* rail, wStream* s, UINT16 orderType)
 {
+	char buffer[128] = { 0 };
 	UINT16 orderLength;
 
 	if (!rail || !s)
@@ -49,7 +52,7 @@ UINT rail_send_pdu(railPlugin* rail, wStream* s, UINT16 orderType)
 	rail_write_pdu_header(s, orderType, orderLength);
 	Stream_SetPosition(s, orderLength);
 	WLog_Print(rail->log, WLOG_DEBUG, "Sending %s PDU, length: %" PRIu16 "",
-	           rail_get_order_type_string(orderType), orderLength);
+	           rail_get_order_type_string_full(orderType, buffer, sizeof(buffer)), orderLength);
 	return rail_send_channel_data(rail, s);
 }
 
@@ -388,7 +391,46 @@ static UINT rail_recv_handshake_order(railPlugin* rail, wStream* s)
 	return error;
 }
 
-static BOOL rail_is_feature_supported(const rdpContext* context, UINT32 featureMask)
+static UINT rail_read_compartment_info_order(wStream* s,
+                                             RAIL_COMPARTMENT_INFO_ORDER* compartmentInfo)
+{
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, RAIL_COMPARTMENT_INFO_ORDER_LENGTH))
+		return ERROR_INVALID_DATA;
+
+	Stream_Read_UINT32(s, compartmentInfo->ImeState);        /* ImeState (4 bytes) */
+	Stream_Read_UINT32(s, compartmentInfo->ImeConvMode);     /* ImeConvMode (4 bytes) */
+	Stream_Read_UINT32(s, compartmentInfo->ImeSentenceMode); /* ImeSentenceMode (4 bytes) */
+	Stream_Read_UINT32(s, compartmentInfo->KanaMode);        /* KANAMode (4 bytes) */
+	return CHANNEL_RC_OK;
+}
+
+static UINT rail_recv_compartmentinfo_order(railPlugin* rail, wStream* s)
+{
+	RailClientContext* context = rail_get_client_interface(rail);
+	RAIL_COMPARTMENT_INFO_ORDER pdu = { 0 };
+	UINT error;
+
+	if (!context || !s)
+		return ERROR_INVALID_PARAMETER;
+
+	if (!rail_is_feature_supported(rail->rdpcontext, RAIL_LEVEL_LANGUAGE_IME_SYNC_SUPPORTED))
+		return ERROR_BAD_CONFIGURATION;
+
+	if ((error = rail_read_compartment_info_order(s, &pdu)))
+		return error;
+
+	if (context->custom)
+	{
+		IFCALLRET(context->ClientCompartmentInfo, error, context, &pdu);
+
+		if (error)
+			WLog_ERR(TAG, "context.ClientCompartmentInfo failed with error %" PRIu32 "", error);
+	}
+
+	return error;
+}
+
+BOOL rail_is_feature_supported(const rdpContext* context, UINT32 featureMask)
 {
 	UINT32 supported, masked;
 
@@ -400,7 +442,15 @@ static BOOL rail_is_feature_supported(const rdpContext* context, UINT32 featureM
 	masked = (supported & featureMask);
 
 	if (masked != featureMask)
+	{
+		char mask[256] = { 0 };
+		char actual[256] = { 0 };
+
+		WLog_WARN(TAG, "[%s] have %s, require %s", __func__,
+		          freerdp_rail_support_flags_to_string(supported, actual, sizeof(actual)),
+		          freerdp_rail_support_flags_to_string(featureMask, mask, sizeof(mask)));
 		return FALSE;
+	}
 
 	return TRUE;
 }
@@ -904,6 +954,73 @@ static UINT rail_recv_get_application_id_extended_response_order(railPlugin* rai
 	return error;
 }
 
+static UINT rail_read_textscaleinfo_order(wStream* s, UINT32* pTextScaleFactor)
+{
+	WINPR_ASSERT(pTextScaleFactor);
+
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 4))
+		return ERROR_INVALID_DATA;
+
+	Stream_Read_UINT32(s, *pTextScaleFactor);
+	return CHANNEL_RC_OK;
+}
+
+static UINT rail_recv_textscaleinfo_order(railPlugin* rail, wStream* s)
+{
+	RailClientContext* context = rail_get_client_interface(rail);
+	UINT32 TextScaleFactor = 0;
+	UINT error;
+
+	if (!context)
+		return ERROR_INVALID_PARAMETER;
+
+	if ((error = rail_read_textscaleinfo_order(s, &TextScaleFactor)))
+		return error;
+
+	if (context->custom)
+	{
+		IFCALLRET(context->ClientTextScale, error, context, TextScaleFactor);
+
+		if (error)
+			WLog_ERR(TAG, "context.ClientTextScale failed with error %" PRIu32 "", error);
+	}
+
+	return error;
+}
+
+static UINT rail_read_caretblinkinfo_order(wStream* s, UINT32* pCaretBlinkRate)
+{
+	WINPR_ASSERT(pCaretBlinkRate);
+
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 4))
+		return ERROR_INVALID_DATA;
+
+	Stream_Read_UINT32(s, *pCaretBlinkRate);
+	return CHANNEL_RC_OK;
+}
+
+static UINT rail_recv_caretblinkinfo_order(railPlugin* rail, wStream* s)
+{
+	RailClientContext* context = rail_get_client_interface(rail);
+	UINT32 CaretBlinkRate = 0;
+	UINT error;
+
+	if (!context)
+		return ERROR_INVALID_PARAMETER;
+	if ((error = rail_read_caretblinkinfo_order(s, &CaretBlinkRate)))
+		return error;
+
+	if (context->custom)
+	{
+		IFCALLRET(context->ClientCaretBlinkRate, error, context, CaretBlinkRate);
+
+		if (error)
+			WLog_ERR(TAG, "context.ClientCaretBlinkRate failed with error %" PRIu32 "", error);
+	}
+
+	return error;
+}
+
 /**
  * Function description
  *
@@ -911,9 +1028,10 @@ static UINT rail_recv_get_application_id_extended_response_order(railPlugin* rai
  */
 UINT rail_order_recv(railPlugin* rail, wStream* s)
 {
+	char buffer[128] = { 0 };
 	UINT16 orderType;
 	UINT16 orderLength;
-	UINT error;
+	UINT error = CHANNEL_RC_OK;
 
 	if (!rail || !s)
 		return ERROR_INVALID_PARAMETER;
@@ -925,55 +1043,88 @@ UINT rail_order_recv(railPlugin* rail, wStream* s)
 	}
 
 	WLog_Print(rail->log, WLOG_DEBUG, "Received %s PDU, length:%" PRIu16 "",
-	           rail_get_order_type_string(orderType), orderLength);
+	           rail_get_order_type_string_full(orderType, buffer, sizeof(buffer)), orderLength);
 
 	switch (orderType)
 	{
 		case TS_RAIL_ORDER_HANDSHAKE:
-			return rail_recv_handshake_order(rail, s);
+			error = rail_recv_handshake_order(rail, s);
+			break;
+
+		case TS_RAIL_ORDER_COMPARTMENTINFO:
+			error = rail_recv_compartmentinfo_order(rail, s);
+			break;
 
 		case TS_RAIL_ORDER_HANDSHAKE_EX:
-			return rail_recv_handshake_ex_order(rail, s);
+			error = rail_recv_handshake_ex_order(rail, s);
+			break;
 
 		case TS_RAIL_ORDER_EXEC_RESULT:
-			return rail_recv_exec_result_order(rail, s);
+			error = rail_recv_exec_result_order(rail, s);
+			break;
 
 		case TS_RAIL_ORDER_SYSPARAM:
-			return rail_recv_server_sysparam_order(rail, s);
+			error = rail_recv_server_sysparam_order(rail, s);
+			break;
 
 		case TS_RAIL_ORDER_MINMAXINFO:
-			return rail_recv_server_minmaxinfo_order(rail, s);
+			error = rail_recv_server_minmaxinfo_order(rail, s);
+			break;
 
 		case TS_RAIL_ORDER_LOCALMOVESIZE:
-			return rail_recv_server_localmovesize_order(rail, s);
+			error = rail_recv_server_localmovesize_order(rail, s);
+			break;
 
 		case TS_RAIL_ORDER_GET_APPID_RESP:
-			return rail_recv_server_get_appid_resp_order(rail, s);
+			error = rail_recv_server_get_appid_resp_order(rail, s);
+			break;
 
 		case TS_RAIL_ORDER_LANGBARINFO:
-			return rail_recv_langbar_info_order(rail, s);
+			error = rail_recv_langbar_info_order(rail, s);
+			break;
 
 		case TS_RAIL_ORDER_TASKBARINFO:
-			return rail_recv_taskbar_info_order(rail, s);
+			error = rail_recv_taskbar_info_order(rail, s);
+			break;
 
 		case TS_RAIL_ORDER_ZORDER_SYNC:
-			return rail_recv_zorder_sync_order(rail, s);
+			error = rail_recv_zorder_sync_order(rail, s);
+			break;
 
 		case TS_RAIL_ORDER_CLOAK:
-			return rail_recv_cloak_order(rail, s);
+			error = rail_recv_cloak_order(rail, s);
+			break;
 
 		case TS_RAIL_ORDER_POWER_DISPLAY_REQUEST:
-			return rail_recv_power_display_request_order(rail, s);
+			error = rail_recv_power_display_request_order(rail, s);
+			break;
 
 		case TS_RAIL_ORDER_GET_APPID_RESP_EX:
-			return rail_recv_get_application_id_extended_response_order(rail, s);
+			error = rail_recv_get_application_id_extended_response_order(rail, s);
+			break;
+
+		case TS_RAIL_ORDER_TEXTSCALEINFO:
+			error = rail_recv_textscaleinfo_order(rail, s);
+			break;
+
+		case TS_RAIL_ORDER_CARETBLINKINFO:
+			error = rail_recv_caretblinkinfo_order(rail, s);
+			break;
 
 		default:
-			WLog_ERR(TAG, "Unknown RAIL PDU order reveived.");
+			WLog_ERR(TAG, "Unknown RAIL PDU %s received.",
+			         rail_get_order_type_string_full(orderType, buffer, sizeof(buffer)));
 			return ERROR_INVALID_DATA;
 	}
 
-	return CHANNEL_RC_OK;
+	if (error != CHANNEL_RC_OK)
+	{
+		char buffer[128] = { 0 };
+		WLog_Print(rail->log, WLOG_ERROR, "Failed to process rail %s PDU, length:%" PRIu16 "",
+		           rail_get_order_type_string_full(orderType, buffer, sizeof(buffer)), orderLength);
+	}
+
+	return error;
 }
 
 /**
@@ -1358,6 +1509,9 @@ UINT rail_send_client_compartment_info_order(railPlugin* rail,
 	if (!rail || !compartmentInfo)
 		return ERROR_INVALID_PARAMETER;
 
+	if (!rail_is_feature_supported(rail->rdpcontext, RAIL_LEVEL_LANGUAGE_IME_SYNC_SUPPORTED))
+		return ERROR_BAD_CONFIGURATION;
+
 	s = rail_pdu_init(RAIL_COMPARTMENT_INFO_ORDER_LENGTH);
 
 	if (!s)

channels/rail/rail_common.c

@@ -27,37 +27,72 @@
 
 #define TAG CHANNELS_TAG("rail.common")
 
-static const char* const RAIL_ORDER_TYPE_STRINGS[] = { "",
-	                                                   "Execute",
-	                                                   "Activate",
-	                                                   "System Parameters Update",
-	                                                   "System Command",
-	                                                   "Handshake",
-	                                                   "Notify Event",
-	                                                   "",
-	                                                   "Window Move",
-	                                                   "Local Move/Size",
-	                                                   "Min Max Info",
-	                                                   "Client Status",
-	                                                   "System Menu",
-	                                                   "Language Bar Info",
-	                                                   "Get Application ID Request",
-	                                                   "Get Application ID Response",
-	                                                   "Execute Result",
-	                                                   "",
-	                                                   "",
-	                                                   "",
-	                                                   "",
-	                                                   "",
-	                                                   "" };
-
 const char* rail_get_order_type_string(UINT16 orderType)
 {
-	UINT32 index = ((orderType & 0xF0) >> 3) + (orderType & 0x0F);
-	if (index >= ARRAYSIZE(RAIL_ORDER_TYPE_STRINGS))
-		return "UNKNOWN";
+	switch (orderType)
+	{
+		case TS_RAIL_ORDER_EXEC:
+			return "TS_RAIL_ORDER_EXEC";
+		case TS_RAIL_ORDER_ACTIVATE:
+			return "TS_RAIL_ORDER_ACTIVATE";
+		case TS_RAIL_ORDER_SYSPARAM:
+			return "TS_RAIL_ORDER_SYSPARAM";
+		case TS_RAIL_ORDER_SYSCOMMAND:
+			return "TS_RAIL_ORDER_SYSCOMMAND";
+		case TS_RAIL_ORDER_HANDSHAKE:
+			return "TS_RAIL_ORDER_HANDSHAKE";
+		case TS_RAIL_ORDER_NOTIFY_EVENT:
+			return "TS_RAIL_ORDER_NOTIFY_EVENT";
+		case TS_RAIL_ORDER_WINDOWMOVE:
+			return "TS_RAIL_ORDER_WINDOWMOVE";
+		case TS_RAIL_ORDER_LOCALMOVESIZE:
+			return "TS_RAIL_ORDER_LOCALMOVESIZE";
+		case TS_RAIL_ORDER_MINMAXINFO:
+			return "TS_RAIL_ORDER_MINMAXINFO";
+		case TS_RAIL_ORDER_CLIENTSTATUS:
+			return "TS_RAIL_ORDER_CLIENTSTATUS";
+		case TS_RAIL_ORDER_SYSMENU:
+			return "TS_RAIL_ORDER_SYSMENU";
+		case TS_RAIL_ORDER_LANGBARINFO:
+			return "TS_RAIL_ORDER_LANGBARINFO";
+		case TS_RAIL_ORDER_GET_APPID_REQ:
+			return "TS_RAIL_ORDER_GET_APPID_REQ";
+		case TS_RAIL_ORDER_GET_APPID_RESP:
+			return "TS_RAIL_ORDER_GET_APPID_RESP";
+		case TS_RAIL_ORDER_TASKBARINFO:
+			return "TS_RAIL_ORDER_TASKBARINFO";
+		case TS_RAIL_ORDER_LANGUAGEIMEINFO:
+			return "TS_RAIL_ORDER_LANGUAGEIMEINFO";
+		case TS_RAIL_ORDER_COMPARTMENTINFO:
+			return "TS_RAIL_ORDER_COMPARTMENTINFO";
+		case TS_RAIL_ORDER_HANDSHAKE_EX:
+			return "TS_RAIL_ORDER_HANDSHAKE_EX";
+		case TS_RAIL_ORDER_ZORDER_SYNC:
+			return "TS_RAIL_ORDER_ZORDER_SYNC";
+		case TS_RAIL_ORDER_CLOAK:
+			return "TS_RAIL_ORDER_CLOAK";
+		case TS_RAIL_ORDER_POWER_DISPLAY_REQUEST:
+			return "TS_RAIL_ORDER_POWER_DISPLAY_REQUEST";
+		case TS_RAIL_ORDER_SNAP_ARRANGE:
+			return "TS_RAIL_ORDER_SNAP_ARRANGE";
+		case TS_RAIL_ORDER_GET_APPID_RESP_EX:
+			return "TS_RAIL_ORDER_GET_APPID_RESP_EX";
+		case TS_RAIL_ORDER_EXEC_RESULT:
+			return "TS_RAIL_ORDER_EXEC_RESULT";
+		case TS_RAIL_ORDER_TEXTSCALEINFO:
+			return "TS_RAIL_ORDER_TEXTSCALEINFO";
+		case TS_RAIL_ORDER_CARETBLINKINFO:
+			return "TS_RAIL_ORDER_CARETBLINKINFO";
+		default:
+			return "TS_RAIL_ORDER_UNKNOWN";
+	}
+}
 
-	return RAIL_ORDER_TYPE_STRINGS[index];
+const char* rail_get_order_type_string_full(UINT16 orderType, char* buffer, size_t length)
+{
+	_snprintf(buffer, length, "%s[0x%04" PRIx16 "]", rail_get_order_type_string(orderType),
+	          orderType);
+	return buffer;
 }
 
 /**

channels/rail/rail_common.h

@@ -71,5 +71,6 @@ UINT rail_write_sysparam_order(wStream* s, const RAIL_SYSPARAM_ORDER* sysparam,
                                BOOL extendedSpiSupported);
 BOOL rail_is_extended_spi_supported(UINT32 channelsFlags);
 const char* rail_get_order_type_string(UINT16 orderType);
+const char* rail_get_order_type_string_full(UINT16 orderType, char* buffer, size_t length);
 
 #endif /* FREERDP_CHANNEL_RAIL_COMMON_H */

channels/rail/server/rail_main.c

@@ -62,6 +62,7 @@ static UINT rail_send(RailServerContext* context, wStream* s, ULONG length)
  */
 static UINT rail_server_send_pdu(RailServerContext* context, wStream* s, UINT16 orderType)
 {
+	char buffer[128] = { 0 };
 	UINT16 orderLength;
 
 	if (!context || !s)
@@ -71,8 +72,8 @@ static UINT rail_server_send_pdu(RailServerContext* context, wStream* s, UINT16
 	Stream_SetPosition(s, 0);
 	rail_write_pdu_header(s, orderType, orderLength);
 	Stream_SetPosition(s, orderLength);
-	WLog_DBG(TAG, "Sending %s PDU, length: %" PRIu16 "", rail_get_order_type_string(orderType),
-	         orderLength);
+	WLog_DBG(TAG, "Sending %s PDU, length: %" PRIu16 "",
+	         rail_get_order_type_string_full(orderType, buffer, sizeof(buffer)), orderLength);
 	return rail_send(context, s, orderLength);
 }
 
@@ -1535,6 +1536,7 @@ void rail_server_set_handshake_ex_flags(RailServerContext* context, DWORD flags)
 
 UINT rail_server_handle_messages(RailServerContext* context)
 {
+	char buffer[128] = { 0 };
 	UINT status = CHANNEL_RC_OK;
 	DWORD bytesReturned;
 	UINT16 orderType;
@@ -1584,8 +1586,8 @@ UINT rail_server_handle_messages(RailServerContext* context)
 		return ERROR_INTERNAL_ERROR;
 	}
 
-	WLog_DBG(TAG, "Received %s PDU, length:%" PRIu16 "", rail_get_order_type_string(orderType),
-	         orderLength);
+	WLog_DBG(TAG, "Received %s PDU, length:%" PRIu16 "",
+	         rail_get_order_type_string_full(orderType, buffer, sizeof(buffer)), orderLength);
 
 	switch (orderType)
 	{

channels/rdp2tcp/client/CMakeLists.txt

@@ -22,6 +22,6 @@ set(${MODULE_PREFIX}_SRCS
 
 add_channel_client_library(${MODULE_PREFIX} ${MODULE_NAME} ${CHANNEL_NAME} TRUE "VirtualChannelEntryEx")
 
-target_link_libraries(${MODULE_NAME} freerdp)
+target_link_libraries(${MODULE_NAME} winpr freerdp)
 
 set_property(TARGET ${MODULE_NAME} PROPERTY FOLDER "Channels/${CHANNEL_NAME}/Client")

channels/rdpdr/client/devman.c

@@ -41,6 +41,8 @@
 
 #include "devman.h"
 
+#define TAG CHANNELS_TAG("rdpdr.client")
+
 static void devman_device_free(void* obj)
 {
 	DEVICE* device = (DEVICE*)obj;
@@ -62,7 +64,7 @@ DEVMAN* devman_new(rdpdrPlugin* rdpdr)
 
 	if (!devman)
 	{
-		WLog_INFO(TAG, "calloc failed!");
+		WLog_Print(rdpdr->log, WLOG_INFO, "calloc failed!");
 		return NULL;
 	}
 
@@ -72,7 +74,7 @@ DEVMAN* devman_new(rdpdrPlugin* rdpdr)
 
 	if (!devman->devices)
 	{
-		WLog_INFO(TAG, "ListDictionary_New failed!");
+		WLog_Print(rdpdr->log, WLOG_INFO, "ListDictionary_New failed!");
 		free(devman);
 		return NULL;
 	}

channels/rdpdr/client/irp.c

@@ -76,13 +76,13 @@ static UINT irp_complete(IRP* irp)
 	return irp_free(irp);
 }
 
-IRP* irp_new(DEVMAN* devman, wStream* s, UINT* error)
+IRP* irp_new(DEVMAN* devman, wStream* s, wLog* log, UINT* error)
 {
 	IRP* irp;
 	DEVICE* device;
 	UINT32 DeviceId;
 
-	if (Stream_GetRemainingLength(s) < 20)
+	if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 20))
 	{
 		if (error)
 			*error = ERROR_INVALID_DATA;
@@ -94,7 +94,7 @@ IRP* irp_new(DEVMAN* devman, wStream* s, UINT* error)
 
 	if (!device)
 	{
-		WLog_WARN(TAG, "devman_get_device_by_id failed!");
+		WLog_Print(log, WLOG_WARN, "devman_get_device_by_id failed!");
 		if (error)
 			*error = CHANNEL_RC_OK;
 
@@ -105,7 +105,7 @@ IRP* irp_new(DEVMAN* devman, wStream* s, UINT* error)
 
 	if (!irp)
 	{
-		WLog_ERR(TAG, "_aligned_malloc failed!");
+		WLog_Print(log, WLOG_ERROR, "_aligned_malloc failed!");
 		if (error)
 			*error = CHANNEL_RC_NO_MEMORY;
 		return NULL;
@@ -125,7 +125,7 @@ IRP* irp_new(DEVMAN* devman, wStream* s, UINT* error)
 	irp->output = Stream_New(NULL, 256);
 	if (!irp->output)
 	{
-		WLog_ERR(TAG, "Stream_New failed!");
+		WLog_Print(log, WLOG_ERROR, "Stream_New failed!");
 		_aligned_free(irp);
 		if (error)
 			*error = CHANNEL_RC_NO_MEMORY;

channels/rdpdr/client/irp.h

@@ -21,8 +21,9 @@
 #ifndef FREERDP_CHANNEL_RDPDR_CLIENT_IRP_H
 #define FREERDP_CHANNEL_RDPDR_CLIENT_IRP_H
 
+#include <winpr/wlog.h>
 #include "rdpdr_main.h"
 
-IRP* irp_new(DEVMAN* devman, wStream* s, UINT* error);
+IRP* irp_new(DEVMAN* devman, wStream* s, wLog* log, UINT* error);
 
 #endif /* FREERDP_CHANNEL_RDPDR_CLIENT_IRP_H */

channels/rdpdr/client/rdpdr_capabilities.c

@@ -35,6 +35,8 @@
 #include "rdpdr_main.h"
 #include "rdpdr_capabilities.h"
 
+#define RDPDR_CAPABILITY_HEADER_LENGTH 8
+
 /* Output device redirection capability set header */
 static void rdpdr_write_capset_header(wStream* s, UINT16 capabilityType, UINT16 capabilityLength,
                                       UINT32 version)
@@ -48,39 +50,59 @@ static void rdpdr_write_capset_header(wStream* s, UINT16 capabilityType, UINT16
 static void rdpdr_write_general_capset(rdpdrPlugin* rdpdr, wStream* s)
 {
 	WINPR_UNUSED(rdpdr);
-	rdpdr_write_capset_header(s, CAP_GENERAL_TYPE, 44, GENERAL_CAPABILITY_VERSION_02);
-	Stream_Write_UINT32(s, 0); /* osType, ignored on receipt */
-	Stream_Write_UINT32(s, 0); /* osVersion, unused and must be set to zero */
-	Stream_Write_UINT16(s, 1); /* protocolMajorVersion, must be set to 1 */
-	Stream_Write_UINT16(s, RDPDR_MINOR_RDP_VERSION_5_2); /* protocolMinorVersion */
-	Stream_Write_UINT32(s, 0x0000FFFF);                  /* ioCode1 */
-	Stream_Write_UINT32(s, 0); /* ioCode2, must be set to zero, reserved for future use */
-	Stream_Write_UINT32(s, RDPDR_DEVICE_REMOVE_PDUS | RDPDR_CLIENT_DISPLAY_NAME_PDU |
-	                           RDPDR_USER_LOGGEDON_PDU); /* extendedPDU */
-	Stream_Write_UINT32(s, ENABLE_ASYNCIO);              /* extraFlags1 */
-	Stream_Write_UINT32(s, 0); /* extraFlags2, must be set to zero, reserved for future use */
+
+	const UINT32 ioCode1 = rdpdr->clientIOCode1 & rdpdr->serverIOCode1;
+	const UINT32 ioCode2 = rdpdr->clientIOCode2 & rdpdr->serverIOCode2;
+
+	rdpdr_write_capset_header(s, CAP_GENERAL_TYPE, RDPDR_CAPABILITY_HEADER_LENGTH + 36,
+	                          GENERAL_CAPABILITY_VERSION_02);
+	Stream_Write_UINT32(s, rdpdr->clientOsType);    /* osType, ignored on receipt */
+	Stream_Write_UINT32(s, rdpdr->clientOsVersion); /* osVersion, unused and must be set to zero */
+	Stream_Write_UINT16(s, rdpdr->clientVersionMajor); /* protocolMajorVersion, must be set to 1 */
+	Stream_Write_UINT16(s, rdpdr->clientVersionMinor); /* protocolMinorVersion */
+	Stream_Write_UINT32(s, ioCode1);                   /* ioCode1 */
+	Stream_Write_UINT32(s, ioCode2); /* ioCode2, must be set to zero, reserved for future use */
+	Stream_Write_UINT32(s, rdpdr->clientExtendedPDU); /* extendedPDU */
+	Stream_Write_UINT32(s, rdpdr->clientExtraFlags1); /* extraFlags1 */
 	Stream_Write_UINT32(
-	    s, 0); /* SpecialTypeDeviceCap, number of special devices to be redirected before logon */
+	    s,
+	    rdpdr->clientExtraFlags2); /* extraFlags2, must be set to zero, reserved for future use */
+	Stream_Write_UINT32(
+	    s, rdpdr->clientSpecialTypeDeviceCap); /* SpecialTypeDeviceCap, number of special devices to
+	                                              be redirected before logon */
 }
 
 /* Process device direction general capability set */
-static UINT rdpdr_process_general_capset(rdpdrPlugin* rdpdr, wStream* s)
+static UINT rdpdr_process_general_capset(rdpdrPlugin* rdpdr, wStream* s, UINT16 capabilityLength)
 {
-	UINT16 capabilityLength;
 	WINPR_UNUSED(rdpdr);
 
-	if (Stream_GetRemainingLength(s) < 2)
+	if (capabilityLength != 36)
+	{
+		WLog_Print(rdpdr->log, WLOG_ERROR,
+		           "CAP_GENERAL_TYPE::CapabilityLength expected 36, got %" PRIu32,
+		           capabilityLength);
+		return ERROR_INVALID_DATA;
+	}
+
+	if (!Stream_CheckAndLogRequiredLengthWLog(rdpdr->log, s, capabilityLength))
 		return ERROR_INVALID_DATA;
 
-	Stream_Read_UINT16(s, capabilityLength);
-
-	if (capabilityLength < 4)
-		return ERROR_INVALID_DATA;
-
-	if (Stream_GetRemainingLength(s) < capabilityLength - 4U)
-		return ERROR_INVALID_DATA;
-
-	Stream_Seek(s, capabilityLength - 4U);
+	Stream_Read_UINT32(s, rdpdr->serverOsType);    /* osType, ignored on receipt */
+	Stream_Read_UINT32(s, rdpdr->serverOsVersion); /* osVersion, unused and must be set to zero */
+	Stream_Read_UINT16(s, rdpdr->serverVersionMajor); /* protocolMajorVersion, must be set to 1 */
+	Stream_Read_UINT16(s, rdpdr->serverVersionMinor); /* protocolMinorVersion */
+	Stream_Read_UINT32(s, rdpdr->serverIOCode1);      /* ioCode1 */
+	Stream_Read_UINT32(
+	    s, rdpdr->serverIOCode2); /* ioCode2, must be set to zero, reserved for future use */
+	Stream_Read_UINT32(s, rdpdr->serverExtendedPDU); /* extendedPDU */
+	Stream_Read_UINT32(s, rdpdr->serverExtraFlags1); /* extraFlags1 */
+	Stream_Read_UINT32(
+	    s,
+	    rdpdr->serverExtraFlags2); /* extraFlags2, must be set to zero, reserved for future use */
+	Stream_Read_UINT32(
+	    s, rdpdr->serverSpecialTypeDeviceCap); /* SpecialTypeDeviceCap, number of special devices to
+	                                              be redirected before logon */
 	return CHANNEL_RC_OK;
 }
 
@@ -92,23 +114,14 @@ static void rdpdr_write_printer_capset(rdpdrPlugin* rdpdr, wStream* s)
 }
 
 /* Process printer direction capability set */
-static UINT rdpdr_process_printer_capset(rdpdrPlugin* rdpdr, wStream* s)
+static UINT rdpdr_process_printer_capset(rdpdrPlugin* rdpdr, wStream* s, UINT16 capabilityLength)
 {
-	UINT16 capabilityLength;
 	WINPR_UNUSED(rdpdr);
 
-	if (Stream_GetRemainingLength(s) < 2)
+	if (!Stream_CheckAndLogRequiredLengthWLog(rdpdr->log, s, capabilityLength))
 		return ERROR_INVALID_DATA;
 
-	Stream_Read_UINT16(s, capabilityLength);
-
-	if (capabilityLength < 4)
-		return ERROR_INVALID_DATA;
-
-	if (Stream_GetRemainingLength(s) < capabilityLength - 4U)
-		return ERROR_INVALID_DATA;
-
-	Stream_Seek(s, capabilityLength - 4U);
+	Stream_Seek(s, capabilityLength);
 	return CHANNEL_RC_OK;
 }
 
@@ -120,23 +133,14 @@ static void rdpdr_write_port_capset(rdpdrPlugin* rdpdr, wStream* s)
 }
 
 /* Process port redirection capability set */
-static UINT rdpdr_process_port_capset(rdpdrPlugin* rdpdr, wStream* s)
+static UINT rdpdr_process_port_capset(rdpdrPlugin* rdpdr, wStream* s, UINT16 capabilityLength)
 {
-	UINT16 capabilityLength;
 	WINPR_UNUSED(rdpdr);
 
-	if (Stream_GetRemainingLength(s) < 2)
+	if (!Stream_CheckAndLogRequiredLengthWLog(rdpdr->log, s, capabilityLength))
 		return ERROR_INVALID_DATA;
 
-	Stream_Read_UINT16(s, capabilityLength);
-
-	if (capabilityLength < 4U)
-		return ERROR_INVALID_DATA;
-
-	if (Stream_GetRemainingLength(s) < capabilityLength - 4U)
-		return ERROR_INVALID_DATA;
-
-	Stream_Seek(s, capabilityLength - 4U);
+	Stream_Seek(s, capabilityLength);
 	return CHANNEL_RC_OK;
 }
 
@@ -148,23 +152,14 @@ static void rdpdr_write_drive_capset(rdpdrPlugin* rdpdr, wStream* s)
 }
 
 /* Process drive redirection capability set */
-static UINT rdpdr_process_drive_capset(rdpdrPlugin* rdpdr, wStream* s)
+static UINT rdpdr_process_drive_capset(rdpdrPlugin* rdpdr, wStream* s, UINT16 capabilityLength)
 {
-	UINT16 capabilityLength;
 	WINPR_UNUSED(rdpdr);
 
-	if (Stream_GetRemainingLength(s) < 2)
+	if (!Stream_CheckAndLogRequiredLengthWLog(rdpdr->log, s, capabilityLength))
 		return ERROR_INVALID_DATA;
 
-	Stream_Read_UINT16(s, capabilityLength);
-
-	if (capabilityLength < 4)
-		return ERROR_INVALID_DATA;
-
-	if (Stream_GetRemainingLength(s) < capabilityLength - 4U)
-		return ERROR_INVALID_DATA;
-
-	Stream_Seek(s, capabilityLength - 4U);
+	Stream_Seek(s, capabilityLength);
 	return CHANNEL_RC_OK;
 }
 
@@ -176,23 +171,14 @@ static void rdpdr_write_smartcard_capset(rdpdrPlugin* rdpdr, wStream* s)
 }
 
 /* Process smartcard redirection capability set */
-static UINT rdpdr_process_smartcard_capset(rdpdrPlugin* rdpdr, wStream* s)
+static UINT rdpdr_process_smartcard_capset(rdpdrPlugin* rdpdr, wStream* s, UINT16 capabilityLength)
 {
-	UINT16 capabilityLength;
 	WINPR_UNUSED(rdpdr);
 
-	if (Stream_GetRemainingLength(s) < 2)
+	if (!Stream_CheckAndLogRequiredLengthWLog(rdpdr->log, s, capabilityLength))
 		return ERROR_INVALID_DATA;
 
-	Stream_Read_UINT16(s, capabilityLength);
-
-	if (capabilityLength < 4)
-		return ERROR_INVALID_DATA;
-
-	if (Stream_GetRemainingLength(s) < capabilityLength - 4U)
-		return ERROR_INVALID_DATA;
-
-	Stream_Seek(s, capabilityLength - 4U);
+	Stream_Seek(s, capabilityLength);
 	return CHANNEL_RC_OK;
 }
 
@@ -201,12 +187,14 @@ UINT rdpdr_process_capability_request(rdpdrPlugin* rdpdr, wStream* s)
 	UINT status = CHANNEL_RC_OK;
 	UINT16 i;
 	UINT16 numCapabilities;
-	UINT16 capabilityType;
 
 	if (!rdpdr || !s)
 		return CHANNEL_RC_NULL_DATA;
 
-	if (Stream_GetRemainingLength(s) < 4)
+	WINPR_ASSERT(rdpdr->state == RDPDR_CHANNEL_STATE_SERVER_CAPS);
+	rdpdr_state_advance(rdpdr, RDPDR_CHANNEL_STATE_CLIENT_CAPS);
+
+	if (!Stream_CheckAndLogRequiredLengthWLog(rdpdr->log, s, 4))
 		return ERROR_INVALID_DATA;
 
 	Stream_Read_UINT16(s, numCapabilities);
@@ -214,31 +202,44 @@ UINT rdpdr_process_capability_request(rdpdrPlugin* rdpdr, wStream* s)
 
 	for (i = 0; i < numCapabilities; i++)
 	{
-		if (Stream_GetRemainingLength(s) < sizeof(UINT16))
+		UINT16 capabilityType;
+		UINT16 capabilityLength;
+		UINT32 version = 0;
+
+		if (!Stream_CheckAndLogRequiredLengthWLog(rdpdr->log, s,
+		                                          2 * sizeof(UINT16) + sizeof(UINT32)))
 			return ERROR_INVALID_DATA;
 
 		Stream_Read_UINT16(s, capabilityType);
+		Stream_Read_UINT16(s, capabilityLength);
+		Stream_Read_UINT32(s, version);
+
+		if (capabilityLength < 8)
+		{
+			return ERROR_INVALID_DATA;
+		}
+		capabilityLength -= 8;
 
 		switch (capabilityType)
 		{
 			case CAP_GENERAL_TYPE:
-				status = rdpdr_process_general_capset(rdpdr, s);
+				status = rdpdr_process_general_capset(rdpdr, s, capabilityLength);
 				break;
 
 			case CAP_PRINTER_TYPE:
-				status = rdpdr_process_printer_capset(rdpdr, s);
+				status = rdpdr_process_printer_capset(rdpdr, s, capabilityLength);
 				break;
 
 			case CAP_PORT_TYPE:
-				status = rdpdr_process_port_capset(rdpdr, s);
+				status = rdpdr_process_port_capset(rdpdr, s, capabilityLength);
 				break;
 
 			case CAP_DRIVE_TYPE:
-				status = rdpdr_process_drive_capset(rdpdr, s);
+				status = rdpdr_process_drive_capset(rdpdr, s, capabilityLength);
 				break;
 
 			case CAP_SMARTCARD_TYPE:
-				status = rdpdr_process_smartcard_capset(rdpdr, s);
+				status = rdpdr_process_smartcard_capset(rdpdr, s, capabilityLength);
 				break;
 
 			default:
@@ -264,7 +265,7 @@ UINT rdpdr_send_capability_response(rdpdrPlugin* rdpdr)
 
 	if (!s)
 	{
-		WLog_ERR(TAG, "Stream_New failed!");
+		WLog_Print(rdpdr->log, WLOG_ERROR, "Stream_New failed!");
 		return CHANNEL_RC_NO_MEMORY;
 	}
 

channels/rdpdr/client/rdpdr_main.h

@@ -42,15 +42,33 @@
 #include <CoreServices/CoreServices.h>
 #endif
 
-#define TAG CHANNELS_TAG("rdpdr.client")
+#if !defined(Stream_CheckAndLogRequiredLengthWLog)
+#define Stream_CheckAndLogRequiredLengthWLog(log, s, len)                                     \
+	Stream_CheckAndLogRequiredLengthWLogEx(log, WLOG_WARN, s, len, "%s(%s:%d)", __FUNCTION__, \
+	                                       __FILE__, __LINE__)
+#endif
 
 typedef struct rdpdr_plugin rdpdrPlugin;
 
+enum RDPDR_CHANNEL_STATE
+{
+	RDPDR_CHANNEL_STATE_INITIAL = 0,
+	RDPDR_CHANNEL_STATE_ANNOUNCE,
+	RDPDR_CHANNEL_STATE_ANNOUNCE_REPLY,
+	RDPDR_CHANNEL_STATE_NAME_REQUEST,
+	RDPDR_CHANNEL_STATE_SERVER_CAPS,
+	RDPDR_CHANNEL_STATE_CLIENT_CAPS,
+	RDPDR_CHANNEL_STATE_CLIENTID_CONFIRM,
+	RDPDR_CHANNEL_STATE_READY,
+	RDPDR_CHANNEL_STATE_USER_LOGGEDON
+};
+
 struct rdpdr_plugin
 {
 	CHANNEL_DEF channelDef;
 	CHANNEL_ENTRY_POINTS_FREERDP_EX channelEntryPoints;
 
+	enum RDPDR_CHANNEL_STATE state;
 	HANDLE thread;
 	wStream* data_in;
 	void* InitHandle;
@@ -59,12 +77,33 @@ struct rdpdr_plugin
 
 	DEVMAN* devman;
 
-	UINT16 versionMajor;
-	UINT16 versionMinor;
-	UINT16 clientID;
+	UINT32 serverOsType;
+	UINT32 serverOsVersion;
+	UINT16 serverVersionMajor;
+	UINT16 serverVersionMinor;
+	UINT32 serverExtendedPDU;
+	UINT32 serverIOCode1;
+	UINT32 serverIOCode2;
+	UINT32 serverExtraFlags1;
+	UINT32 serverExtraFlags2;
+	UINT32 serverSpecialTypeDeviceCap;
+
+	UINT32 clientOsType;
+	UINT32 clientOsVersion;
+	UINT16 clientVersionMajor;
+	UINT16 clientVersionMinor;
+	UINT32 clientExtendedPDU;
+	UINT32 clientIOCode1;
+	UINT32 clientIOCode2;
+	UINT32 clientExtraFlags1;
+	UINT32 clientExtraFlags2;
+	UINT32 clientSpecialTypeDeviceCap;
+
+	UINT32 clientID;
 	char computerName[256];
 
 	UINT32 sequenceId;
+	BOOL userLoggedOn;
 
 	/* hotplug support */
 	HANDLE hotplugThread;
@@ -78,8 +117,10 @@ struct rdpdr_plugin
 	HANDLE stopEvent;
 #endif
 	rdpContext* rdpcontext;
+	wLog* log;
 };
 
+BOOL rdpdr_state_advance(rdpdrPlugin* rdpdr, enum RDPDR_CHANNEL_STATE next);
 UINT rdpdr_send(rdpdrPlugin* rdpdr, wStream* s);
 
 #endif /* FREERDP_CHANNEL_RDPDR_CLIENT_MAIN_H */

channels/rdpdr/server/rdpdr_main.c

@@ -1952,7 +1952,7 @@ static UINT rdpdr_server_drive_query_directory_callback1(RdpdrServerContext* con
 	irp->Callback = rdpdr_server_drive_query_directory_callback2;
 	irp->DeviceId = deviceId;
 	irp->FileId = fileId;
-	strcat(irp->PathName, "\\*.*");
+	winpr_str_append("\\*.*", irp->PathName, ARRAYSIZE(irp->PathName), NULL);
 
 	if (!rdpdr_server_enqueue_irp(context, irp))
 	{

channels/rdpdr/server/rdpdr_main.h

@@ -57,13 +57,6 @@ struct _RDPDR_HEADER
 };
 typedef struct _RDPDR_HEADER RDPDR_HEADER;
 
-#define RDPDR_VERSION_MAJOR 0x0001
-
-#define RDPDR_VERSION_MINOR_RDP50 0x0002
-#define RDPDR_VERSION_MINOR_RDP51 0x0005
-#define RDPDR_VERSION_MINOR_RDP52 0x000A
-#define RDPDR_VERSION_MINOR_RDP6X 0x000C
-
 #define RDPDR_CAPABILITY_HEADER_LENGTH 8
 
 struct _RDPDR_CAPABILITY_HEADER

channels/rdpecam/CMakeLists.txt

@@ -0,0 +1,22 @@
+# FreeRDP: A Remote Desktop Protocol Implementation
+# FreeRDP cmake build script
+#
+# Copyright 2022 Pascal Nowack <Pascal.Nowack@gmx.de>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+define_channel("rdpecam")
+
+if(WITH_SERVER_CHANNELS)
+	add_channel_server(${MODULE_PREFIX} ${CHANNEL_NAME})
+endif()

channels/rdpecam/ChannelOptions.cmake

@@ -0,0 +1,12 @@
+
+set(OPTION_DEFAULT ON)
+set(OPTION_CLIENT_DEFAULT OFF)
+set(OPTION_SERVER_DEFAULT ON)
+
+define_channel_options(NAME "rdpecam" TYPE "dynamic"
+	DESCRIPTION "Video Capture Virtual Channel Extension"
+	SPECIFICATIONS "[MS-RDPECAM]"
+	DEFAULT ${OPTION_DEFAULT})
+
+define_channel_server_options(${OPTION_SERVER_DEFAULT})
+

channels/rdpecam/server/CMakeLists.txt

@@ -0,0 +1,27 @@
+# FreeRDP: A Remote Desktop Protocol Implementation
+# FreeRDP cmake build script
+#
+# Copyright 2022 Pascal Nowack <Pascal.Nowack@gmx.de>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+define_channel_server("rdpecam")
+
+set(${MODULE_PREFIX}_SRCS
+	camera_device_enumerator_main.c
+	camera_device_main.c)
+
+add_channel_server_library(${MODULE_PREFIX} ${MODULE_NAME} ${CHANNEL_NAME} FALSE "DVCPluginEntry")
+
+target_link_libraries(${MODULE_NAME} freerdp)
+set_property(TARGET ${MODULE_NAME} PROPERTY FOLDER "Channels/${CHANNEL_NAME}/Server")

channels/rdpecam/server/camera_device_enumerator_main.c

@@ -0,0 +1,612 @@
+/**
+ * FreeRDP: A Remote Desktop Protocol Implementation
+ * Video Capture Virtual Channel Extension
+ *
+ * Copyright 2022 Pascal Nowack <Pascal.Nowack@gmx.de>
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *	 http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <freerdp/channels/log.h>
+#include <freerdp/server/rdpecam-enumerator.h>
+
+#define TAG CHANNELS_TAG("rdpecam-enumerator.server")
+
+typedef enum
+{
+	ENUMERATOR_INITIAL,
+	ENUMERATOR_OPENED,
+} eEnumeratorChannelState;
+
+typedef struct
+{
+	CamDevEnumServerContext context;
+
+	HANDLE stopEvent;
+
+	HANDLE thread;
+	void* enumerator_channel;
+
+	DWORD SessionId;
+
+	BOOL isOpened;
+	BOOL externalThread;
+
+	/* Channel state */
+	eEnumeratorChannelState state;
+
+	wStream* buffer;
+} enumerator_server;
+
+static UINT enumerator_server_initialize(CamDevEnumServerContext* context, BOOL externalThread)
+{
+	UINT error = CHANNEL_RC_OK;
+	enumerator_server* enumerator = (enumerator_server*)context;
+
+	WINPR_ASSERT(enumerator);
+
+	if (enumerator->isOpened)
+	{
+		WLog_WARN(TAG, "Application error: Camera Device Enumerator channel already initialized, "
+		               "calling in this state is not possible!");
+		return ERROR_INVALID_STATE;
+	}
+
+	enumerator->externalThread = externalThread;
+
+	return error;
+}
+
+static UINT enumerator_server_open_channel(enumerator_server* enumerator)
+{
+	CamDevEnumServerContext* context = &enumerator->context;
+	DWORD Error = ERROR_SUCCESS;
+	HANDLE hEvent;
+	DWORD BytesReturned = 0;
+	PULONG pSessionId = NULL;
+	UINT32 channelId;
+	BOOL status = TRUE;
+
+	WINPR_ASSERT(enumerator);
+
+	if (WTSQuerySessionInformationA(enumerator->context.vcm, WTS_CURRENT_SESSION, WTSSessionId,
+	                                (LPSTR*)&pSessionId, &BytesReturned) == FALSE)
+	{
+		WLog_ERR(TAG, "WTSQuerySessionInformationA failed!");
+		return ERROR_INTERNAL_ERROR;
+	}
+
+	enumerator->SessionId = (DWORD)*pSessionId;
+	WTSFreeMemory(pSessionId);
+	hEvent = WTSVirtualChannelManagerGetEventHandle(enumerator->context.vcm);
+
+	if (WaitForSingleObject(hEvent, 1000) == WAIT_FAILED)
+	{
+		Error = GetLastError();
+		WLog_ERR(TAG, "WaitForSingleObject failed with error %" PRIu32 "!", Error);
+		return Error;
+	}
+
+	enumerator->enumerator_channel = WTSVirtualChannelOpenEx(
+	    enumerator->SessionId, RDPECAM_CONTROL_DVC_CHANNEL_NAME, WTS_CHANNEL_OPTION_DYNAMIC);
+	if (!enumerator->enumerator_channel)
+	{
+		Error = GetLastError();
+		WLog_ERR(TAG, "WTSVirtualChannelOpenEx failed with error %" PRIu32 "!", Error);
+		return Error;
+	}
+
+	channelId = WTSChannelGetIdByHandle(enumerator->enumerator_channel);
+
+	IFCALLRET(context->ChannelIdAssigned, status, context, channelId);
+	if (!status)
+	{
+		WLog_ERR(TAG, "context->ChannelIdAssigned failed!");
+		return ERROR_INTERNAL_ERROR;
+	}
+
+	return Error;
+}
+
+static UINT enumerator_server_handle_select_version_request(CamDevEnumServerContext* context,
+                                                            wStream* s,
+                                                            const CAM_SHARED_MSG_HEADER* header)
+{
+	CAM_SELECT_VERSION_REQUEST pdu = { 0 };
+	UINT error = CHANNEL_RC_OK;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(header);
+
+	pdu.Header = *header;
+
+	IFCALLRET(context->SelectVersionRequest, error, context, &pdu);
+	if (error)
+		WLog_ERR(TAG, "context->SelectVersionRequest failed with error %" PRIu32 "", error);
+
+	return error;
+}
+
+static UINT enumerator_server_recv_device_added_notification(CamDevEnumServerContext* context,
+                                                             wStream* s,
+                                                             const CAM_SHARED_MSG_HEADER* header)
+{
+	CAM_DEVICE_ADDED_NOTIFICATION pdu;
+	UINT error = CHANNEL_RC_OK;
+	size_t remaining_length;
+	WCHAR* channel_name_start;
+	char* tmp;
+	size_t i;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(header);
+
+	pdu.Header = *header;
+
+	/*
+	 * RequiredLength 4:
+	 *
+	 * Nullterminator DeviceName (2),
+	 * VirtualChannelName (>= 1),
+	 * Nullterminator VirtualChannelName (1)
+	 */
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 4))
+		return ERROR_NO_DATA;
+
+	pdu.DeviceName = (WCHAR*)Stream_Pointer(s);
+
+	remaining_length = Stream_GetRemainingLength(s);
+	channel_name_start = (WCHAR*)Stream_Pointer(s);
+
+	/* Search for null terminator of DeviceName */
+	for (i = 0; i < remaining_length; i += sizeof(WCHAR), ++channel_name_start)
+	{
+		if (*channel_name_start == L'\0')
+			break;
+	}
+
+	if (*channel_name_start != L'\0')
+	{
+		WLog_ERR(TAG, "enumerator_server_recv_device_added_notification: Invalid DeviceName!");
+		return ERROR_INVALID_DATA;
+	}
+
+	pdu.VirtualChannelName = (char*)++channel_name_start;
+	++i;
+
+	if (i >= remaining_length || *pdu.VirtualChannelName == '\0')
+	{
+		WLog_ERR(TAG,
+		         "enumerator_server_recv_device_added_notification: Invalid VirtualChannelName!");
+		return ERROR_INVALID_DATA;
+	}
+
+	tmp = pdu.VirtualChannelName;
+	for (; i < remaining_length; ++i, ++tmp)
+	{
+		if (*tmp == '\0')
+			break;
+	}
+
+	if (*tmp != '\0')
+	{
+		WLog_ERR(TAG,
+		         "enumerator_server_recv_device_added_notification: Invalid VirtualChannelName!");
+		return ERROR_INVALID_DATA;
+	}
+
+	IFCALLRET(context->DeviceAddedNotification, error, context, &pdu);
+	if (error)
+		WLog_ERR(TAG, "context->DeviceAddedNotification failed with error %" PRIu32 "", error);
+
+	return error;
+}
+
+static UINT enumerator_server_recv_device_removed_notification(CamDevEnumServerContext* context,
+                                                               wStream* s,
+                                                               const CAM_SHARED_MSG_HEADER* header)
+{
+	CAM_DEVICE_REMOVED_NOTIFICATION pdu;
+	UINT error = CHANNEL_RC_OK;
+	size_t remaining_length;
+	char* tmp;
+	size_t i;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(header);
+
+	pdu.Header = *header;
+
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 2))
+		return ERROR_NO_DATA;
+
+	pdu.VirtualChannelName = (char*)Stream_Pointer(s);
+
+	remaining_length = Stream_GetRemainingLength(s);
+	tmp = (char*)(Stream_Pointer(s) + 1);
+
+	for (i = 1; i < remaining_length; ++i, ++tmp)
+	{
+		if (*tmp == '\0')
+			break;
+	}
+
+	if (*tmp != '\0')
+	{
+		WLog_ERR(TAG,
+		         "enumerator_server_recv_device_removed_notification: Invalid VirtualChannelName!");
+		return ERROR_INVALID_DATA;
+	}
+
+	IFCALLRET(context->DeviceRemovedNotification, error, context, &pdu);
+	if (error)
+		WLog_ERR(TAG, "context->DeviceRemovedNotification failed with error %" PRIu32 "", error);
+
+	return error;
+}
+
+static UINT enumerator_process_message(enumerator_server* enumerator)
+{
+	BOOL rc;
+	UINT error = ERROR_INTERNAL_ERROR;
+	ULONG BytesReturned;
+	CAM_SHARED_MSG_HEADER header = { 0 };
+	wStream* s;
+
+	WINPR_ASSERT(enumerator);
+	WINPR_ASSERT(enumerator->enumerator_channel);
+
+	s = enumerator->buffer;
+	WINPR_ASSERT(s);
+
+	Stream_SetPosition(s, 0);
+	rc = WTSVirtualChannelRead(enumerator->enumerator_channel, 0, NULL, 0, &BytesReturned);
+	if (!rc)
+		goto out;
+
+	if (BytesReturned < 1)
+	{
+		error = CHANNEL_RC_OK;
+		goto out;
+	}
+
+	if (!Stream_EnsureRemainingCapacity(s, BytesReturned))
+	{
+		WLog_ERR(TAG, "Stream_EnsureRemainingCapacity failed!");
+		error = CHANNEL_RC_NO_MEMORY;
+		goto out;
+	}
+
+	if (WTSVirtualChannelRead(enumerator->enumerator_channel, 0, (PCHAR)Stream_Buffer(s),
+	                          (ULONG)Stream_Capacity(s), &BytesReturned) == FALSE)
+	{
+		WLog_ERR(TAG, "WTSVirtualChannelRead failed!");
+		goto out;
+	}
+
+	Stream_SetLength(s, BytesReturned);
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, CAM_HEADER_SIZE))
+		return ERROR_NO_DATA;
+
+	Stream_Read_UINT8(s, header.Version);
+	Stream_Read_UINT8(s, header.MessageId);
+
+	switch (header.MessageId)
+	{
+		case CAM_MSG_ID_SelectVersionRequest:
+			error =
+			    enumerator_server_handle_select_version_request(&enumerator->context, s, &header);
+			break;
+		case CAM_MSG_ID_DeviceAddedNotification:
+			error =
+			    enumerator_server_recv_device_added_notification(&enumerator->context, s, &header);
+			break;
+		case CAM_MSG_ID_DeviceRemovedNotification:
+			error = enumerator_server_recv_device_removed_notification(&enumerator->context, s,
+			                                                           &header);
+			break;
+		default:
+			WLog_ERR(TAG, "enumerator_process_message: unknown or invalid MessageId %" PRIu8 "",
+			         header.MessageId);
+			break;
+	}
+
+out:
+	if (error)
+		WLog_ERR(TAG, "Response failed with error %" PRIu32 "!", error);
+
+	return error;
+}
+
+static UINT enumerator_server_context_poll_int(CamDevEnumServerContext* context)
+{
+	enumerator_server* enumerator = (enumerator_server*)context;
+	UINT error = ERROR_INTERNAL_ERROR;
+
+	WINPR_ASSERT(enumerator);
+
+	switch (enumerator->state)
+	{
+		case ENUMERATOR_INITIAL:
+			error = enumerator_server_open_channel(enumerator);
+			if (error)
+				WLog_ERR(TAG, "enumerator_server_open_channel failed with error %" PRIu32 "!",
+				         error);
+			else
+				enumerator->state = ENUMERATOR_OPENED;
+			break;
+		case ENUMERATOR_OPENED:
+			error = enumerator_process_message(enumerator);
+			break;
+	}
+
+	return error;
+}
+
+static HANDLE enumerator_server_get_channel_handle(enumerator_server* enumerator)
+{
+	void* buffer = NULL;
+	DWORD BytesReturned = 0;
+	HANDLE ChannelEvent = NULL;
+
+	WINPR_ASSERT(enumerator);
+
+	if (WTSVirtualChannelQuery(enumerator->enumerator_channel, WTSVirtualEventHandle, &buffer,
+	                           &BytesReturned) == TRUE)
+	{
+		if (BytesReturned == sizeof(HANDLE))
+			CopyMemory(&ChannelEvent, buffer, sizeof(HANDLE));
+
+		WTSFreeMemory(buffer);
+	}
+
+	return ChannelEvent;
+}
+
+static DWORD WINAPI enumerator_server_thread_func(LPVOID arg)
+{
+	DWORD nCount;
+	HANDLE events[2] = { 0 };
+	enumerator_server* enumerator = (enumerator_server*)arg;
+	UINT error = CHANNEL_RC_OK;
+	DWORD status;
+
+	WINPR_ASSERT(enumerator);
+
+	nCount = 0;
+	events[nCount++] = enumerator->stopEvent;
+
+	while ((error == CHANNEL_RC_OK) && (WaitForSingleObject(events[0], 0) != WAIT_OBJECT_0))
+	{
+		switch (enumerator->state)
+		{
+			case ENUMERATOR_INITIAL:
+				error = enumerator_server_context_poll_int(&enumerator->context);
+				if (error == CHANNEL_RC_OK)
+				{
+					events[1] = enumerator_server_get_channel_handle(enumerator);
+					nCount = 2;
+				}
+				break;
+			case ENUMERATOR_OPENED:
+				status = WaitForMultipleObjects(nCount, events, FALSE, INFINITE);
+				switch (status)
+				{
+					case WAIT_OBJECT_0:
+						break;
+					case WAIT_OBJECT_0 + 1:
+					case WAIT_TIMEOUT:
+						error = enumerator_server_context_poll_int(&enumerator->context);
+						break;
+
+					case WAIT_FAILED:
+					default:
+						error = ERROR_INTERNAL_ERROR;
+						break;
+				}
+				break;
+		}
+	}
+
+	WTSVirtualChannelClose(enumerator->enumerator_channel);
+	enumerator->enumerator_channel = NULL;
+
+	if (error && enumerator->context.rdpcontext)
+		setChannelError(enumerator->context.rdpcontext, error,
+		                "enumerator_server_thread_func reported an error");
+
+	ExitThread(error);
+	return error;
+}
+
+static UINT enumerator_server_open(CamDevEnumServerContext* context)
+{
+	enumerator_server* enumerator = (enumerator_server*)context;
+
+	WINPR_ASSERT(enumerator);
+
+	if (!enumerator->externalThread && (enumerator->thread == NULL))
+	{
+		enumerator->stopEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
+		if (!enumerator->stopEvent)
+		{
+			WLog_ERR(TAG, "CreateEvent failed!");
+			return ERROR_INTERNAL_ERROR;
+		}
+
+		enumerator->thread =
+		    CreateThread(NULL, 0, enumerator_server_thread_func, enumerator, 0, NULL);
+		if (!enumerator->thread)
+		{
+			WLog_ERR(TAG, "CreateThread failed!");
+			CloseHandle(enumerator->stopEvent);
+			enumerator->stopEvent = NULL;
+			return ERROR_INTERNAL_ERROR;
+		}
+	}
+	enumerator->isOpened = TRUE;
+
+	return CHANNEL_RC_OK;
+}
+
+static UINT enumerator_server_close(CamDevEnumServerContext* context)
+{
+	UINT error = CHANNEL_RC_OK;
+	enumerator_server* enumerator = (enumerator_server*)context;
+
+	WINPR_ASSERT(enumerator);
+
+	if (!enumerator->externalThread && enumerator->thread)
+	{
+		SetEvent(enumerator->stopEvent);
+
+		if (WaitForSingleObject(enumerator->thread, INFINITE) == WAIT_FAILED)
+		{
+			error = GetLastError();
+			WLog_ERR(TAG, "WaitForSingleObject failed with error %" PRIu32 "", error);
+			return error;
+		}
+
+		CloseHandle(enumerator->thread);
+		CloseHandle(enumerator->stopEvent);
+		enumerator->thread = NULL;
+		enumerator->stopEvent = NULL;
+	}
+	if (enumerator->externalThread)
+	{
+		if (enumerator->state != ENUMERATOR_INITIAL)
+		{
+			WTSVirtualChannelClose(enumerator->enumerator_channel);
+			enumerator->enumerator_channel = NULL;
+			enumerator->state = ENUMERATOR_INITIAL;
+		}
+	}
+	enumerator->isOpened = FALSE;
+
+	return error;
+}
+
+static UINT enumerator_server_context_poll(CamDevEnumServerContext* context)
+{
+	enumerator_server* enumerator = (enumerator_server*)context;
+
+	WINPR_ASSERT(enumerator);
+
+	if (!enumerator->externalThread)
+		return ERROR_INTERNAL_ERROR;
+
+	return enumerator_server_context_poll_int(context);
+}
+
+static BOOL enumerator_server_context_handle(CamDevEnumServerContext* context, HANDLE* handle)
+{
+	enumerator_server* enumerator = (enumerator_server*)context;
+
+	WINPR_ASSERT(enumerator);
+	WINPR_ASSERT(handle);
+
+	if (!enumerator->externalThread)
+		return FALSE;
+	if (enumerator->state == ENUMERATOR_INITIAL)
+		return FALSE;
+
+	*handle = enumerator_server_get_channel_handle(enumerator);
+
+	return TRUE;
+}
+
+static UINT enumerator_server_packet_send(CamDevEnumServerContext* context, wStream* s)
+{
+	enumerator_server* enumerator = (enumerator_server*)context;
+	UINT error = CHANNEL_RC_OK;
+	ULONG written;
+
+	if (!WTSVirtualChannelWrite(enumerator->enumerator_channel, (PCHAR)Stream_Buffer(s),
+	                            Stream_GetPosition(s), &written))
+	{
+		WLog_ERR(TAG, "WTSVirtualChannelWrite failed!");
+		error = ERROR_INTERNAL_ERROR;
+		goto out;
+	}
+
+	if (written < Stream_GetPosition(s))
+	{
+		WLog_WARN(TAG, "Unexpected bytes written: %" PRIu32 "/%" PRIuz "", written,
+		          Stream_GetPosition(s));
+	}
+
+out:
+	Stream_Free(s, TRUE);
+	return error;
+}
+
+static UINT enumerator_send_select_version_response_pdu(
+    CamDevEnumServerContext* context, const CAM_SELECT_VERSION_RESPONSE* selectVersionResponse)
+{
+	wStream* s;
+
+	s = Stream_New(NULL, CAM_HEADER_SIZE);
+	if (!s)
+	{
+		WLog_ERR(TAG, "Stream_New failed!");
+		return ERROR_NOT_ENOUGH_MEMORY;
+	}
+
+	Stream_Write_UINT8(s, selectVersionResponse->Header.Version);
+	Stream_Write_UINT8(s, selectVersionResponse->Header.MessageId);
+
+	return enumerator_server_packet_send(context, s);
+}
+
+CamDevEnumServerContext* cam_dev_enum_server_context_new(HANDLE vcm)
+{
+	enumerator_server* enumerator = (enumerator_server*)calloc(1, sizeof(enumerator_server));
+
+	if (!enumerator)
+		return NULL;
+
+	enumerator->context.vcm = vcm;
+	enumerator->context.Initialize = enumerator_server_initialize;
+	enumerator->context.Open = enumerator_server_open;
+	enumerator->context.Close = enumerator_server_close;
+	enumerator->context.Poll = enumerator_server_context_poll;
+	enumerator->context.ChannelHandle = enumerator_server_context_handle;
+
+	enumerator->context.SelectVersionResponse = enumerator_send_select_version_response_pdu;
+
+	enumerator->buffer = Stream_New(NULL, 4096);
+	if (!enumerator->buffer)
+		goto fail;
+
+	return &enumerator->context;
+fail:
+	cam_dev_enum_server_context_free(&enumerator->context);
+	return NULL;
+}
+
+void cam_dev_enum_server_context_free(CamDevEnumServerContext* context)
+{
+	enumerator_server* enumerator = (enumerator_server*)context;
+
+	if (enumerator)
+	{
+		enumerator_server_close(context);
+		Stream_Free(enumerator->buffer, TRUE);
+	}
+
+	free(enumerator);
+}

channels/rdpecam/server/camera_device_main.c

@@ -0,0 +1,969 @@
+/**
+ * FreeRDP: A Remote Desktop Protocol Implementation
+ * Video Capture Virtual Channel Extension
+ *
+ * Copyright 2022 Pascal Nowack <Pascal.Nowack@gmx.de>
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *	 http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <freerdp/channels/log.h>
+#include <freerdp/server/rdpecam.h>
+
+#define TAG CHANNELS_TAG("rdpecam.server")
+
+typedef enum
+{
+	CAMERA_DEVICE_INITIAL,
+	CAMERA_DEVICE_OPENED,
+} eCameraDeviceChannelState;
+
+typedef struct
+{
+	CameraDeviceServerContext context;
+
+	HANDLE stopEvent;
+
+	HANDLE thread;
+	void* device_channel;
+
+	DWORD SessionId;
+
+	BOOL isOpened;
+	BOOL externalThread;
+
+	/* Channel state */
+	eCameraDeviceChannelState state;
+
+	wStream* buffer;
+} device_server;
+
+static UINT device_server_initialize(CameraDeviceServerContext* context, BOOL externalThread)
+{
+	UINT error = CHANNEL_RC_OK;
+	device_server* device = (device_server*)context;
+
+	WINPR_ASSERT(device);
+
+	if (device->isOpened)
+	{
+		WLog_WARN(TAG, "Application error: Camera channel already initialized, "
+		               "calling in this state is not possible!");
+		return ERROR_INVALID_STATE;
+	}
+
+	device->externalThread = externalThread;
+
+	return error;
+}
+
+static UINT device_server_open_channel(device_server* device)
+{
+	CameraDeviceServerContext* context = &device->context;
+	DWORD Error = ERROR_SUCCESS;
+	HANDLE hEvent;
+	DWORD BytesReturned = 0;
+	PULONG pSessionId = NULL;
+	UINT32 channelId;
+	BOOL status = TRUE;
+
+	WINPR_ASSERT(device);
+
+	if (WTSQuerySessionInformationA(device->context.vcm, WTS_CURRENT_SESSION, WTSSessionId,
+	                                (LPSTR*)&pSessionId, &BytesReturned) == FALSE)
+	{
+		WLog_ERR(TAG, "WTSQuerySessionInformationA failed!");
+		return ERROR_INTERNAL_ERROR;
+	}
+
+	device->SessionId = (DWORD)*pSessionId;
+	WTSFreeMemory(pSessionId);
+	hEvent = WTSVirtualChannelManagerGetEventHandle(device->context.vcm);
+
+	if (WaitForSingleObject(hEvent, 1000) == WAIT_FAILED)
+	{
+		Error = GetLastError();
+		WLog_ERR(TAG, "WaitForSingleObject failed with error %" PRIu32 "!", Error);
+		return Error;
+	}
+
+	device->device_channel = WTSVirtualChannelOpenEx(device->SessionId, context->virtualChannelName,
+	                                                 WTS_CHANNEL_OPTION_DYNAMIC);
+	if (!device->device_channel)
+	{
+		Error = GetLastError();
+		WLog_ERR(TAG, "WTSVirtualChannelOpenEx failed with error %" PRIu32 "!", Error);
+		return Error;
+	}
+
+	channelId = WTSChannelGetIdByHandle(device->device_channel);
+
+	IFCALLRET(context->ChannelIdAssigned, status, context, channelId);
+	if (!status)
+	{
+		WLog_ERR(TAG, "context->ChannelIdAssigned failed!");
+		return ERROR_INTERNAL_ERROR;
+	}
+
+	return Error;
+}
+
+static UINT device_server_handle_success_response(CameraDeviceServerContext* context, wStream* s,
+                                                  const CAM_SHARED_MSG_HEADER* header)
+{
+	CAM_SUCCESS_RESPONSE pdu = { 0 };
+	UINT error = CHANNEL_RC_OK;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(header);
+
+	pdu.Header = *header;
+
+	IFCALLRET(context->SuccessResponse, error, context, &pdu);
+	if (error)
+		WLog_ERR(TAG, "context->SuccessResponse failed with error %" PRIu32 "", error);
+
+	return error;
+}
+
+static UINT device_server_recv_error_response(CameraDeviceServerContext* context, wStream* s,
+                                              const CAM_SHARED_MSG_HEADER* header)
+{
+	CAM_ERROR_RESPONSE pdu = { 0 };
+	UINT error = CHANNEL_RC_OK;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(header);
+
+	pdu.Header = *header;
+
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 4))
+		return ERROR_NO_DATA;
+
+	Stream_Read_UINT32(s, pdu.ErrorCode);
+
+	IFCALLRET(context->ErrorResponse, error, context, &pdu);
+	if (error)
+		WLog_ERR(TAG, "context->ErrorResponse failed with error %" PRIu32 "", error);
+
+	return error;
+}
+
+static UINT device_server_recv_stream_list_response(CameraDeviceServerContext* context, wStream* s,
+                                                    const CAM_SHARED_MSG_HEADER* header)
+{
+	CAM_STREAM_LIST_RESPONSE pdu = { 0 };
+	UINT error = CHANNEL_RC_OK;
+	BYTE i;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(header);
+
+	pdu.Header = *header;
+
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 5))
+		return ERROR_NO_DATA;
+
+	pdu.N_Descriptions = MIN(Stream_GetRemainingLength(s) / 5, 255);
+
+	for (i = 0; i < pdu.N_Descriptions; ++i)
+	{
+		CAM_STREAM_DESCRIPTION* StreamDescription = &pdu.StreamDescriptions[i];
+
+		Stream_Read_UINT16(s, StreamDescription->FrameSourceTypes);
+		Stream_Read_UINT8(s, StreamDescription->StreamCategory);
+		Stream_Read_UINT8(s, StreamDescription->Selected);
+		Stream_Read_UINT8(s, StreamDescription->CanBeShared);
+	}
+
+	IFCALLRET(context->StreamListResponse, error, context, &pdu);
+	if (error)
+		WLog_ERR(TAG, "context->StreamListResponse failed with error %" PRIu32 "", error);
+
+	return error;
+}
+
+static UINT device_server_recv_media_type_list_response(CameraDeviceServerContext* context,
+                                                        wStream* s,
+                                                        const CAM_SHARED_MSG_HEADER* header)
+{
+	CAM_MEDIA_TYPE_LIST_RESPONSE pdu = { 0 };
+	UINT error = CHANNEL_RC_OK;
+	BYTE i;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(header);
+
+	pdu.Header = *header;
+
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 26))
+		return ERROR_NO_DATA;
+
+	pdu.N_Descriptions = Stream_GetRemainingLength(s) / 26;
+
+	pdu.MediaTypeDescriptions = calloc(pdu.N_Descriptions, sizeof(CAM_MEDIA_TYPE_DESCRIPTION));
+	if (!pdu.MediaTypeDescriptions)
+	{
+		WLog_ERR(TAG, "Failed to allocate %zu CAM_MEDIA_TYPE_DESCRIPTION structs",
+		         pdu.N_Descriptions);
+		return ERROR_NOT_ENOUGH_MEMORY;
+	}
+
+	for (i = 0; i < pdu.N_Descriptions; ++i)
+	{
+		CAM_MEDIA_TYPE_DESCRIPTION* MediaTypeDescriptions = &pdu.MediaTypeDescriptions[i];
+
+		Stream_Read_UINT8(s, MediaTypeDescriptions->Format);
+		Stream_Read_UINT32(s, MediaTypeDescriptions->Width);
+		Stream_Read_UINT32(s, MediaTypeDescriptions->Height);
+		Stream_Read_UINT32(s, MediaTypeDescriptions->FrameRateNumerator);
+		Stream_Read_UINT32(s, MediaTypeDescriptions->FrameRateDenominator);
+		Stream_Read_UINT32(s, MediaTypeDescriptions->PixelAspectRatioNumerator);
+		Stream_Read_UINT32(s, MediaTypeDescriptions->PixelAspectRatioDenominator);
+		Stream_Read_UINT8(s, MediaTypeDescriptions->Flags);
+	}
+
+	IFCALLRET(context->MediaTypeListResponse, error, context, &pdu);
+	if (error)
+		WLog_ERR(TAG, "context->MediaTypeListResponse failed with error %" PRIu32 "", error);
+
+	free(pdu.MediaTypeDescriptions);
+
+	return error;
+}
+
+static UINT device_server_recv_current_media_type_response(CameraDeviceServerContext* context,
+                                                           wStream* s,
+                                                           const CAM_SHARED_MSG_HEADER* header)
+{
+	CAM_CURRENT_MEDIA_TYPE_RESPONSE pdu = { 0 };
+	UINT error = CHANNEL_RC_OK;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(header);
+
+	pdu.Header = *header;
+
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 26))
+		return ERROR_NO_DATA;
+
+	Stream_Read_UINT8(s, pdu.MediaTypeDescription.Format);
+	Stream_Read_UINT32(s, pdu.MediaTypeDescription.Width);
+	Stream_Read_UINT32(s, pdu.MediaTypeDescription.Height);
+	Stream_Read_UINT32(s, pdu.MediaTypeDescription.FrameRateNumerator);
+	Stream_Read_UINT32(s, pdu.MediaTypeDescription.FrameRateDenominator);
+	Stream_Read_UINT32(s, pdu.MediaTypeDescription.PixelAspectRatioNumerator);
+	Stream_Read_UINT32(s, pdu.MediaTypeDescription.PixelAspectRatioDenominator);
+	Stream_Read_UINT8(s, pdu.MediaTypeDescription.Flags);
+
+	IFCALLRET(context->CurrentMediaTypeResponse, error, context, &pdu);
+	if (error)
+		WLog_ERR(TAG, "context->CurrentMediaTypeResponse failed with error %" PRIu32 "", error);
+
+	return error;
+}
+
+static UINT device_server_recv_sample_response(CameraDeviceServerContext* context, wStream* s,
+                                               const CAM_SHARED_MSG_HEADER* header)
+{
+	CAM_SAMPLE_RESPONSE pdu = { 0 };
+	UINT error = CHANNEL_RC_OK;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(header);
+
+	pdu.Header = *header;
+
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 1))
+		return ERROR_NO_DATA;
+
+	Stream_Read_UINT8(s, pdu.StreamIndex);
+
+	pdu.SampleSize = Stream_GetRemainingLength(s);
+	pdu.Sample = Stream_Pointer(s);
+
+	IFCALLRET(context->SampleResponse, error, context, &pdu);
+	if (error)
+		WLog_ERR(TAG, "context->SampleResponse failed with error %" PRIu32 "", error);
+
+	return error;
+}
+
+static UINT device_server_recv_sample_error_response(CameraDeviceServerContext* context, wStream* s,
+                                                     const CAM_SHARED_MSG_HEADER* header)
+{
+	CAM_SAMPLE_ERROR_RESPONSE pdu = { 0 };
+	UINT error = CHANNEL_RC_OK;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(header);
+
+	pdu.Header = *header;
+
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 5))
+		return ERROR_NO_DATA;
+
+	Stream_Read_UINT8(s, pdu.StreamIndex);
+	Stream_Read_UINT32(s, pdu.ErrorCode);
+
+	IFCALLRET(context->SampleErrorResponse, error, context, &pdu);
+	if (error)
+		WLog_ERR(TAG, "context->SampleErrorResponse failed with error %" PRIu32 "", error);
+
+	return error;
+}
+
+static UINT device_server_recv_property_list_response(CameraDeviceServerContext* context,
+                                                      wStream* s,
+                                                      const CAM_SHARED_MSG_HEADER* header)
+{
+	CAM_PROPERTY_LIST_RESPONSE pdu = { 0 };
+	UINT error = CHANNEL_RC_OK;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(header);
+
+	pdu.Header = *header;
+
+	pdu.N_Properties = Stream_GetRemainingLength(s) / 19;
+
+	if (pdu.N_Properties > 0)
+	{
+		size_t i;
+
+		pdu.Properties = calloc(pdu.N_Properties, sizeof(CAM_PROPERTY_DESCRIPTION));
+		if (!pdu.Properties)
+		{
+			WLog_ERR(TAG, "Failed to allocate %zu CAM_PROPERTY_DESCRIPTION structs",
+			         pdu.N_Properties);
+			return ERROR_NOT_ENOUGH_MEMORY;
+		}
+
+		for (i = 0; i < pdu.N_Properties; ++i)
+		{
+			Stream_Read_UINT8(s, pdu.Properties[i].PropertySet);
+			Stream_Read_UINT8(s, pdu.Properties[i].PropertyId);
+			Stream_Read_UINT8(s, pdu.Properties[i].Capabilities);
+			Stream_Read_INT32(s, pdu.Properties[i].MinValue);
+			Stream_Read_INT32(s, pdu.Properties[i].MaxValue);
+			Stream_Read_INT32(s, pdu.Properties[i].Step);
+			Stream_Read_INT32(s, pdu.Properties[i].DefaultValue);
+		}
+	}
+
+	IFCALLRET(context->PropertyListResponse, error, context, &pdu);
+	if (error)
+		WLog_ERR(TAG, "context->PropertyListResponse failed with error %" PRIu32 "", error);
+
+	free(pdu.Properties);
+
+	return error;
+}
+
+static UINT device_server_recv_property_value_response(CameraDeviceServerContext* context,
+                                                       wStream* s,
+                                                       const CAM_SHARED_MSG_HEADER* header)
+{
+	CAM_PROPERTY_VALUE_RESPONSE pdu = { 0 };
+	UINT error = CHANNEL_RC_OK;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(header);
+
+	pdu.Header = *header;
+
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 5))
+		return ERROR_NO_DATA;
+
+	Stream_Read_UINT8(s, pdu.PropertyValue.Mode);
+	Stream_Read_INT32(s, pdu.PropertyValue.Value);
+
+	IFCALLRET(context->PropertyValueResponse, error, context, &pdu);
+	if (error)
+		WLog_ERR(TAG, "context->PropertyValueResponse failed with error %" PRIu32 "", error);
+
+	return error;
+}
+
+static UINT device_process_message(device_server* device)
+{
+	BOOL rc;
+	UINT error = ERROR_INTERNAL_ERROR;
+	ULONG BytesReturned;
+	CAM_SHARED_MSG_HEADER header = { 0 };
+	wStream* s;
+
+	WINPR_ASSERT(device);
+	WINPR_ASSERT(device->device_channel);
+
+	s = device->buffer;
+	WINPR_ASSERT(s);
+
+	Stream_SetPosition(s, 0);
+	rc = WTSVirtualChannelRead(device->device_channel, 0, NULL, 0, &BytesReturned);
+	if (!rc)
+		goto out;
+
+	if (BytesReturned < 1)
+	{
+		error = CHANNEL_RC_OK;
+		goto out;
+	}
+
+	if (!Stream_EnsureRemainingCapacity(s, BytesReturned))
+	{
+		WLog_ERR(TAG, "Stream_EnsureRemainingCapacity failed!");
+		error = CHANNEL_RC_NO_MEMORY;
+		goto out;
+	}
+
+	if (WTSVirtualChannelRead(device->device_channel, 0, (PCHAR)Stream_Buffer(s),
+	                          (ULONG)Stream_Capacity(s), &BytesReturned) == FALSE)
+	{
+		WLog_ERR(TAG, "WTSVirtualChannelRead failed!");
+		goto out;
+	}
+
+	Stream_SetLength(s, BytesReturned);
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, CAM_HEADER_SIZE))
+		return ERROR_NO_DATA;
+
+	Stream_Read_UINT8(s, header.Version);
+	Stream_Read_UINT8(s, header.MessageId);
+
+	switch (header.MessageId)
+	{
+		case CAM_MSG_ID_SuccessResponse:
+			error = device_server_handle_success_response(&device->context, s, &header);
+			break;
+		case CAM_MSG_ID_ErrorResponse:
+			error = device_server_recv_error_response(&device->context, s, &header);
+			break;
+		case CAM_MSG_ID_StreamListResponse:
+			error = device_server_recv_stream_list_response(&device->context, s, &header);
+			break;
+		case CAM_MSG_ID_MediaTypeListResponse:
+			error = device_server_recv_media_type_list_response(&device->context, s, &header);
+			break;
+		case CAM_MSG_ID_CurrentMediaTypeResponse:
+			error = device_server_recv_current_media_type_response(&device->context, s, &header);
+			break;
+		case CAM_MSG_ID_SampleResponse:
+			error = device_server_recv_sample_response(&device->context, s, &header);
+			break;
+		case CAM_MSG_ID_SampleErrorResponse:
+			error = device_server_recv_sample_error_response(&device->context, s, &header);
+			break;
+		case CAM_MSG_ID_PropertyListResponse:
+			error = device_server_recv_property_list_response(&device->context, s, &header);
+			break;
+		case CAM_MSG_ID_PropertyValueResponse:
+			error = device_server_recv_property_value_response(&device->context, s, &header);
+			break;
+		default:
+			WLog_ERR(TAG, "device_process_message: unknown or invalid MessageId %" PRIu8 "",
+			         header.MessageId);
+			break;
+	}
+
+out:
+	if (error)
+		WLog_ERR(TAG, "Response failed with error %" PRIu32 "!", error);
+
+	return error;
+}
+
+static UINT device_server_context_poll_int(CameraDeviceServerContext* context)
+{
+	device_server* device = (device_server*)context;
+	UINT error = ERROR_INTERNAL_ERROR;
+
+	WINPR_ASSERT(device);
+
+	switch (device->state)
+	{
+		case CAMERA_DEVICE_INITIAL:
+			error = device_server_open_channel(device);
+			if (error)
+				WLog_ERR(TAG, "device_server_open_channel failed with error %" PRIu32 "!", error);
+			else
+				device->state = CAMERA_DEVICE_OPENED;
+			break;
+		case CAMERA_DEVICE_OPENED:
+			error = device_process_message(device);
+			break;
+	}
+
+	return error;
+}
+
+static HANDLE device_server_get_channel_handle(device_server* device)
+{
+	void* buffer = NULL;
+	DWORD BytesReturned = 0;
+	HANDLE ChannelEvent = NULL;
+
+	WINPR_ASSERT(device);
+
+	if (WTSVirtualChannelQuery(device->device_channel, WTSVirtualEventHandle, &buffer,
+	                           &BytesReturned) == TRUE)
+	{
+		if (BytesReturned == sizeof(HANDLE))
+			CopyMemory(&ChannelEvent, buffer, sizeof(HANDLE));
+
+		WTSFreeMemory(buffer);
+	}
+
+	return ChannelEvent;
+}
+
+static DWORD WINAPI device_server_thread_func(LPVOID arg)
+{
+	DWORD nCount;
+	HANDLE events[2] = { 0 };
+	device_server* device = (device_server*)arg;
+	UINT error = CHANNEL_RC_OK;
+	DWORD status;
+
+	WINPR_ASSERT(device);
+
+	nCount = 0;
+	events[nCount++] = device->stopEvent;
+
+	while ((error == CHANNEL_RC_OK) && (WaitForSingleObject(events[0], 0) != WAIT_OBJECT_0))
+	{
+		switch (device->state)
+		{
+			case CAMERA_DEVICE_INITIAL:
+				error = device_server_context_poll_int(&device->context);
+				if (error == CHANNEL_RC_OK)
+				{
+					events[1] = device_server_get_channel_handle(device);
+					nCount = 2;
+				}
+				break;
+			case CAMERA_DEVICE_OPENED:
+				status = WaitForMultipleObjects(nCount, events, FALSE, INFINITE);
+				switch (status)
+				{
+					case WAIT_OBJECT_0:
+						break;
+					case WAIT_OBJECT_0 + 1:
+					case WAIT_TIMEOUT:
+						error = device_server_context_poll_int(&device->context);
+						break;
+
+					case WAIT_FAILED:
+					default:
+						error = ERROR_INTERNAL_ERROR;
+						break;
+				}
+				break;
+		}
+	}
+
+	WTSVirtualChannelClose(device->device_channel);
+	device->device_channel = NULL;
+
+	if (error && device->context.rdpcontext)
+		setChannelError(device->context.rdpcontext, error,
+		                "device_server_thread_func reported an error");
+
+	ExitThread(error);
+	return error;
+}
+
+static UINT device_server_open(CameraDeviceServerContext* context)
+{
+	device_server* device = (device_server*)context;
+
+	WINPR_ASSERT(device);
+
+	if (!device->externalThread && (device->thread == NULL))
+	{
+		device->stopEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
+		if (!device->stopEvent)
+		{
+			WLog_ERR(TAG, "CreateEvent failed!");
+			return ERROR_INTERNAL_ERROR;
+		}
+
+		device->thread = CreateThread(NULL, 0, device_server_thread_func, device, 0, NULL);
+		if (!device->thread)
+		{
+			WLog_ERR(TAG, "CreateThread failed!");
+			CloseHandle(device->stopEvent);
+			device->stopEvent = NULL;
+			return ERROR_INTERNAL_ERROR;
+		}
+	}
+	device->isOpened = TRUE;
+
+	return CHANNEL_RC_OK;
+}
+
+static UINT device_server_close(CameraDeviceServerContext* context)
+{
+	UINT error = CHANNEL_RC_OK;
+	device_server* device = (device_server*)context;
+
+	WINPR_ASSERT(device);
+
+	if (!device->externalThread && device->thread)
+	{
+		SetEvent(device->stopEvent);
+
+		if (WaitForSingleObject(device->thread, INFINITE) == WAIT_FAILED)
+		{
+			error = GetLastError();
+			WLog_ERR(TAG, "WaitForSingleObject failed with error %" PRIu32 "", error);
+			return error;
+		}
+
+		CloseHandle(device->thread);
+		CloseHandle(device->stopEvent);
+		device->thread = NULL;
+		device->stopEvent = NULL;
+	}
+	if (device->externalThread)
+	{
+		if (device->state != CAMERA_DEVICE_INITIAL)
+		{
+			WTSVirtualChannelClose(device->device_channel);
+			device->device_channel = NULL;
+			device->state = CAMERA_DEVICE_INITIAL;
+		}
+	}
+	device->isOpened = FALSE;
+
+	return error;
+}
+
+static UINT device_server_context_poll(CameraDeviceServerContext* context)
+{
+	device_server* device = (device_server*)context;
+
+	WINPR_ASSERT(device);
+
+	if (!device->externalThread)
+		return ERROR_INTERNAL_ERROR;
+
+	return device_server_context_poll_int(context);
+}
+
+static BOOL device_server_context_handle(CameraDeviceServerContext* context, HANDLE* handle)
+{
+	device_server* device = (device_server*)context;
+
+	WINPR_ASSERT(device);
+	WINPR_ASSERT(handle);
+
+	if (!device->externalThread)
+		return FALSE;
+	if (device->state == CAMERA_DEVICE_INITIAL)
+		return FALSE;
+
+	*handle = device_server_get_channel_handle(device);
+
+	return TRUE;
+}
+
+static wStream* device_server_packet_new(size_t size, BYTE version, BYTE messageId)
+{
+	wStream* s;
+
+	/* Allocate what we need plus header bytes */
+	s = Stream_New(NULL, size + CAM_HEADER_SIZE);
+	if (!s)
+	{
+		WLog_ERR(TAG, "Stream_New failed!");
+		return NULL;
+	}
+
+	Stream_Write_UINT8(s, version);
+	Stream_Write_UINT8(s, messageId);
+
+	return s;
+}
+
+static UINT device_server_packet_send(CameraDeviceServerContext* context, wStream* s)
+{
+	device_server* device = (device_server*)context;
+	UINT error = CHANNEL_RC_OK;
+	ULONG written;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(s);
+
+	if (!WTSVirtualChannelWrite(device->device_channel, (PCHAR)Stream_Buffer(s),
+	                            Stream_GetPosition(s), &written))
+	{
+		WLog_ERR(TAG, "WTSVirtualChannelWrite failed!");
+		error = ERROR_INTERNAL_ERROR;
+		goto out;
+	}
+
+	if (written < Stream_GetPosition(s))
+	{
+		WLog_WARN(TAG, "Unexpected bytes written: %" PRIu32 "/%" PRIuz "", written,
+		          Stream_GetPosition(s));
+	}
+
+out:
+	Stream_Free(s, TRUE);
+	return error;
+}
+
+static UINT device_server_write_and_send_header(CameraDeviceServerContext* context, BYTE messageId)
+{
+	wStream* s;
+
+	WINPR_ASSERT(context);
+
+	s = device_server_packet_new(0, context->protocolVersion, messageId);
+	if (!s)
+		return ERROR_NOT_ENOUGH_MEMORY;
+
+	return device_server_packet_send(context, s);
+}
+
+static UINT
+device_send_activate_device_request_pdu(CameraDeviceServerContext* context,
+                                        const CAM_ACTIVATE_DEVICE_REQUEST* activateDeviceRequest)
+{
+	WINPR_ASSERT(context);
+
+	return device_server_write_and_send_header(context, CAM_MSG_ID_ActivateDeviceRequest);
+}
+
+static UINT device_send_deactivate_device_request_pdu(
+    CameraDeviceServerContext* context,
+    const CAM_DEACTIVATE_DEVICE_REQUEST* deactivateDeviceRequest)
+{
+	WINPR_ASSERT(context);
+
+	return device_server_write_and_send_header(context, CAM_MSG_ID_DeactivateDeviceRequest);
+}
+
+static UINT device_send_stream_list_request_pdu(CameraDeviceServerContext* context,
+                                                const CAM_STREAM_LIST_REQUEST* streamListRequest)
+{
+	WINPR_ASSERT(context);
+
+	return device_server_write_and_send_header(context, CAM_MSG_ID_StreamListRequest);
+}
+
+static UINT
+device_send_media_type_list_request_pdu(CameraDeviceServerContext* context,
+                                        const CAM_MEDIA_TYPE_LIST_REQUEST* mediaTypeListRequest)
+{
+	wStream* s;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(mediaTypeListRequest);
+
+	s = device_server_packet_new(1, context->protocolVersion, CAM_MSG_ID_MediaTypeListRequest);
+	if (!s)
+		return ERROR_NOT_ENOUGH_MEMORY;
+
+	Stream_Write_UINT8(s, mediaTypeListRequest->StreamIndex);
+
+	return device_server_packet_send(context, s);
+}
+
+static UINT device_send_current_media_type_request_pdu(
+    CameraDeviceServerContext* context,
+    const CAM_CURRENT_MEDIA_TYPE_REQUEST* currentMediaTypeRequest)
+{
+	wStream* s;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(currentMediaTypeRequest);
+
+	s = device_server_packet_new(1, context->protocolVersion, CAM_MSG_ID_CurrentMediaTypeRequest);
+	if (!s)
+		return ERROR_NOT_ENOUGH_MEMORY;
+
+	Stream_Write_UINT8(s, currentMediaTypeRequest->StreamIndex);
+
+	return device_server_packet_send(context, s);
+}
+
+static UINT
+device_send_start_streams_request_pdu(CameraDeviceServerContext* context,
+                                      const CAM_START_STREAMS_REQUEST* startStreamsRequest)
+{
+	wStream* s;
+	size_t i;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(startStreamsRequest);
+
+	s = device_server_packet_new(startStreamsRequest->N_Infos * 27ul, context->protocolVersion,
+	                             CAM_MSG_ID_StartStreamsRequest);
+	if (!s)
+		return ERROR_NOT_ENOUGH_MEMORY;
+
+	for (i = 0; i < startStreamsRequest->N_Infos; ++i)
+	{
+		const CAM_START_STREAM_INFO* info = &startStreamsRequest->StartStreamsInfo[i];
+		const CAM_MEDIA_TYPE_DESCRIPTION* description = &info->MediaTypeDescription;
+
+		Stream_Write_UINT8(s, info->StreamIndex);
+
+		Stream_Write_UINT8(s, description->Format);
+		Stream_Write_UINT32(s, description->Width);
+		Stream_Write_UINT32(s, description->Height);
+		Stream_Write_UINT32(s, description->FrameRateNumerator);
+		Stream_Write_UINT32(s, description->FrameRateDenominator);
+		Stream_Write_UINT32(s, description->PixelAspectRatioNumerator);
+		Stream_Write_UINT32(s, description->PixelAspectRatioDenominator);
+		Stream_Write_UINT8(s, description->Flags);
+	}
+
+	return device_server_packet_send(context, s);
+}
+
+static UINT device_send_stop_streams_request_pdu(CameraDeviceServerContext* context,
+                                                 const CAM_STOP_STREAMS_REQUEST* stopStreamsRequest)
+{
+	WINPR_ASSERT(context);
+
+	return device_server_write_and_send_header(context, CAM_MSG_ID_StopStreamsRequest);
+}
+
+static UINT device_send_sample_request_pdu(CameraDeviceServerContext* context,
+                                           const CAM_SAMPLE_REQUEST* sampleRequest)
+{
+	wStream* s;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(sampleRequest);
+
+	s = device_server_packet_new(1, context->protocolVersion, CAM_MSG_ID_SampleRequest);
+	if (!s)
+		return ERROR_NOT_ENOUGH_MEMORY;
+
+	Stream_Write_UINT8(s, sampleRequest->StreamIndex);
+
+	return device_server_packet_send(context, s);
+}
+
+static UINT
+device_send_property_list_request_pdu(CameraDeviceServerContext* context,
+                                      const CAM_PROPERTY_LIST_REQUEST* propertyListRequest)
+{
+	WINPR_ASSERT(context);
+
+	return device_server_write_and_send_header(context, CAM_MSG_ID_PropertyListRequest);
+}
+
+static UINT
+device_send_property_value_request_pdu(CameraDeviceServerContext* context,
+                                       const CAM_PROPERTY_VALUE_REQUEST* propertyValueRequest)
+{
+	wStream* s;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(propertyValueRequest);
+
+	s = device_server_packet_new(2, context->protocolVersion, CAM_MSG_ID_PropertyValueRequest);
+	if (!s)
+		return ERROR_NOT_ENOUGH_MEMORY;
+
+	Stream_Write_UINT8(s, propertyValueRequest->PropertySet);
+	Stream_Write_UINT8(s, propertyValueRequest->PropertyId);
+
+	return device_server_packet_send(context, s);
+}
+
+static UINT device_send_set_property_value_request_pdu(
+    CameraDeviceServerContext* context,
+    const CAM_SET_PROPERTY_VALUE_REQUEST* setPropertyValueRequest)
+{
+	wStream* s;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(setPropertyValueRequest);
+
+	s = device_server_packet_new(2 + 5, context->protocolVersion,
+	                             CAM_MSG_ID_SetPropertyValueRequest);
+	if (!s)
+		return ERROR_NOT_ENOUGH_MEMORY;
+
+	Stream_Write_UINT8(s, setPropertyValueRequest->PropertySet);
+	Stream_Write_UINT8(s, setPropertyValueRequest->PropertyId);
+
+	Stream_Write_UINT8(s, setPropertyValueRequest->PropertyValue.Mode);
+	Stream_Write_INT32(s, setPropertyValueRequest->PropertyValue.Value);
+
+	return device_server_packet_send(context, s);
+}
+
+CameraDeviceServerContext* camera_device_server_context_new(HANDLE vcm)
+{
+	device_server* device = (device_server*)calloc(1, sizeof(device_server));
+
+	if (!device)
+		return NULL;
+
+	device->context.vcm = vcm;
+	device->context.Initialize = device_server_initialize;
+	device->context.Open = device_server_open;
+	device->context.Close = device_server_close;
+	device->context.Poll = device_server_context_poll;
+	device->context.ChannelHandle = device_server_context_handle;
+
+	device->context.ActivateDeviceRequest = device_send_activate_device_request_pdu;
+	device->context.DeactivateDeviceRequest = device_send_deactivate_device_request_pdu;
+
+	device->context.StreamListRequest = device_send_stream_list_request_pdu;
+	device->context.MediaTypeListRequest = device_send_media_type_list_request_pdu;
+	device->context.CurrentMediaTypeRequest = device_send_current_media_type_request_pdu;
+
+	device->context.StartStreamsRequest = device_send_start_streams_request_pdu;
+	device->context.StopStreamsRequest = device_send_stop_streams_request_pdu;
+	device->context.SampleRequest = device_send_sample_request_pdu;
+
+	device->context.PropertyListRequest = device_send_property_list_request_pdu;
+	device->context.PropertyValueRequest = device_send_property_value_request_pdu;
+	device->context.SetPropertyValueRequest = device_send_set_property_value_request_pdu;
+
+	device->buffer = Stream_New(NULL, 4096);
+	if (!device->buffer)
+		goto fail;
+
+	return &device->context;
+fail:
+	camera_device_server_context_free(&device->context);
+	return NULL;
+}
+
+void camera_device_server_context_free(CameraDeviceServerContext* context)
+{
+	device_server* device = (device_server*)context;
+
+	if (device)
+	{
+		device_server_close(context);
+		Stream_Free(device->buffer, TRUE);
+	}
+
+	free(context->virtualChannelName);
+
+	free(device);
+}

channels/rdpei/server/rdpei_main.c

@@ -99,6 +99,8 @@ UINT rdpei_server_init(RdpeiServerContext* context)
 	void* buffer = NULL;
 	DWORD bytesReturned;
 	RdpeiServerPrivate* priv = context->priv;
+	UINT32 channelId;
+	BOOL status = TRUE;
 
 	priv->channelHandle = WTSVirtualChannelOpenEx(WTS_CURRENT_SESSION, RDPEI_DVC_CHANNEL_NAME,
 	                                              WTS_CHANNEL_OPTION_DYNAMIC);
@@ -108,6 +110,15 @@ UINT rdpei_server_init(RdpeiServerContext* context)
 		return CHANNEL_RC_INITIALIZATION_ERROR;
 	}
 
+	channelId = WTSChannelGetIdByHandle(priv->channelHandle);
+
+	IFCALLRET(context->onChannelIdAssigned, status, context, channelId);
+	if (!status)
+	{
+		WLog_ERR(TAG, "context->onChannelIdAssigned failed!");
+		goto out_close;
+	}
+
 	if (!WTSVirtualChannelQuery(priv->channelHandle, WTSVirtualEventHandle, &buffer,
 	                            &bytesReturned) ||
 	    (bytesReturned != sizeof(HANDLE)))

channels/rdpgfx/client/rdpgfx_main.c

@@ -163,11 +163,12 @@ fail:
 static BOOL rdpgfx_is_capability_filtered(RDPGFX_PLUGIN* gfx, UINT32 caps)
 {
 	const UINT32 filter = gfx->capsFilter;
-	const UINT32 capList[] = {
-		RDPGFX_CAPVERSION_8,   RDPGFX_CAPVERSION_81,  RDPGFX_CAPVERSION_10,
-		RDPGFX_CAPVERSION_101, RDPGFX_CAPVERSION_102, RDPGFX_CAPVERSION_103,
-		RDPGFX_CAPVERSION_104, RDPGFX_CAPVERSION_105, RDPGFX_CAPVERSION_106
-	};
+	const UINT32 capList[] = { RDPGFX_CAPVERSION_8,   RDPGFX_CAPVERSION_81,
+		                       RDPGFX_CAPVERSION_10,  RDPGFX_CAPVERSION_101,
+		                       RDPGFX_CAPVERSION_102, RDPGFX_CAPVERSION_103,
+		                       RDPGFX_CAPVERSION_104, RDPGFX_CAPVERSION_105,
+		                       RDPGFX_CAPVERSION_106, RDPGFX_CAPVERSION_106_ERR,
+		                       RDPGFX_CAPVERSION_107 };
 	UINT32 x;
 
 	for (x = 0; x < ARRAYSIZE(capList); x++)
@@ -190,7 +191,7 @@ static UINT rdpgfx_send_supported_caps(RDPGFX_CHANNEL_CALLBACK* callback)
 	RdpgfxClientContext* context;
 	RDPGFX_CAPSET* capsSet;
 	RDPGFX_CAPSET capsSets[RDPGFX_NUMBER_CAPSETS] = { 0 };
-	RDPGFX_CAPS_ADVERTISE_PDU pdu;
+	RDPGFX_CAPS_ADVERTISE_PDU pdu = { 0 };
 
 	if (!callback)
 		return ERROR_BAD_ARGUMENTS;
@@ -323,6 +324,25 @@ static UINT rdpgfx_send_supported_caps(RDPGFX_CHANNEL_CALLBACK* callback)
 			capsSet->length = 0x4;
 			capsSet->flags = caps10Flags;
 		}
+
+		if (!rdpgfx_is_capability_filtered(gfx, RDPGFX_CAPVERSION_106_ERR))
+		{
+			capsSet = &capsSets[pdu.capsSetCount++];
+			capsSet->version = RDPGFX_CAPVERSION_106_ERR;
+			capsSet->length = 0x4;
+			capsSet->flags = caps10Flags;
+		}
+
+		if (!rdpgfx_is_capability_filtered(gfx, RDPGFX_CAPVERSION_107))
+		{
+			capsSet = &capsSets[pdu.capsSetCount++];
+			capsSet->version = RDPGFX_CAPVERSION_107;
+			capsSet->length = 0x4;
+			capsSet->flags = caps10Flags;
+#if !defined(CAIRO_FOUND) && !defined(SWSCALE_FOUND)
+			capsSet->flags |= RDPGFX_CAPS_FLAG_SCALEDMAP_DISABLE;
+#endif
+		}
 	}
 
 	return IFCALLRESULT(ERROR_BAD_CONFIGURATION, context->CapsAdvertise, context, &pdu);
@@ -895,6 +915,8 @@ static UINT rdpgfx_recv_end_frame_pdu(RDPGFX_CHANNEL_CALLBACK* callback, wStream
 		case RDPGFX_CAPVERSION_104:
 		case RDPGFX_CAPVERSION_105:
 		case RDPGFX_CAPVERSION_106:
+		case RDPGFX_CAPVERSION_106_ERR:
+		case RDPGFX_CAPVERSION_107:
 			if (gfx->SendQoeAck)
 			{
 				RDPGFX_QOE_FRAME_ACKNOWLEDGE_PDU qoe;

channels/rdpgfx/rdpgfx_common.c

@@ -24,12 +24,10 @@
 #endif
 
 #include <winpr/crt.h>
-#include <assert.h>
+#include <winpr/assert.h>
 #include <winpr/stream.h>
 #include <freerdp/channels/log.h>
 
-#define WINPR_ASSERT(x) assert(x)
-
 #define TAG CHANNELS_TAG("rdpgfx.common")
 
 #include "rdpgfx_common.h"

channels/rdpgfx/server/rdpgfx_main.c

@@ -1428,6 +1428,8 @@ static BOOL rdpgfx_server_open(RdpgfxServerContext* context)
 		PULONG pSessionId = NULL;
 		DWORD BytesReturned = 0;
 		priv->SessionId = WTS_CURRENT_SESSION;
+		UINT32 channelId;
+		BOOL status = TRUE;
 
 		if (WTSQuerySessionInformationA(context->vcm, WTS_CURRENT_SESSION, WTSSessionId,
 		                                (LPSTR*)&pSessionId, &BytesReturned) == FALSE)
@@ -1447,6 +1449,15 @@ static BOOL rdpgfx_server_open(RdpgfxServerContext* context)
 			return FALSE;
 		}
 
+		channelId = WTSChannelGetIdByHandle(priv->rdpgfx_channel);
+
+		IFCALLRET(context->ChannelIdAssigned, status, context, channelId);
+		if (!status)
+		{
+			WLog_ERR(TAG, "context->ChannelIdAssigned failed!");
+			goto out_close;
+		}
+
 		/* Query for channel event handle */
 		if (!WTSVirtualChannelQuery(priv->rdpgfx_channel, WTSVirtualEventHandle, &buffer,
 		                            &BytesReturned) ||

channels/rdpsnd/client/alsa/rdpsnd_alsa.c

@@ -213,10 +213,6 @@ static BOOL rdpsnd_alsa_set_format(rdpsndDevicePlugin* device, const AUDIO_FORMA
 
 				break;
 
-			case WAVE_FORMAT_ALAW:
-			case WAVE_FORMAT_MULAW:
-				break;
-
 			default:
 				return FALSE;
 		}

channels/rdpsnd/client/mac/rdpsnd_mac.m

@@ -139,86 +139,99 @@ static void rdpsnd_mac_release(rdpsndMacPlugin *mac)
 
 static BOOL rdpsnd_mac_open(rdpsndDevicePlugin *device, const AUDIO_FORMAT *format, UINT32 latency)
 {
-	AudioDeviceID outputDeviceID;
-	UInt32 propertySize;
-	OSStatus err;
-	NSError *error;
-	rdpsndMacPlugin *mac = (rdpsndMacPlugin *)device;
-	AudioObjectPropertyAddress propertyAddress = { kAudioHardwarePropertyDefaultOutputDevice,
-		                                           kAudioObjectPropertyScopeGlobal,
-		                                           kAudioObjectPropertyElementMaster };
+	@autoreleasepool
+	{
+		AudioDeviceID outputDeviceID;
+		UInt32 propertySize;
+		OSStatus err;
+		NSError *error;
+		rdpsndMacPlugin *mac = (rdpsndMacPlugin *)device;
+		AudioObjectPropertyAddress propertyAddress = {
+			kAudioHardwarePropertyDefaultOutputDevice,
+			kAudioObjectPropertyScopeGlobal,
+#if defined(MAC_OS_VERSION_12_0)
+			kAudioObjectPropertyElementMain
+#else
+			kAudioObjectPropertyElementMaster
+#endif
+		};
 
-	if (mac->isOpen)
+		if (mac->isOpen)
+			return TRUE;
+
+		if (!rdpsnd_mac_set_format(device, format, latency))
+			return FALSE;
+
+		propertySize = sizeof(outputDeviceID);
+		err = AudioObjectGetPropertyData(kAudioObjectSystemObject, &propertyAddress, 0, NULL,
+		                                 &propertySize, &outputDeviceID);
+		if (err)
+		{
+			WLog_ERR(TAG, "AudioHardwareGetProperty: %s", FormatError(err));
+			return FALSE;
+		}
+
+		mac->engine = [[AVAudioEngine alloc] init];
+		if (!mac->engine)
+			return FALSE;
+
+		err = AudioUnitSetProperty(mac->engine.outputNode.audioUnit,
+		                           kAudioOutputUnitProperty_CurrentDevice, kAudioUnitScope_Global,
+		                           0, &outputDeviceID, sizeof(outputDeviceID));
+		if (err)
+		{
+			rdpsnd_mac_release(mac);
+			WLog_ERR(TAG, "AudioUnitSetProperty: %s", FormatError(err));
+			return FALSE;
+		}
+
+		mac->player = [[AVAudioPlayerNode alloc] init];
+		if (!mac->player)
+		{
+			rdpsnd_mac_release(mac);
+			WLog_ERR(TAG, "AVAudioPlayerNode::init() failed");
+			return FALSE;
+		}
+
+		[mac->engine attachNode:mac->player];
+
+		[mac->engine connect:mac->player to:mac->engine.mainMixerNode format:nil];
+
+		[mac->engine prepare];
+
+		if (![mac->engine startAndReturnError:&error])
+		{
+			device->Close(device);
+			WLog_ERR(TAG, "Failed to start audio player %s",
+			         [error.localizedDescription UTF8String]);
+			return FALSE;
+		}
+
+		mac->isOpen = TRUE;
 		return TRUE;
-
-	if (!rdpsnd_mac_set_format(device, format, latency))
-		return FALSE;
-
-	propertySize = sizeof(outputDeviceID);
-	err = AudioObjectGetPropertyData(kAudioObjectSystemObject, &propertyAddress, 0, NULL,
-	                                 &propertySize, &outputDeviceID);
-	if (err)
-	{
-		WLog_ERR(TAG, "AudioHardwareGetProperty: %s", FormatError(err));
-		return FALSE;
 	}
-
-	mac->engine = [[AVAudioEngine alloc] init];
-	if (!mac->engine)
-		return FALSE;
-
-	err = AudioUnitSetProperty(mac->engine.outputNode.audioUnit,
-	                           kAudioOutputUnitProperty_CurrentDevice, kAudioUnitScope_Global, 0,
-	                           &outputDeviceID, sizeof(outputDeviceID));
-	if (err)
-	{
-		rdpsnd_mac_release(mac);
-		WLog_ERR(TAG, "AudioUnitSetProperty: %s", FormatError(err));
-		return FALSE;
-	}
-
-	mac->player = [[AVAudioPlayerNode alloc] init];
-	if (!mac->player)
-	{
-		rdpsnd_mac_release(mac);
-		WLog_ERR(TAG, "AVAudioPlayerNode::init() failed");
-		return FALSE;
-	}
-
-	[mac->engine attachNode:mac->player];
-
-	[mac->engine connect:mac->player to:mac->engine.mainMixerNode format:nil];
-
-	[mac->engine prepare];
-
-	if (![mac->engine startAndReturnError:&error])
-	{
-		device->Close(device);
-		WLog_ERR(TAG, "Failed to start audio player %s", [error.localizedDescription UTF8String]);
-		return FALSE;
-	}
-
-	mac->isOpen = TRUE;
-	return TRUE;
 }
 
 static void rdpsnd_mac_close(rdpsndDevicePlugin *device)
 {
-	rdpsndMacPlugin *mac = (rdpsndMacPlugin *)device;
-
-	if (mac->isPlaying)
+	@autoreleasepool
 	{
-		[mac->player stop];
-		mac->isPlaying = FALSE;
-	}
+		rdpsndMacPlugin *mac = (rdpsndMacPlugin *)device;
 
-	if (mac->isOpen)
-	{
-		[mac->engine stop];
-		mac->isOpen = FALSE;
-	}
+		if (mac->isPlaying)
+		{
+			[mac->player stop];
+			mac->isPlaying = FALSE;
+		}
 
-	rdpsnd_mac_release(mac);
+		if (mac->isOpen)
+		{
+			[mac->engine stop];
+			mac->isOpen = FALSE;
+		}
+
+		rdpsnd_mac_release(mac);
+	}
 }
 
 static void rdpsnd_mac_free(rdpsndDevicePlugin *device)
@@ -246,108 +259,118 @@ static BOOL rdpsnd_mac_format_supported(rdpsndDevicePlugin *device, const AUDIO_
 
 static BOOL rdpsnd_mac_set_volume(rdpsndDevicePlugin *device, UINT32 value)
 {
-	Float32 fVolume;
-	UINT16 volumeLeft;
-	UINT16 volumeRight;
-	rdpsndMacPlugin *mac = (rdpsndMacPlugin *)device;
+	@autoreleasepool
+	{
+		Float32 fVolume;
+		UINT16 volumeLeft;
+		UINT16 volumeRight;
+		rdpsndMacPlugin *mac = (rdpsndMacPlugin *)device;
 
-	if (!mac->player)
-		return FALSE;
+		if (!mac->player)
+			return FALSE;
 
-	volumeLeft = (value & 0xFFFF);
-	volumeRight = ((value >> 16) & 0xFFFF);
-	fVolume = ((float)volumeLeft) / 65535.0f;
+		volumeLeft = (value & 0xFFFF);
+		volumeRight = ((value >> 16) & 0xFFFF);
+		fVolume = ((float)volumeLeft) / 65535.0f;
 
-	mac->player.volume = fVolume;
+		mac->player.volume = fVolume;
 
-	return TRUE;
+		return TRUE;
+	}
 }
 
 static void rdpsnd_mac_start(rdpsndDevicePlugin *device)
 {
-	rdpsndMacPlugin *mac = (rdpsndMacPlugin *)device;
-
-	if (!mac->isPlaying)
+	@autoreleasepool
 	{
-		if (!mac->engine.isRunning)
+		rdpsndMacPlugin *mac = (rdpsndMacPlugin *)device;
+
+		if (!mac->isPlaying)
 		{
-			NSError *error;
-
-			if (![mac->engine startAndReturnError:&error])
+			if (!mac->engine.isRunning)
 			{
-				device->Close(device);
-				WLog_ERR(TAG, "Failed to start audio player %s",
-				         [error.localizedDescription UTF8String]);
-				return;
+				NSError *error;
+
+				if (![mac->engine startAndReturnError:&error])
+				{
+					device->Close(device);
+					WLog_ERR(TAG, "Failed to start audio player %s",
+					         [error.localizedDescription UTF8String]);
+					return;
+				}
 			}
+
+			[mac->player play];
+
+			mac->isPlaying = TRUE;
+			mac->diff = 100; /* Initial latency, corrected after first sample is played. */
 		}
-
-		[mac->player play];
-
-		mac->isPlaying = TRUE;
-		mac->diff = 100; /* Initial latency, corrected after first sample is played. */
 	}
 }
 
 static UINT rdpsnd_mac_play(rdpsndDevicePlugin *device, const BYTE *data, size_t size)
 {
-	rdpsndMacPlugin *mac = (rdpsndMacPlugin *)device;
-	AVAudioPCMBuffer *buffer;
-	AVAudioFormat *format;
-	float *const *db;
-	size_t pos, step, x;
-	AVAudioFrameCount count;
-	UINT64 start = GetTickCount64();
-
-	if (!mac->isOpen)
-		return 0;
-
-	step = 2 * mac->format.nChannels;
-
-	count = size / step;
-	format = [[AVAudioFormat alloc] initWithCommonFormat:AVAudioPCMFormatFloat32
-	                                          sampleRate:mac->format.nSamplesPerSec
-	                                            channels:mac->format.nChannels
-	                                         interleaved:NO];
-	if (!format)
+	@autoreleasepool
 	{
-		WLog_WARN(TAG, "AVAudioFormat::init() failed");
-		return 0;
-	}
-	buffer = [[AVAudioPCMBuffer alloc] initWithPCMFormat:format frameCapacity:count];
-	if (!buffer)
-	{
-		[format release];
-		WLog_WARN(TAG, "AVAudioPCMBuffer::init() failed");
-		return 0;
-	}
+		rdpsndMacPlugin *mac = (rdpsndMacPlugin *)device;
+		AVAudioPCMBuffer *buffer;
+		AVAudioFormat *format;
+		float *const *db;
+		size_t pos, step, x;
+		AVAudioFrameCount count;
+		UINT64 start = GetTickCount64();
 
-	buffer.frameLength = buffer.frameCapacity;
-	db = buffer.floatChannelData;
+		if (!mac->isOpen)
+			return 0;
 
-	for (pos = 0; pos < count; pos++)
-	{
-		const BYTE *d = &data[pos * step];
-		for (x = 0; x < mac->format.nChannels; x++)
+		step = 2 * mac->format.nChannels;
+
+		count = size / step;
+		format = [[AVAudioFormat alloc] initWithCommonFormat:AVAudioPCMFormatFloat32
+		                                          sampleRate:mac->format.nSamplesPerSec
+		                                            channels:mac->format.nChannels
+		                                         interleaved:NO];
+		if (!format)
 		{
-			const float val = (int16_t)((uint16_t)d[0] | ((uint16_t)d[1] << 8)) / 32768.0f;
-			db[x][pos] = val;
-			d += sizeof(int16_t);
+			WLog_WARN(TAG, "AVAudioFormat::init() failed");
+			return 0;
 		}
+		buffer = [[AVAudioPCMBuffer alloc] initWithPCMFormat:format frameCapacity:count];
+		[format release];
+		if (!buffer)
+		{
+			WLog_WARN(TAG, "AVAudioPCMBuffer::init() failed");
+			return 0;
+		}
+
+		buffer.frameLength = buffer.frameCapacity;
+		db = buffer.floatChannelData;
+
+		for (pos = 0; pos < count; pos++)
+		{
+			const BYTE *d = &data[pos * step];
+			for (x = 0; x < mac->format.nChannels; x++)
+			{
+				const float val = (int16_t)((uint16_t)d[0] | ((uint16_t)d[1] << 8)) / 32768.0f;
+				db[x][pos] = val;
+				d += sizeof(int16_t);
+			}
+		}
+
+		rdpsnd_mac_start(device);
+
+		[mac->player scheduleBuffer:buffer
+		          completionHandler:^{
+			          UINT64 stop = GetTickCount64();
+			          if (start > stop)
+				          mac->diff = 0;
+			          else
+				          mac->diff = stop - start;
+		          }];
+		[buffer release];
+
+		return mac->diff > UINT_MAX ? UINT_MAX : mac->diff;
 	}
-
-	rdpsnd_mac_start(device);
-
-	[mac->player scheduleBuffer:buffer
-	          completionHandler:^{
-		          UINT64 stop = GetTickCount64();
-		          if (start > stop)
-			          mac->diff = 0;
-		          else
-			          mac->diff = stop - start;
-	          }];
-
-	return mac->diff > UINT_MAX ? UINT_MAX : mac->diff;
 }
 
 #ifdef BUILTIN_CHANNELS

channels/rdpsnd/client/oss/rdpsnd_oss.c

@@ -117,10 +117,6 @@ static BOOL rdpsnd_oss_format_supported(rdpsndDevicePlugin* device, const AUDIO_
 
 			break;
 
-		case WAVE_FORMAT_MULAW:
-		case WAVE_FORMAT_ALAW:
-			break;
-
 		default:
 			return FALSE;
 	}

channels/rdpsnd/client/proxy/CMakeLists.txt

@@ -25,6 +25,9 @@ include_directories(..)
 
 add_channel_client_subsystem_library(${MODULE_PREFIX} ${MODULE_NAME} ${CHANNEL_NAME} "" TRUE "")
 
+if (NOT BUILTIN_CHANNELS)
+	list(APPEND ${MODULE_PREFIX}_LIBS freerdp-client)
+endif()
 list(APPEND ${MODULE_PREFIX}_LIBS freerdp)
 list(APPEND ${MODULE_PREFIX}_LIBS winpr)
 

channels/rdpsnd/client/pulse/rdpsnd_pulse.c

@@ -23,11 +23,15 @@
 #include "config.h"
 #endif
 
+#include <errno.h>
+
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <time.h>
 
 #include <winpr/crt.h>
+#include <winpr/assert.h>
 #include <winpr/stream.h>
 #include <winpr/cmdline.h>
 
@@ -51,8 +55,39 @@ struct rdpsnd_pulse_plugin
 	pa_stream* stream;
 	UINT32 latency;
 	UINT32 volume;
+	time_t reconnect_delay_seconds;
+	time_t reconnect_time;
 };
 
+static BOOL rdpsnd_check_pulse(rdpsndPulsePlugin* pulse, BOOL haveStream)
+{
+	BOOL rc = TRUE;
+	WINPR_ASSERT(pulse);
+
+	if (!pulse->context)
+	{
+		WLog_WARN(TAG, "pulse->context=%p", pulse->context);
+		rc = FALSE;
+	}
+
+	if (haveStream)
+	{
+		if (!pulse->stream)
+		{
+			WLog_WARN(TAG, "pulse->stream=%p", pulse->stream);
+			rc = FALSE;
+		}
+	}
+
+	if (!pulse->mainloop)
+	{
+		WLog_WARN(TAG, "pulse->mainloop=%p", pulse->mainloop);
+		rc = FALSE;
+	}
+
+	return rc;
+}
+
 static BOOL rdpsnd_pulse_format_supported(rdpsndDevicePlugin* device, const AUDIO_FORMAT* format);
 
 static void rdpsnd_pulse_get_sink_info(pa_context* c, const pa_sink_info* i, int eol,
@@ -65,7 +100,8 @@ static void rdpsnd_pulse_get_sink_info(pa_context* c, const pa_sink_info* i, int
 	;
 	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)userdata;
 
-	if (!pulse || !c || !i)
+	WINPR_ASSERT(c);
+	if (!rdpsnd_check_pulse(pulse, FALSE) || !i)
 		return;
 
 	for (x = 0; x < i->volume.channels; x++)
@@ -97,6 +133,10 @@ static void rdpsnd_pulse_context_state_callback(pa_context* context, void* userd
 {
 	pa_context_state_t state;
 	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)userdata;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(pulse);
+
 	state = pa_context_get_state(context);
 
 	switch (state)
@@ -106,6 +146,14 @@ static void rdpsnd_pulse_context_state_callback(pa_context* context, void* userd
 			break;
 
 		case PA_CONTEXT_FAILED:
+			// Destroy context now, create new one for next connection attempt
+			pa_context_unref(pulse->context);
+			pulse->context = NULL;
+			if (pulse->reconnect_delay_seconds >= 0)
+				pulse->reconnect_time = time(NULL) + pulse->reconnect_delay_seconds;
+			pa_threaded_mainloop_signal(pulse->mainloop, 0);
+			break;
+
 		case PA_CONTEXT_TERMINATED:
 			pa_threaded_mainloop_signal(pulse->mainloop, 0);
 			break;
@@ -117,21 +165,17 @@ static void rdpsnd_pulse_context_state_callback(pa_context* context, void* userd
 
 static BOOL rdpsnd_pulse_connect(rdpsndDevicePlugin* device)
 {
+	BOOL rc;
 	pa_operation* o;
 	pa_context_state_t state;
 	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)device;
 
-	if (!pulse->context)
+	if (!rdpsnd_check_pulse(pulse, FALSE))
 		return FALSE;
 
-	if (pa_context_connect(pulse->context, NULL, 0, NULL))
-	{
-		return FALSE;
-	}
-
 	pa_threaded_mainloop_lock(pulse->mainloop);
 
-	if (pa_threaded_mainloop_start(pulse->mainloop) < 0)
+	if (pa_context_connect(pulse->context, NULL, 0, NULL) < 0)
 	{
 		pa_threaded_mainloop_unlock(pulse->mainloop);
 		return FALSE;
@@ -157,27 +201,35 @@ static BOOL rdpsnd_pulse_connect(rdpsndDevicePlugin* device)
 	if (o)
 		pa_operation_unref(o);
 
-	pa_threaded_mainloop_unlock(pulse->mainloop);
-
 	if (state == PA_CONTEXT_READY)
 	{
-		return TRUE;
+		rc = TRUE;
 	}
 	else
 	{
 		pa_context_disconnect(pulse->context);
-		return FALSE;
+		rc = FALSE;
 	}
+
+	pa_threaded_mainloop_unlock(pulse->mainloop);
+	return rc;
 }
 
 static void rdpsnd_pulse_stream_success_callback(pa_stream* stream, int success, void* userdata)
 {
 	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)userdata;
+
+	if (!rdpsnd_check_pulse(pulse, TRUE))
+		return;
+
 	pa_threaded_mainloop_signal(pulse->mainloop, 0);
 }
 
 static void rdpsnd_pulse_wait_for_operation(rdpsndPulsePlugin* pulse, pa_operation* operation)
 {
+	if (!rdpsnd_check_pulse(pulse, TRUE))
+		return;
+
 	if (!operation)
 		return;
 
@@ -193,6 +245,11 @@ static void rdpsnd_pulse_stream_state_callback(pa_stream* stream, void* userdata
 {
 	pa_stream_state_t state;
 	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)userdata;
+
+	WINPR_ASSERT(stream);
+	if (!rdpsnd_check_pulse(pulse, TRUE))
+		return;
+
 	state = pa_stream_get_state(stream);
 
 	switch (state)
@@ -203,6 +260,8 @@ static void rdpsnd_pulse_stream_state_callback(pa_stream* stream, void* userdata
 
 		case PA_STREAM_FAILED:
 		case PA_STREAM_TERMINATED:
+			// Stream object is about to be destroyed, clean up our pointer
+			pulse->stream = NULL;
 			pa_threaded_mainloop_signal(pulse->mainloop, 0);
 			break;
 
@@ -214,6 +273,11 @@ static void rdpsnd_pulse_stream_state_callback(pa_stream* stream, void* userdata
 static void rdpsnd_pulse_stream_request_callback(pa_stream* stream, size_t length, void* userdata)
 {
 	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)userdata;
+
+	WINPR_ASSERT(stream);
+	if (!rdpsnd_check_pulse(pulse, TRUE))
+		return;
+
 	pa_threaded_mainloop_signal(pulse->mainloop, 0);
 }
 
@@ -221,15 +285,20 @@ static void rdpsnd_pulse_close(rdpsndDevicePlugin* device)
 {
 	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)device;
 
-	if (!pulse->context || !pulse->stream)
+	WINPR_ASSERT(pulse);
+
+	if (!rdpsnd_check_pulse(pulse, FALSE))
 		return;
 
 	pa_threaded_mainloop_lock(pulse->mainloop);
-	rdpsnd_pulse_wait_for_operation(
-	    pulse, pa_stream_drain(pulse->stream, rdpsnd_pulse_stream_success_callback, pulse));
-	pa_stream_disconnect(pulse->stream);
-	pa_stream_unref(pulse->stream);
-	pulse->stream = NULL;
+	if (pulse->stream)
+	{
+		rdpsnd_pulse_wait_for_operation(
+		    pulse, pa_stream_drain(pulse->stream, rdpsnd_pulse_stream_success_callback, pulse));
+		pa_stream_disconnect(pulse->stream);
+		pa_stream_unref(pulse->stream);
+		pulse->stream = NULL;
+	}
 	pa_threaded_mainloop_unlock(pulse->mainloop);
 }
 
@@ -237,7 +306,9 @@ static BOOL rdpsnd_pulse_set_format_spec(rdpsndPulsePlugin* pulse, const AUDIO_F
 {
 	pa_sample_spec sample_spec = { 0 };
 
-	if (!pulse->context)
+	WINPR_ASSERT(format);
+
+	if (!rdpsnd_check_pulse(pulse, FALSE))
 		return FALSE;
 
 	if (!rdpsnd_pulse_format_supported(&pulse->device, format))
@@ -281,30 +352,52 @@ static BOOL rdpsnd_pulse_set_format_spec(rdpsndPulsePlugin* pulse, const AUDIO_F
 	return TRUE;
 }
 
-static BOOL rdpsnd_pulse_open(rdpsndDevicePlugin* device, const AUDIO_FORMAT* format,
-                              UINT32 latency)
+static BOOL rdpsnd_pulse_context_connect(rdpsndDevicePlugin* device)
+{
+	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)device;
+
+	pulse->context = pa_context_new(pa_threaded_mainloop_get_api(pulse->mainloop), "freerdp");
+
+	if (!pulse->context)
+		return FALSE;
+
+	pa_context_set_state_callback(pulse->context, rdpsnd_pulse_context_state_callback, pulse);
+
+	if (!rdpsnd_pulse_connect((rdpsndDevicePlugin*)pulse))
+		return FALSE;
+
+	return TRUE;
+}
+
+static BOOL rdpsnd_pulse_open_stream(rdpsndDevicePlugin* device)
 {
 	pa_stream_state_t state;
 	pa_stream_flags_t flags;
 	pa_buffer_attr buffer_attr = { 0 };
-	char ss[PA_SAMPLE_SPEC_SNPRINT_MAX];
+	char ss[PA_SAMPLE_SPEC_SNPRINT_MAX] = { 0 };
 	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)device;
 
-	if (!pulse->context || pulse->stream)
-		return TRUE;
-
-	if (!rdpsnd_pulse_set_format_spec(pulse, format))
-		return FALSE;
-
-	pulse->latency = latency;
-
 	if (pa_sample_spec_valid(&pulse->sample_spec) == 0)
 	{
 		pa_sample_spec_snprint(ss, sizeof(ss), &pulse->sample_spec);
-		return TRUE;
+		return FALSE;
 	}
 
 	pa_threaded_mainloop_lock(pulse->mainloop);
+	if (!pulse->context)
+	{
+		pa_threaded_mainloop_unlock(pulse->mainloop);
+		if (pulse->reconnect_delay_seconds >= 0 && time(NULL) - pulse->reconnect_time >= 0)
+			rdpsnd_pulse_context_connect(device);
+		pa_threaded_mainloop_lock(pulse->mainloop);
+	}
+
+	if (!rdpsnd_check_pulse(pulse, FALSE))
+	{
+		pa_threaded_mainloop_unlock(pulse->mainloop);
+		return FALSE;
+	}
+
 	pulse->stream = pa_stream_new(pulse->context, "freerdp", &pulse->sample_spec, NULL);
 
 	if (!pulse->stream)
@@ -320,19 +413,22 @@ static BOOL rdpsnd_pulse_open(rdpsndDevicePlugin* device, const AUDIO_FORMAT* fo
 
 	if (pulse->latency > 0)
 	{
-		buffer_attr.maxlength = pa_usec_to_bytes(pulse->latency * 2 * 1000, &pulse->sample_spec);
+		buffer_attr.maxlength = UINT32_MAX;
 		buffer_attr.tlength = pa_usec_to_bytes(pulse->latency * 1000, &pulse->sample_spec);
-		buffer_attr.prebuf = (UINT32)-1;
-		buffer_attr.minreq = (UINT32)-1;
-		buffer_attr.fragsize = (UINT32)-1;
+		buffer_attr.prebuf = UINT32_MAX;
+		buffer_attr.minreq = UINT32_MAX;
+		buffer_attr.fragsize = UINT32_MAX;
 		flags |= PA_STREAM_ADJUST_LATENCY;
 	}
 
 	if (pa_stream_connect_playback(pulse->stream, pulse->device_name,
 	                               pulse->latency > 0 ? &buffer_attr : NULL, flags, NULL, NULL) < 0)
 	{
+		WLog_ERR(TAG, "error connecting playback stream");
+		pa_stream_unref(pulse->stream);
+		pulse->stream = NULL;
 		pa_threaded_mainloop_unlock(pulse->mainloop);
-		return TRUE;
+		return FALSE;
 	}
 
 	for (;;)
@@ -359,6 +455,24 @@ static BOOL rdpsnd_pulse_open(rdpsndDevicePlugin* device, const AUDIO_FORMAT* fo
 	return FALSE;
 }
 
+static BOOL rdpsnd_pulse_open(rdpsndDevicePlugin* device, const AUDIO_FORMAT* format,
+                              UINT32 latency)
+{
+	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)device;
+
+	WINPR_ASSERT(format);
+
+	if (!rdpsnd_check_pulse(pulse, FALSE))
+		return TRUE;
+
+	if (!rdpsnd_pulse_set_format_spec(pulse, format))
+		return FALSE;
+
+	pulse->latency = latency;
+
+	return rdpsnd_pulse_open_stream(device);
+}
+
 static void rdpsnd_pulse_free(rdpsndDevicePlugin* device)
 {
 	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)device;
@@ -369,9 +483,7 @@ static void rdpsnd_pulse_free(rdpsndDevicePlugin* device)
 	rdpsnd_pulse_close(device);
 
 	if (pulse->mainloop)
-	{
 		pa_threaded_mainloop_stop(pulse->mainloop);
-	}
 
 	if (pulse->context)
 	{
@@ -394,6 +506,7 @@ static BOOL rdpsnd_pulse_default_format(rdpsndDevicePlugin* device, const AUDIO_
                                         AUDIO_FORMAT* defaultFormat)
 {
 	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)device;
+
 	if (!pulse || !defaultFormat)
 		return FALSE;
 
@@ -415,6 +528,9 @@ static BOOL rdpsnd_pulse_default_format(rdpsndDevicePlugin* device, const AUDIO_
 
 BOOL rdpsnd_pulse_format_supported(rdpsndDevicePlugin* device, const AUDIO_FORMAT* format)
 {
+	WINPR_ASSERT(device);
+	WINPR_ASSERT(format);
+
 	switch (format->wFormatTag)
 	{
 		case WAVE_FORMAT_PCM:
@@ -427,15 +543,7 @@ BOOL rdpsnd_pulse_format_supported(rdpsndDevicePlugin* device, const AUDIO_FORMA
 
 			break;
 
-		case WAVE_FORMAT_ALAW:
-		case WAVE_FORMAT_MULAW:
-			if (format->cbSize == 0 && (format->nSamplesPerSec <= PA_RATE_MAX) &&
-			    (format->wBitsPerSample == 8) &&
-			    (format->nChannels >= 1 && format->nChannels <= PA_CHANNELS_MAX))
-			{
-				return TRUE;
-			}
-
+		default:
 			break;
 	}
 
@@ -447,39 +555,51 @@ static UINT32 rdpsnd_pulse_get_volume(rdpsndDevicePlugin* device)
 	pa_operation* o;
 	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)device;
 
-	if (!pulse)
-		return 0;
-
-	if (!pulse->context || !pulse->mainloop)
+	if (!rdpsnd_check_pulse(pulse, FALSE))
 		return 0;
 
 	pa_threaded_mainloop_lock(pulse->mainloop);
 	o = pa_context_get_sink_info_by_index(pulse->context, 0, rdpsnd_pulse_get_sink_info, pulse);
-	pa_operation_unref(o);
+	if (o)
+		pa_operation_unref(o);
 	pa_threaded_mainloop_unlock(pulse->mainloop);
 	return pulse->volume;
 }
 
+static void rdpsnd_set_volume_success_cb(pa_context* c, int success, void* userdata)
+{
+	rdpsndPulsePlugin* pulse = userdata;
+
+	if (!rdpsnd_check_pulse(pulse, TRUE))
+		return;
+	WINPR_ASSERT(c);
+
+	WLog_INFO(TAG, "%s: %d", __FUNCTION__, success);
+}
+
 static BOOL rdpsnd_pulse_set_volume(rdpsndDevicePlugin* device, UINT32 value)
 {
-	pa_cvolume cv;
+	pa_cvolume cv = { 0 };
 	pa_volume_t left;
 	pa_volume_t right;
 	pa_operation* operation;
 	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)device;
 
-	if (!pulse->context || !pulse->stream)
+	if (!rdpsnd_check_pulse(pulse, TRUE))
+	{
+		WLog_WARN(TAG, "%s called before pulse backend was initialized");
 		return FALSE;
+	}
 
 	left = (pa_volume_t)(value & 0xFFFF);
 	right = (pa_volume_t)((value >> 16) & 0xFFFF);
 	pa_cvolume_init(&cv);
 	cv.channels = 2;
-	cv.values[0] = PA_VOLUME_MUTED + (left * (PA_VOLUME_NORM - PA_VOLUME_MUTED)) / 0xFFFF;
-	cv.values[1] = PA_VOLUME_MUTED + (right * (PA_VOLUME_NORM - PA_VOLUME_MUTED)) / 0xFFFF;
+	cv.values[0] = PA_VOLUME_MUTED + (left * (PA_VOLUME_NORM - PA_VOLUME_MUTED)) / PA_VOLUME_NORM;
+	cv.values[1] = PA_VOLUME_MUTED + (right * (PA_VOLUME_NORM - PA_VOLUME_MUTED)) / PA_VOLUME_NORM;
 	pa_threaded_mainloop_lock(pulse->mainloop);
 	operation = pa_context_set_sink_input_volume(pulse->context, pa_stream_get_index(pulse->stream),
-	                                             &cv, NULL, NULL);
+	                                             &cv, rdpsnd_set_volume_success_cb, pulse);
 
 	if (operation)
 		pa_operation_unref(operation);
@@ -491,28 +611,38 @@ static BOOL rdpsnd_pulse_set_volume(rdpsndDevicePlugin* device, UINT32 value)
 static UINT rdpsnd_pulse_play(rdpsndDevicePlugin* device, const BYTE* data, size_t size)
 {
 	size_t length;
+	void* pa_data;
 	int status;
 	pa_usec_t latency;
 	int negative;
 	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)device;
 
-	if (!pulse->stream || !data)
+	if (!data)
 		return 0;
 
 	pa_threaded_mainloop_lock(pulse->mainloop);
 
+	if (!rdpsnd_check_pulse(pulse, TRUE))
+	{
+		pa_threaded_mainloop_unlock(pulse->mainloop);
+		// Discard this playback request and just attempt to reconnect the stream
+		WLog_DBG(TAG, "reconnecting playback stream");
+		rdpsnd_pulse_open_stream(device);
+		return 0;
+	}
+
 	while (size > 0)
 	{
-		while ((length = pa_stream_writable_size(pulse->stream)) == 0)
-			pa_threaded_mainloop_wait(pulse->mainloop);
+		length = size;
 
-		if (length == (size_t)-1)
+		status = pa_stream_begin_write(pulse->stream, &pa_data, &length);
+
+		if (status < 0)
 			break;
 
-		if (length > size)
-			length = size;
+		memcpy(pa_data, data, length);
 
-		status = pa_stream_write(pulse->stream, data, length, NULL, 0LL, PA_SEEK_RELATIVE);
+		status = pa_stream_write(pulse->stream, pa_data, length, NULL, 0LL, PA_SEEK_RELATIVE);
 
 		if (status < 0)
 		{
@@ -530,22 +660,24 @@ static UINT rdpsnd_pulse_play(rdpsndDevicePlugin* device, const BYTE* data, size
 	return latency / 1000;
 }
 
-/**
- * Function description
- *
- * @return 0 on success, otherwise a Win32 error code
- */
 static UINT rdpsnd_pulse_parse_addin_args(rdpsndDevicePlugin* device, ADDIN_ARGV* args)
 {
 	int status;
 	DWORD flags;
 	COMMAND_LINE_ARGUMENT_A* arg;
 	rdpsndPulsePlugin* pulse = (rdpsndPulsePlugin*)device;
-	COMMAND_LINE_ARGUMENT_A rdpsnd_pulse_args[] = { { "dev", COMMAND_LINE_VALUE_REQUIRED,
-		                                              "<device>", NULL, NULL, -1, NULL, "device" },
-		                                            { NULL, 0, NULL, NULL, NULL, -1, NULL, NULL } };
+	COMMAND_LINE_ARGUMENT_A rdpsnd_pulse_args[] = {
+		{ "dev", COMMAND_LINE_VALUE_REQUIRED, "<device>", NULL, NULL, -1, NULL, "device" },
+		{ "reconnect_delay_seconds", COMMAND_LINE_VALUE_REQUIRED, "<reconnect_delay_seconds>", NULL,
+		  NULL, -1, NULL, "reconnect_delay_seconds" },
+		{ NULL, 0, NULL, NULL, NULL, -1, NULL, NULL }
+	};
 	flags =
 	    COMMAND_LINE_SIGIL_NONE | COMMAND_LINE_SEPARATOR_COLON | COMMAND_LINE_IGN_UNKNOWN_KEYWORD;
+
+	WINPR_ASSERT(pulse);
+	WINPR_ASSERT(args);
+
 	status = CommandLineParseArgumentsA(args->argc, args->argv, rdpsnd_pulse_args, flags, pulse,
 	                                    NULL, NULL);
 
@@ -566,6 +698,15 @@ static UINT rdpsnd_pulse_parse_addin_args(rdpsndDevicePlugin* device, ADDIN_ARGV
 			if (!pulse->device_name)
 				return ERROR_OUTOFMEMORY;
 		}
+		CommandLineSwitchCase(arg, "reconnect_delay_seconds")
+		{
+			unsigned long val = strtoul(arg->Value, NULL, 0);
+
+			if ((errno != 0) || (val > INT32_MAX))
+				return ERROR_INVALID_DATA;
+
+			pulse->reconnect_delay_seconds = val;
+		}
 		CommandLineSwitchEnd(arg)
 	} while ((arg = CommandLineFindNextArgumentA(arg)) != NULL);
 
@@ -578,16 +719,14 @@ static UINT rdpsnd_pulse_parse_addin_args(rdpsndDevicePlugin* device, ADDIN_ARGV
 #define freerdp_rdpsnd_client_subsystem_entry FREERDP_API freerdp_rdpsnd_client_subsystem_entry
 #endif
 
-/**
- * Function description
- *
- * @return 0 on success, otherwise a Win32 error code
- */
 UINT freerdp_rdpsnd_client_subsystem_entry(PFREERDP_RDPSND_DEVICE_ENTRY_POINTS pEntryPoints)
 {
 	ADDIN_ARGV* args;
 	rdpsndPulsePlugin* pulse;
 	UINT ret;
+
+	WINPR_ASSERT(pEntryPoints);
+
 	pulse = (rdpsndPulsePlugin*)calloc(1, sizeof(rdpsndPulsePlugin));
 
 	if (!pulse)
@@ -613,6 +752,8 @@ UINT freerdp_rdpsnd_client_subsystem_entry(PFREERDP_RDPSND_DEVICE_ENTRY_POINTS p
 			goto error;
 		}
 	}
+	pulse->reconnect_delay_seconds = 5;
+	pulse->reconnect_time = time(NULL);
 
 	ret = CHANNEL_RC_NO_MEMORY;
 	pulse->mainloop = pa_threaded_mainloop_new();
@@ -620,15 +761,17 @@ UINT freerdp_rdpsnd_client_subsystem_entry(PFREERDP_RDPSND_DEVICE_ENTRY_POINTS p
 	if (!pulse->mainloop)
 		goto error;
 
-	pulse->context = pa_context_new(pa_threaded_mainloop_get_api(pulse->mainloop), "freerdp");
+	pa_threaded_mainloop_lock(pulse->mainloop);
 
-	if (!pulse->context)
-		goto error;
+	if (pa_threaded_mainloop_start(pulse->mainloop) < 0)
+	{
+		pa_threaded_mainloop_unlock(pulse->mainloop);
+		return FALSE;
+	}
 
-	pa_context_set_state_callback(pulse->context, rdpsnd_pulse_context_state_callback, pulse);
-	ret = ERROR_INVALID_OPERATION;
+	pa_threaded_mainloop_unlock(pulse->mainloop);
 
-	if (!rdpsnd_pulse_connect((rdpsndDevicePlugin*)pulse))
+	if (!rdpsnd_pulse_context_connect((rdpsndDevicePlugin*)pulse))
 		goto error;
 
 	pEntryPoints->pRegisterRdpsndDevice(pEntryPoints->rdpsnd, (rdpsndDevicePlugin*)pulse);

channels/rdpsnd/client/rdpsnd_main.c

@@ -126,6 +126,10 @@ struct rdpsnd_plugin
 	HANDLE thread;
 	wMessageQueue* queue;
 	BOOL initialized;
+
+	UINT16 wVersion;
+	UINT32 volume;
+	BOOL applyVolume;
 };
 
 static const char* rdpsnd_is_dyn_str(BOOL dynamic)
@@ -268,9 +272,9 @@ static UINT rdpsnd_send_client_audio_formats(rdpsndPlugin* rdpsnd)
 static UINT rdpsnd_recv_server_audio_formats_pdu(rdpsndPlugin* rdpsnd, wStream* s)
 {
 	UINT16 index;
-	UINT16 wVersion;
 	UINT16 wNumberOfFormats;
 	UINT ret = ERROR_BAD_LENGTH;
+
 	audio_formats_free(rdpsnd->ServerFormats, rdpsnd->NumberOfServerFormats);
 	rdpsnd->NumberOfServerFormats = 0;
 	rdpsnd->ServerFormats = NULL;
@@ -285,7 +289,7 @@ static UINT rdpsnd_recv_server_audio_formats_pdu(rdpsndPlugin* rdpsnd, wStream*
 	Stream_Seek_UINT16(s); /* wDGramPort */
 	Stream_Read_UINT16(s, wNumberOfFormats);
 	Stream_Read_UINT8(s, rdpsnd->cBlockNo); /* cLastBlockConfirmed */
-	Stream_Read_UINT16(s, wVersion);        /* wVersion */
+	Stream_Read_UINT16(s, rdpsnd->wVersion); /* wVersion */
 	Stream_Seek_UINT8(s);                   /* bPad */
 	rdpsnd->NumberOfServerFormats = wNumberOfFormats;
 
@@ -312,7 +316,7 @@ static UINT rdpsnd_recv_server_audio_formats_pdu(rdpsndPlugin* rdpsnd, wStream*
 
 	if (ret == CHANNEL_RC_OK)
 	{
-		if (wVersion >= CHANNEL_VERSION_WIN_7)
+		if (rdpsnd->wVersion >= CHANNEL_VERSION_WIN_7)
 			ret = rdpsnd_send_quality_mode_pdu(rdpsnd);
 	}
 
@@ -373,6 +377,20 @@ static UINT rdpsnd_recv_training_pdu(rdpsndPlugin* rdpsnd, wStream* s)
 	return rdpsnd_send_training_confirm_pdu(rdpsnd, wTimeStamp, wPackSize);
 }
 
+static BOOL rdpsnd_apply_volume(rdpsndPlugin* rdpsnd)
+{
+	WINPR_ASSERT(rdpsnd);
+
+	if (rdpsnd->isOpen && rdpsnd->applyVolume && rdpsnd->device)
+	{
+		BOOL rc = IFCALLRESULT(TRUE, rdpsnd->device->SetVolume, rdpsnd->device, rdpsnd->volume);
+		if (!rc)
+			return FALSE;
+		rdpsnd->applyVolume = FALSE;
+	}
+	return TRUE;
+}
+
 static BOOL rdpsnd_ensure_device_is_open(rdpsndPlugin* rdpsnd, UINT32 wFormatNo,
                                          const AUDIO_FORMAT* format)
 {
@@ -421,7 +439,7 @@ static BOOL rdpsnd_ensure_device_is_open(rdpsndPlugin* rdpsnd, UINT32 wFormatNo,
 		rdpsnd->totalPlaySize = 0;
 	}
 
-	return TRUE;
+	return rdpsnd_apply_volume(rdpsnd);
 }
 
 /**
@@ -582,6 +600,7 @@ static UINT rdpsnd_treat_wave(rdpsndPlugin* rdpsnd, wStream* s, size_t size)
 	UINT64 end;
 	UINT64 diffMS, ts;
 	UINT latency = 0;
+	UINT error;
 
 	if (Stream_GetRemainingLength(s) < size)
 		return ERROR_BAD_LENGTH;
@@ -589,6 +608,15 @@ static UINT rdpsnd_treat_wave(rdpsndPlugin* rdpsnd, wStream* s, size_t size)
 	if (rdpsnd->wCurrentFormatNo >= rdpsnd->NumberOfClientFormats)
 		return ERROR_INTERNAL_ERROR;
 
+	/*
+	 * Send the first WaveConfirm PDU. The server side uses this to determine the
+	 * network latency.
+	 * See also [MS-RDPEA] 2.2.3.8 Wave Confirm PDU
+	 */
+	error = rdpsnd_send_wave_confirm_pdu(rdpsnd, rdpsnd->wTimeStamp, rdpsnd->cBlockNo);
+	if (error)
+		return error;
+
 	data = Stream_Pointer(s);
 	format = &rdpsnd->ClientFormats[rdpsnd->wCurrentFormatNo];
 	WLog_Print(rdpsnd->log, WLOG_DEBUG,
@@ -621,10 +649,11 @@ static UINT rdpsnd_treat_wave(rdpsndPlugin* rdpsnd, wStream* s, size_t size)
 	diffMS = end - rdpsnd->wArrivalTime + latency;
 	ts = (rdpsnd->wTimeStamp + diffMS) % UINT16_MAX;
 
-	/* Don't send wave confirm PDU if on dynamic channel */
-	if (rdpsnd->dynamic)
-		return CHANNEL_RC_OK;
-
+	/*
+	 * Send the second WaveConfirm PDU. With the first WaveConfirm PDU,
+	 * the server side uses this second WaveConfirm PDU to determine the actual
+	 * render latency.
+	 */
 	return rdpsnd_send_wave_confirm_pdu(rdpsnd, (UINT16)ts, rdpsnd->cBlockNo);
 }
 
@@ -699,7 +728,7 @@ static void rdpsnd_recv_close_pdu(rdpsndPlugin* rdpsnd)
  */
 static UINT rdpsnd_recv_volume_pdu(rdpsndPlugin* rdpsnd, wStream* s)
 {
-	BOOL rc = FALSE;
+	BOOL rc = TRUE;
 	UINT32 dwVolume;
 
 	if (Stream_GetRemainingLength(s) < 4)
@@ -708,8 +737,10 @@ static UINT rdpsnd_recv_volume_pdu(rdpsndPlugin* rdpsnd, wStream* s)
 	Stream_Read_UINT32(s, dwVolume);
 	WLog_Print(rdpsnd->log, WLOG_DEBUG, "%s Volume: 0x%08" PRIX32 "",
 	           rdpsnd_is_dyn_str(rdpsnd->dynamic), dwVolume);
-	if (rdpsnd->device)
-		rc = IFCALLRESULT(FALSE, rdpsnd->device->SetVolume, rdpsnd->device, dwVolume);
+
+	rdpsnd->volume = dwVolume;
+	rdpsnd->applyVolume = TRUE;
+	rc = rdpsnd_apply_volume(rdpsnd);
 
 	if (!rc)
 	{

channels/rdpsnd/server/rdpsnd_main.c

@@ -28,6 +28,7 @@
 #include <string.h>
 
 #include <winpr/crt.h>
+#include <winpr/assert.h>
 #include <winpr/print.h>
 #include <winpr/stream.h>
 
@@ -36,17 +37,33 @@
 #include "rdpsnd_common.h"
 #include "rdpsnd_main.h"
 
+static wStream* rdpsnd_server_get_buffer(RdpsndServerContext* context)
+{
+	wStream* s;
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->priv);
+
+	s = context->priv->rdpsnd_pdu;
+	Stream_SetPosition(s, 0);
+	return s;
+}
+
 /**
- * Function description
+ * Send Server Audio Formats and Version PDU (2.2.2.1)
  *
  * @return 0 on success, otherwise a Win32 error code
  */
-static UINT rdpsnd_server_send_formats(RdpsndServerContext* context, wStream* s)
+static UINT rdpsnd_server_send_formats(RdpsndServerContext* context)
 {
+	wStream* s = rdpsnd_server_get_buffer(context);
 	size_t pos;
 	UINT16 i;
 	BOOL status = FALSE;
 	ULONG written;
+
+	if (!Stream_EnsureRemainingCapacity(s, 24))
+		return ERROR_OUTOFMEMORY;
+
 	Stream_Write_UINT8(s, SNDC_FORMATS);
 	Stream_Write_UINT8(s, 0);
 	Stream_Seek_UINT16(s);
@@ -61,12 +78,9 @@ static UINT rdpsnd_server_send_formats(RdpsndServerContext* context, wStream* s)
 
 	for (i = 0; i < context->num_server_formats; i++)
 	{
-		AUDIO_FORMAT format = context->server_formats[i];
-		// TODO: Eliminate this!!!
-		format.nAvgBytesPerSec =
-		    format.nSamplesPerSec * format.nChannels * format.wBitsPerSample / 8;
+		const AUDIO_FORMAT* format = &context->server_formats[i];
 
-		if (!audio_format_write(s, &format))
+		if (!audio_format_write(s, format))
 			goto fail;
 	}
 
@@ -74,6 +88,8 @@ static UINT rdpsnd_server_send_formats(RdpsndServerContext* context, wStream* s)
 	Stream_SetPosition(s, 2);
 	Stream_Write_UINT16(s, pos - 4);
 	Stream_SetPosition(s, pos);
+
+	WINPR_ASSERT(context->priv);
 	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, (PCHAR)Stream_Buffer(s),
 	                                Stream_GetPosition(s), &written);
 	Stream_SetPosition(s, 0);
@@ -82,7 +98,7 @@ fail:
 }
 
 /**
- * Function description
+ * Read Wave Confirm PDU (2.2.3.8) and handle callback
  *
  * @return 0 on success, otherwise a Win32 error code
  */
@@ -92,11 +108,10 @@ static UINT rdpsnd_server_recv_waveconfirm(RdpsndServerContext* context, wStream
 	BYTE confirmBlockNum;
 	UINT error = CHANNEL_RC_OK;
 
-	if (Stream_GetRemainingLength(s) < 4)
-	{
-		WLog_ERR(TAG, "not enough data in stream!");
+	WINPR_ASSERT(context);
+
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 4))
 		return ERROR_INVALID_DATA;
-	}
 
 	Stream_Read_UINT16(s, timestamp);
 	Stream_Read_UINT8(s, confirmBlockNum);
@@ -110,13 +125,39 @@ static UINT rdpsnd_server_recv_waveconfirm(RdpsndServerContext* context, wStream
 }
 
 /**
- * Function description
+ * Read Training Confirm PDU (2.2.3.2) and handle callback
+ *
+ * @return 0 on success, otherwise a Win32 error code
+ */
+static UINT rdpsnd_server_recv_trainingconfirm(RdpsndServerContext* context, wStream* s)
+{
+	UINT16 timestamp;
+	UINT16 packsize;
+	UINT error = CHANNEL_RC_OK;
+
+	WINPR_ASSERT(context);
+
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 4))
+		return ERROR_INVALID_DATA;
+
+	Stream_Read_UINT16(s, timestamp);
+	Stream_Read_UINT16(s, packsize);
+
+	IFCALLRET(context->TrainingConfirm, error, context, timestamp, packsize);
+	if (error)
+		WLog_ERR(TAG, "context->TrainingConfirm failed with error %" PRIu32 "", error);
+
+	return error;
+}
+
+/**
+ * Read Quality Mode PDU (2.2.2.3)
  *
  * @return 0 on success, otherwise a Win32 error code
  */
 static UINT rdpsnd_server_recv_quality_mode(RdpsndServerContext* context, wStream* s)
 {
-	UINT16 quality;
+	WINPR_ASSERT(context);
 
 	if (Stream_GetRemainingLength(s) < 4)
 	{
@@ -124,34 +165,34 @@ static UINT rdpsnd_server_recv_quality_mode(RdpsndServerContext* context, wStrea
 		return ERROR_INVALID_DATA;
 	}
 
-	Stream_Read_UINT16(s, quality);
-	Stream_Seek_UINT16(s); // reserved
-	WLog_DBG(TAG, "Client requested sound quality: 0x%04" PRIX16 "", quality);
+	Stream_Read_UINT16(s, context->qualityMode); /* wQualityMode */
+	Stream_Seek_UINT16(s);                       /* Reserved */
+
+	WLog_DBG(TAG, "Client requested sound quality: 0x%04" PRIX16 "", context->qualityMode);
+
 	return CHANNEL_RC_OK;
 }
 
 /**
- * Function description
+ * Read Client Audio Formats and Version PDU (2.2.2.2)
  *
  * @return 0 on success, otherwise a Win32 error code
  */
 static UINT rdpsnd_server_recv_formats(RdpsndServerContext* context, wStream* s)
 {
 	UINT16 i, num_known_format = 0;
-	UINT32 flags, vol, pitch;
 	UINT16 udpPort;
 	BYTE lastblock;
 	UINT error = CHANNEL_RC_OK;
 
-	if (Stream_GetRemainingLength(s) < 20)
-	{
-		WLog_ERR(TAG, "not enough data in stream!");
-		return ERROR_INVALID_DATA;
-	}
+	WINPR_ASSERT(context);
 
-	Stream_Read_UINT32(s, flags);                       /* dwFlags */
-	Stream_Read_UINT32(s, vol);                         /* dwVolume */
-	Stream_Read_UINT32(s, pitch);                       /* dwPitch */
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 20))
+		return ERROR_INVALID_DATA;
+
+	Stream_Read_UINT32(s, context->capsFlags);          /* dwFlags */
+	Stream_Read_UINT32(s, context->initialVolume);      /* dwVolume */
+	Stream_Read_UINT32(s, context->initialPitch);       /* dwPitch */
 	Stream_Read_UINT16(s, udpPort);                     /* wDGramPort */
 	Stream_Read_UINT16(s, context->num_client_formats); /* wNumberOfFormats */
 	Stream_Read_UINT8(s, lastblock);                    /* cLastBlockConfirmed */
@@ -159,11 +200,8 @@ static UINT rdpsnd_server_recv_formats(RdpsndServerContext* context, wStream* s)
 	Stream_Seek_UINT8(s);                               /* bPad */
 
 	/* this check is only a guess as cbSize can influence the size of a format record */
-	if (Stream_GetRemainingLength(s) < context->num_client_formats * 18)
-	{
-		WLog_ERR(TAG, "not enough data in stream!");
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 18ull * context->num_client_formats))
 		return ERROR_INVALID_DATA;
-	}
 
 	if (!context->num_client_formats)
 	{
@@ -181,24 +219,26 @@ static UINT rdpsnd_server_recv_formats(RdpsndServerContext* context, wStream* s)
 
 	for (i = 0; i < context->num_client_formats; i++)
 	{
-		if (Stream_GetRemainingLength(s) < 18)
+		AUDIO_FORMAT* format = &context->client_formats[i];
+
+		if (!Stream_CheckAndLogRequiredLength(TAG, s, 18))
 		{
 			WLog_ERR(TAG, "not enough data in stream!");
 			error = ERROR_INVALID_DATA;
 			goto out_free;
 		}
 
-		Stream_Read_UINT16(s, context->client_formats[i].wFormatTag);
-		Stream_Read_UINT16(s, context->client_formats[i].nChannels);
-		Stream_Read_UINT32(s, context->client_formats[i].nSamplesPerSec);
-		Stream_Read_UINT32(s, context->client_formats[i].nAvgBytesPerSec);
-		Stream_Read_UINT16(s, context->client_formats[i].nBlockAlign);
-		Stream_Read_UINT16(s, context->client_formats[i].wBitsPerSample);
-		Stream_Read_UINT16(s, context->client_formats[i].cbSize);
+		Stream_Read_UINT16(s, format->wFormatTag);
+		Stream_Read_UINT16(s, format->nChannels);
+		Stream_Read_UINT32(s, format->nSamplesPerSec);
+		Stream_Read_UINT32(s, format->nAvgBytesPerSec);
+		Stream_Read_UINT16(s, format->nBlockAlign);
+		Stream_Read_UINT16(s, format->wBitsPerSample);
+		Stream_Read_UINT16(s, format->cbSize);
 
-		if (context->client_formats[i].cbSize > 0)
+		if (format->cbSize > 0)
 		{
-			if (!Stream_SafeSeek(s, context->client_formats[i].cbSize))
+			if (!Stream_SafeSeek(s, format->cbSize))
 			{
 				WLog_ERR(TAG, "Stream_SafeSeek failed!");
 				error = ERROR_INTERNAL_ERROR;
@@ -206,7 +246,7 @@ static UINT rdpsnd_server_recv_formats(RdpsndServerContext* context, wStream* s)
 			}
 		}
 
-		if (context->client_formats[i].wFormatTag != 0)
+		if (format->wFormatTag != 0)
 		{
 			// lets call this a known format
 			// TODO: actually look through our own list of known formats
@@ -228,15 +268,19 @@ out_free:
 
 static DWORD WINAPI rdpsnd_server_thread(LPVOID arg)
 {
-	DWORD nCount, status;
-	HANDLE events[8];
-	RdpsndServerContext* context;
+	DWORD nCount = 0, status;
+	HANDLE events[2] = { 0 };
+	RdpsndServerContext* context = (RdpsndServerContext*)arg;
 	UINT error = CHANNEL_RC_OK;
-	context = (RdpsndServerContext*)arg;
-	nCount = 0;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->priv);
+
 	events[nCount++] = context->priv->channelEvent;
 	events[nCount++] = context->priv->StopEvent;
 
+	WINPR_ASSERT(nCount <= ARRAYSIZE(events));
+
 	while (TRUE)
 	{
 		status = WaitForMultipleObjects(nCount, events, FALSE, INFINITE);
@@ -281,6 +325,9 @@ static DWORD WINAPI rdpsnd_server_thread(LPVOID arg)
  */
 static UINT rdpsnd_server_initialize(RdpsndServerContext* context, BOOL ownThread)
 {
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->priv);
+
 	context->priv->ownThread = ownThread;
 	return context->Start(context);
 }
@@ -297,6 +344,9 @@ static UINT rdpsnd_server_select_format(RdpsndServerContext* context, UINT16 cli
 	AUDIO_FORMAT* format;
 	UINT error = CHANNEL_RC_OK;
 
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->priv);
+
 	if ((client_format_index >= context->num_client_formats) || (!context->src_format))
 	{
 		WLog_ERR(TAG, "index %d is not correct.", client_format_index);
@@ -371,6 +421,51 @@ out:
 	return error;
 }
 
+/**
+ * Send Training PDU (2.2.3.1)
+ *
+ * @return 0 on success, otherwise a Win32 error code
+ */
+static UINT rdpsnd_server_training(RdpsndServerContext* context, UINT16 timestamp, UINT16 packsize,
+                                   BYTE* data)
+{
+	size_t end = 0;
+	ULONG written;
+	BOOL status;
+	wStream* s = rdpsnd_server_get_buffer(context);
+
+	if (!Stream_EnsureRemainingCapacity(s, 8))
+		return ERROR_INTERNAL_ERROR;
+
+	Stream_Write_UINT8(s, SNDC_TRAINING);
+	Stream_Write_UINT8(s, 0);
+	Stream_Seek_UINT16(s);
+	Stream_Write_UINT16(s, timestamp);
+	Stream_Write_UINT16(s, packsize);
+
+	if (packsize > 0)
+	{
+		if (!Stream_EnsureRemainingCapacity(s, packsize))
+		{
+			Stream_SetPosition(s, 0);
+			return ERROR_INTERNAL_ERROR;
+		}
+
+		Stream_Write(s, data, packsize);
+	}
+
+	end = Stream_GetPosition(s);
+	Stream_SetPosition(s, 2);
+	Stream_Write_UINT16(s, end - 4);
+
+	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, (PCHAR)Stream_Buffer(s), end,
+	                                &written);
+
+	Stream_SetPosition(s, 0);
+
+	return status ? CHANNEL_RC_OK : ERROR_INTERNAL_ERROR;
+}
+
 static BOOL rdpsnd_server_align_wave_pdu(wStream* s, UINT32 alignment)
 {
 	size_t size;
@@ -404,15 +499,21 @@ static UINT rdpsnd_server_send_wave_pdu(RdpsndServerContext* context, UINT16 wTi
 	const BYTE* src;
 	AUDIO_FORMAT* format;
 	ULONG written;
-	wStream* s = context->priv->rdpsnd_pdu;
 	UINT error = CHANNEL_RC_OK;
+	wStream* s = rdpsnd_server_get_buffer(context);
 
-	if (context->selected_client_format >= context->num_client_formats)
+	if (context->selected_client_format > context->num_client_formats)
 		return ERROR_INTERNAL_ERROR;
 
+	WINPR_ASSERT(context->client_formats);
+
 	format = &context->client_formats[context->selected_client_format];
 	/* WaveInfo PDU */
 	Stream_SetPosition(s, 0);
+
+	if (!Stream_EnsureRemainingCapacity(s, 16))
+		return ERROR_OUTOFMEMORY;
+
 	Stream_Write_UINT8(s, SNDC_WAVE);                        /* msgType */
 	Stream_Write_UINT8(s, 0);                                /* bPad */
 	Stream_Write_UINT16(s, 0);                               /* BodySize */
@@ -422,7 +523,7 @@ static UINT rdpsnd_server_send_wave_pdu(RdpsndServerContext* context, UINT16 wTi
 	Stream_Seek(s, 3);                                       /* bPad */
 	start = Stream_GetPosition(s);
 	src = context->priv->out_buffer;
-	length = context->priv->out_pending_frames * context->priv->src_bytes_per_frame * 1ULL;
+	length = 1ull * context->priv->out_pending_frames * context->priv->src_bytes_per_frame;
 
 	if (!freerdp_dsp_encode(context->priv->dsp_context, context->src_format, src, length, s))
 		return ERROR_INTERNAL_ERROR;
@@ -436,7 +537,6 @@ static UINT rdpsnd_server_send_wave_pdu(RdpsndServerContext* context, UINT16 wTi
 		Stream_SetPosition(s, 2);
 		Stream_Write_UINT16(s, end - start + 8);
 		Stream_SetPosition(s, end);
-		context->block_no = (context->block_no + 1) % 256;
 
 		if (!WTSVirtualChannelWrite(context->priv->ChannelHandle, (PCHAR)Stream_Buffer(s),
 		                            start + 4, &written))
@@ -464,6 +564,8 @@ static UINT rdpsnd_server_send_wave_pdu(RdpsndServerContext* context, UINT16 wTi
 		error = ERROR_INTERNAL_ERROR;
 	}
 
+	context->block_no = (context->block_no + 1) % 256;
+
 out:
 	Stream_SetPosition(s, 0);
 	context->priv->out_pending_frames = 0;
@@ -476,59 +578,79 @@ out:
  *
  * @return 0 on success, otherwise a Win32 error code
  */
-static UINT rdpsnd_server_send_wave2_pdu(RdpsndServerContext* context, UINT16 wTimestamp)
+static UINT rdpsnd_server_send_wave2_pdu(RdpsndServerContext* context, UINT16 formatNo,
+                                         const BYTE* data, size_t size, BOOL encoded,
+                                         UINT16 timestamp, UINT32 audioTimeStamp)
 {
-	size_t length;
 	size_t end = 0;
-	const BYTE* src;
-	AUDIO_FORMAT* format;
 	ULONG written;
-	wStream* s = context->priv->rdpsnd_pdu;
 	UINT error = CHANNEL_RC_OK;
+	BOOL status;
+	wStream* s = rdpsnd_server_get_buffer(context);
 
-	if (context->selected_client_format >= context->num_client_formats)
-		return ERROR_INTERNAL_ERROR;
-
-	format = &context->client_formats[context->selected_client_format];
-	/* WaveInfo PDU */
-	Stream_SetPosition(s, 0);
-	Stream_Write_UINT8(s, SNDC_WAVE2);                       /* msgType */
-	Stream_Write_UINT8(s, 0);                                /* bPad */
-	Stream_Write_UINT16(s, 0);                               /* BodySize */
-	Stream_Write_UINT16(s, wTimestamp);                      /* wTimeStamp */
-	Stream_Write_UINT16(s, context->selected_client_format); /* wFormatNo */
-	Stream_Write_UINT8(s, context->block_no);                /* cBlockNo */
-	Stream_Seek(s, 3);                                       /* bPad */
-	Stream_Write_UINT32(s, wTimestamp);                      /* dwAudioTimeStamp */
-	src = context->priv->out_buffer;
-	length = context->priv->out_pending_frames * context->priv->src_bytes_per_frame;
-
-	if (!freerdp_dsp_encode(context->priv->dsp_context, context->src_format, src, length, s))
+	if (!Stream_EnsureRemainingCapacity(s, 16))
+	{
 		error = ERROR_INTERNAL_ERROR;
+		goto out;
+	}
+
+	/* Wave2 PDU */
+	Stream_Write_UINT8(s, SNDC_WAVE2);        /* msgType */
+	Stream_Write_UINT8(s, 0);                 /* bPad */
+	Stream_Write_UINT16(s, 0);                /* BodySize */
+	Stream_Write_UINT16(s, timestamp);        /* wTimeStamp */
+	Stream_Write_UINT16(s, formatNo);         /* wFormatNo */
+	Stream_Write_UINT8(s, context->block_no); /* cBlockNo */
+	Stream_Write_UINT8(s, 0);                 /* bPad */
+	Stream_Write_UINT8(s, 0);                 /* bPad */
+	Stream_Write_UINT8(s, 0);                 /* bPad */
+	Stream_Write_UINT32(s, audioTimeStamp);   /* dwAudioTimeStamp */
+
+	if (encoded)
+	{
+		if (!Stream_EnsureRemainingCapacity(s, size))
+		{
+			error = ERROR_INTERNAL_ERROR;
+			goto out;
+		}
+
+		Stream_Write(s, data, size);
+	}
 	else
 	{
-		BOOL rc;
+		AUDIO_FORMAT* format;
 
-		/* Set stream size */
-		if (!rdpsnd_server_align_wave_pdu(s, format->nBlockAlign))
-			return ERROR_INTERNAL_ERROR;
-
-		end = Stream_GetPosition(s);
-		Stream_SetPosition(s, 2);
-		Stream_Write_UINT16(s, end - 4);
-		context->block_no = (context->block_no + 1) % 256;
-		rc = WTSVirtualChannelWrite(context->priv->ChannelHandle, (PCHAR)Stream_Buffer(s), end,
-		                            &written);
-
-		if (!rc || (end != written))
+		if (!freerdp_dsp_encode(context->priv->dsp_context, context->src_format, data, size, s))
 		{
-			WLog_ERR(TAG,
-			         "WTSVirtualChannelWrite failed! [stream length=%" PRIdz " - written=%" PRIu32,
-			         end, written);
 			error = ERROR_INTERNAL_ERROR;
+			goto out;
+		}
+
+		format = &context->client_formats[formatNo];
+		if (!rdpsnd_server_align_wave_pdu(s, format->nBlockAlign))
+		{
+			error = ERROR_INTERNAL_ERROR;
+			goto out;
 		}
 	}
 
+	end = Stream_GetPosition(s);
+	Stream_SetPosition(s, 2);
+	Stream_Write_UINT16(s, end - 4);
+
+	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, (PCHAR)Stream_Buffer(s), end,
+	                                &written);
+
+	if (!status || (end != written))
+	{
+		WLog_ERR(TAG, "WTSVirtualChannelWrite failed! [stream length=%" PRIdz " - written=%" PRIu32,
+		         end, written);
+		error = ERROR_INTERNAL_ERROR;
+	}
+
+	context->block_no = (context->block_no + 1) % 256;
+
+out:
 	Stream_SetPosition(s, 0);
 	context->priv->out_pending_frames = 0;
 	return error;
@@ -537,8 +659,21 @@ static UINT rdpsnd_server_send_wave2_pdu(RdpsndServerContext* context, UINT16 wT
 /* Wrapper function to send WAVE or WAVE2 PDU depending on client connected */
 static UINT rdpsnd_server_send_audio_pdu(RdpsndServerContext* context, UINT16 wTimestamp)
 {
+	const BYTE* src;
+	size_t length;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->priv);
+
+	if (context->selected_client_format >= context->num_client_formats)
+		return ERROR_INTERNAL_ERROR;
+
+	src = context->priv->out_buffer;
+	length = context->priv->out_pending_frames * context->priv->src_bytes_per_frame;
+
 	if (context->clientVersion >= CHANNEL_VERSION_WIN_8)
-		return rdpsnd_server_send_wave2_pdu(context, wTimestamp);
+		return rdpsnd_server_send_wave2_pdu(context, context->selected_client_format, src, length,
+		                                    FALSE, wTimestamp, wTimestamp);
 	else
 		return rdpsnd_server_send_wave_pdu(context, wTimestamp);
 }
@@ -551,9 +686,11 @@ static UINT rdpsnd_server_send_audio_pdu(RdpsndServerContext* context, UINT16 wT
 static UINT rdpsnd_server_send_samples(RdpsndServerContext* context, const void* buf, int nframes,
                                        UINT16 wTimestamp)
 {
-	int cframes;
-	int cframesize;
 	UINT error = CHANNEL_RC_OK;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->priv);
+
 	EnterCriticalSection(&context->priv->lock);
 
 	if (context->selected_client_format >= context->num_client_formats)
@@ -566,12 +703,13 @@ static UINT rdpsnd_server_send_samples(RdpsndServerContext* context, const void*
 
 	while (nframes > 0)
 	{
-		cframes = MIN(nframes, context->priv->out_frames - context->priv->out_pending_frames);
-		cframesize = cframes * context->priv->src_bytes_per_frame;
+		const size_t cframes =
+		    MIN(nframes, context->priv->out_frames - context->priv->out_pending_frames);
+		size_t cframesize = cframes * context->priv->src_bytes_per_frame;
 		CopyMemory(context->priv->out_buffer +
 		               (context->priv->out_pending_frames * context->priv->src_bytes_per_frame),
 		           buf, cframesize);
-		buf = (BYTE*)buf + cframesize;
+		buf = (const BYTE*)buf + cframesize;
 		nframes -= cframes;
 		context->priv->out_pending_frames += cframes;
 
@@ -590,6 +728,33 @@ out:
 	return error;
 }
 
+/**
+ * Send encoded audio samples using a Wave2 PDU.
+ *
+ * @return 0 on success, otherwise a Win32 error code
+ */
+static UINT rdpsnd_server_send_samples2(RdpsndServerContext* context, UINT16 formatNo,
+                                        const void* buf, size_t size, UINT16 timestamp,
+                                        UINT32 audioTimeStamp)
+{
+	UINT error = CHANNEL_RC_OK;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->priv);
+
+	if (context->clientVersion < CHANNEL_VERSION_WIN_8)
+		return ERROR_INTERNAL_ERROR;
+
+	EnterCriticalSection(&context->priv->lock);
+
+	error =
+	    rdpsnd_server_send_wave2_pdu(context, formatNo, buf, size, TRUE, timestamp, audioTimeStamp);
+
+	LeaveCriticalSection(&context->priv->lock);
+
+	return error;
+}
+
 /**
  * Function description
  *
@@ -597,21 +762,23 @@ out:
  */
 static UINT rdpsnd_server_set_volume(RdpsndServerContext* context, int left, int right)
 {
-	size_t pos;
+	size_t len;
 	BOOL status;
 	ULONG written;
-	wStream* s = context->priv->rdpsnd_pdu;
+	wStream* s = rdpsnd_server_get_buffer(context);
+
+	if (!Stream_EnsureRemainingCapacity(s, 8))
+		return ERROR_NOT_ENOUGH_MEMORY;
+
 	Stream_Write_UINT8(s, SNDC_SETVOLUME);
 	Stream_Write_UINT8(s, 0);
-	Stream_Seek_UINT16(s);
+	Stream_Write_UINT16(s, 4); /* Payload length */
 	Stream_Write_UINT16(s, left);
 	Stream_Write_UINT16(s, right);
-	pos = Stream_GetPosition(s);
-	Stream_SetPosition(s, 2);
-	Stream_Write_UINT16(s, pos - 4);
-	Stream_SetPosition(s, pos);
+	len = Stream_GetPosition(s);
+
 	status = WTSVirtualChannelWrite(context->priv->ChannelHandle, (PCHAR)Stream_Buffer(s),
-	                                Stream_GetPosition(s), &written);
+	                                (ULONG)len, &written);
 	Stream_SetPosition(s, 0);
 	return status ? CHANNEL_RC_OK : ERROR_INTERNAL_ERROR;
 }
@@ -626,8 +793,9 @@ static UINT rdpsnd_server_close(RdpsndServerContext* context)
 	size_t pos;
 	BOOL status;
 	ULONG written;
-	wStream* s = context->priv->rdpsnd_pdu;
 	UINT error = CHANNEL_RC_OK;
+	wStream* s = rdpsnd_server_get_buffer(context);
+
 	EnterCriticalSection(&context->priv->lock);
 
 	if (context->priv->out_pending_frames > 0)
@@ -649,6 +817,10 @@ static UINT rdpsnd_server_close(RdpsndServerContext* context)
 		return error;
 
 	context->selected_client_format = 0xFFFF;
+
+	if (!Stream_EnsureRemainingCapacity(s, 4))
+		return ERROR_OUTOFMEMORY;
+
 	Stream_Write_UINT8(s, SNDC_CLOSE);
 	Stream_Write_UINT8(s, 0);
 	Stream_Seek_UINT16(s);
@@ -671,14 +843,58 @@ static UINT rdpsnd_server_start(RdpsndServerContext* context)
 {
 	void* buffer = NULL;
 	DWORD bytesReturned;
-	RdpsndServerPrivate* priv = context->priv;
+	RdpsndServerPrivate* priv;
 	UINT error = ERROR_INTERNAL_ERROR;
-	priv->ChannelHandle = WTSVirtualChannelOpen(context->vcm, WTS_CURRENT_SESSION, "rdpsnd");
+	PULONG pSessionId = NULL;
 
-	if (!priv->ChannelHandle)
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->priv);
+
+	priv = context->priv;
+	priv->SessionId = WTS_CURRENT_SESSION;
+
+	if (context->use_dynamic_virtual_channel)
 	{
-		WLog_ERR(TAG, "WTSVirtualChannelOpen failed!");
-		return ERROR_INTERNAL_ERROR;
+		UINT32 channelId;
+		BOOL status = TRUE;
+
+		if (WTSQuerySessionInformationA(context->vcm, WTS_CURRENT_SESSION, WTSSessionId,
+		                                (LPSTR*)&pSessionId, &bytesReturned))
+		{
+			priv->SessionId = (DWORD)*pSessionId;
+			WTSFreeMemory(pSessionId);
+			priv->ChannelHandle = (HANDLE)WTSVirtualChannelOpenEx(
+			    priv->SessionId, "AUDIO_PLAYBACK_DVC", WTS_CHANNEL_OPTION_DYNAMIC);
+			if (!priv->ChannelHandle)
+			{
+				WLog_ERR(TAG, "Open audio dynamic virtual channel (AUDIO_PLAYBACK_DVC) failed!");
+				return ERROR_INTERNAL_ERROR;
+			}
+
+			channelId = WTSChannelGetIdByHandle(priv->ChannelHandle);
+
+			IFCALLRET(context->ChannelIdAssigned, status, context, channelId);
+			if (!status)
+			{
+				WLog_ERR(TAG, "context->ChannelIdAssigned failed!");
+				goto out_close;
+			}
+		}
+		else
+		{
+			WLog_ERR(TAG, "WTSQuerySessionInformationA failed!");
+			return ERROR_INTERNAL_ERROR;
+		}
+	}
+	else
+	{
+		priv->ChannelHandle =
+		    WTSVirtualChannelOpen(context->vcm, WTS_CURRENT_SESSION, "rdpsnd");
+		if (!priv->ChannelHandle)
+		{
+			WLog_ERR(TAG, "Open audio static virtual channel (rdpsnd) failed!");
+			return ERROR_INTERNAL_ERROR;
+		}
 	}
 
 	if (!WTSVirtualChannelQuery(priv->ChannelHandle, WTSVirtualEventHandle, &buffer,
@@ -713,7 +929,7 @@ static UINT rdpsnd_server_start(RdpsndServerContext* context)
 		goto out_pdu;
 	}
 
-	if ((error = rdpsnd_server_send_formats(context, context->priv->rdpsnd_pdu)))
+	if ((error = rdpsnd_server_send_formats(context)))
 	{
 		WLog_ERR(TAG, "rdpsnd_server_send_formats failed with error %" PRIu32 "", error);
 		goto out_lock;
@@ -763,6 +979,12 @@ static UINT rdpsnd_server_stop(RdpsndServerContext* context)
 {
 	UINT error = CHANNEL_RC_OK;
 
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->priv);
+
+	if (!context->priv->StopEvent)
+		return error;
+
 	if (context->priv->ownThread)
 	{
 		if (context->priv->StopEvent)
@@ -778,36 +1000,46 @@ static UINT rdpsnd_server_stop(RdpsndServerContext* context)
 
 			CloseHandle(context->priv->Thread);
 			CloseHandle(context->priv->StopEvent);
+			context->priv->Thread = NULL;
+			context->priv->StopEvent = NULL;
 		}
 	}
 
 	DeleteCriticalSection(&context->priv->lock);
 
 	if (context->priv->rdpsnd_pdu)
+	{
 		Stream_Free(context->priv->rdpsnd_pdu, TRUE);
+		context->priv->rdpsnd_pdu = NULL;
+	}
+
+	if (context->priv->ChannelHandle)
+	{
+		WTSVirtualChannelClose(context->priv->ChannelHandle);
+		context->priv->ChannelHandle = NULL;
+	}
 
 	return error;
 }
 
 RdpsndServerContext* rdpsnd_server_context_new(HANDLE vcm)
 {
-	RdpsndServerContext* context;
 	RdpsndServerPrivate* priv;
-	context = (RdpsndServerContext*)calloc(1, sizeof(RdpsndServerContext));
+	RdpsndServerContext* context = (RdpsndServerContext*)calloc(1, sizeof(RdpsndServerContext));
 
 	if (!context)
-	{
-		WLog_ERR(TAG, "calloc failed!");
-		return NULL;
-	}
+		goto fail;
 
 	context->vcm = vcm;
 	context->Start = rdpsnd_server_start;
 	context->Stop = rdpsnd_server_stop;
 	context->selected_client_format = 0xFFFF;
 	context->Initialize = rdpsnd_server_initialize;
+	context->SendFormats = rdpsnd_server_send_formats;
 	context->SelectFormat = rdpsnd_server_select_format;
+	context->Training = rdpsnd_server_training;
 	context->SendSamples = rdpsnd_server_send_samples;
+	context->SendSamples2 = rdpsnd_server_send_samples2;
 	context->SetVolume = rdpsnd_server_set_volume;
 	context->Close = rdpsnd_server_close;
 	context->priv = priv = (RdpsndServerPrivate*)calloc(1, sizeof(RdpsndServerPrivate));
@@ -815,7 +1047,7 @@ RdpsndServerContext* rdpsnd_server_context_new(HANDLE vcm)
 	if (!priv)
 	{
 		WLog_ERR(TAG, "calloc failed!");
-		goto out_free;
+		goto fail;
 	}
 
 	priv->dsp_context = freerdp_dsp_context_new(TRUE);
@@ -823,7 +1055,7 @@ RdpsndServerContext* rdpsnd_server_context_new(HANDLE vcm)
 	if (!priv->dsp_context)
 	{
 		WLog_ERR(TAG, "freerdp_dsp_context_new failed!");
-		goto out_free_priv;
+		goto fail;
 	}
 
 	priv->input_stream = Stream_New(NULL, 4);
@@ -831,24 +1063,23 @@ RdpsndServerContext* rdpsnd_server_context_new(HANDLE vcm)
 	if (!priv->input_stream)
 	{
 		WLog_ERR(TAG, "Stream_New failed!");
-		goto out_free_dsp;
+		goto fail;
 	}
 
 	priv->expectedBytes = 4;
 	priv->waitingHeader = TRUE;
 	priv->ownThread = TRUE;
 	return context;
-out_free_dsp:
-	freerdp_dsp_context_free(priv->dsp_context);
-out_free_priv:
-	free(context->priv);
-out_free:
-	free(context);
+fail:
+	rdpsnd_server_context_free(context);
 	return NULL;
 }
 
 void rdpsnd_server_context_reset(RdpsndServerContext* context)
 {
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->priv);
+
 	context->priv->expectedBytes = 4;
 	context->priv->waitingHeader = TRUE;
 	Stream_SetPosition(context->priv->input_stream, 0);
@@ -856,16 +1087,21 @@ void rdpsnd_server_context_reset(RdpsndServerContext* context)
 
 void rdpsnd_server_context_free(RdpsndServerContext* context)
 {
-	if (context->priv->ChannelHandle)
-		WTSVirtualChannelClose(context->priv->ChannelHandle);
+	if (!context)
+		return;
 
-	free(context->priv->out_buffer);
+	if (context->priv)
+	{
+		rdpsnd_server_stop(context);
 
-	if (context->priv->dsp_context)
-		freerdp_dsp_context_free(context->priv->dsp_context);
+		free(context->priv->out_buffer);
 
-	if (context->priv->input_stream)
-		Stream_Free(context->priv->input_stream, TRUE);
+		if (context->priv->dsp_context)
+			freerdp_dsp_context_free(context->priv->dsp_context);
+
+		if (context->priv->input_stream)
+			Stream_Free(context->priv->input_stream, TRUE);
+	}
 
 	free(context->server_formats);
 	free(context->client_formats);
@@ -875,6 +1111,9 @@ void rdpsnd_server_context_free(RdpsndServerContext* context)
 
 HANDLE rdpsnd_server_get_event_handle(RdpsndServerContext* context)
 {
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->priv);
+
 	return context->priv->channelEvent;
 }
 
@@ -896,8 +1135,14 @@ UINT rdpsnd_server_handle_messages(RdpsndServerContext* context)
 {
 	DWORD bytesReturned;
 	UINT ret = CHANNEL_RC_OK;
-	RdpsndServerPrivate* priv = context->priv;
-	wStream* s = priv->input_stream;
+	RdpsndServerPrivate* priv;
+	wStream* s;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->priv);
+
+	priv = context->priv;
+	s = priv->input_stream;
 
 	if (!WTSVirtualChannelRead(priv->ChannelHandle, 0, (PCHAR)Stream_Pointer(s),
 	                           priv->expectedBytes, &bytesReturned))
@@ -952,6 +1197,10 @@ UINT rdpsnd_server_handle_messages(RdpsndServerContext* context)
 			ret = rdpsnd_server_recv_waveconfirm(context, s);
 			break;
 
+		case SNDC_TRAINING:
+			ret = rdpsnd_server_recv_trainingconfirm(context, s);
+			break;
+
 		case SNDC_FORMATS:
 			ret = rdpsnd_server_recv_formats(context, s);
 
@@ -962,8 +1211,6 @@ UINT rdpsnd_server_handle_messages(RdpsndServerContext* context)
 
 		case SNDC_QUALITYMODE:
 			ret = rdpsnd_server_recv_quality_mode(context, s);
-			Stream_SetPosition(s,
-			                   0); /* in case the Activated callback tries to treat some messages */
 
 			if ((ret == CHANNEL_RC_OK) && (context->clientVersion >= CHANNEL_VERSION_WIN_7))
 				IFCALL(context->Activated, context);

channels/rdpsnd/server/rdpsnd_main.h

@@ -39,6 +39,7 @@ struct _rdpsnd_server_private
 	HANDLE StopEvent;
 	HANDLE channelEvent;
 	void* ChannelHandle;
+	DWORD SessionId;
 
 	BOOL waitingHeader;
 	DWORD expectedBytes;

channels/server/channels.c

@@ -50,9 +50,15 @@
 #include <freerdp/server/remdesk.h>
 #include <freerdp/server/encomsp.h>
 #include <freerdp/server/rail.h>
+#include <freerdp/server/telemetry.h>
 #include <freerdp/server/rdpgfx.h>
 #include <freerdp/server/disp.h>
 
+#if defined(CHANNEL_RDPECAM_SERVER)
+#include <freerdp/server/rdpecam-enumerator.h>
+#include <freerdp/server/rdpecam.h>
+#endif
+
 #if defined(CHANNEL_AINPUT_SERVER)
 #include <freerdp/server/ainput.h>
 #endif
@@ -71,8 +77,13 @@ void freerdp_channels_dummy(void)
 	RemdeskServerContext* remdesk;
 	EncomspServerContext* encomsp;
 	RailServerContext* rail;
+	TelemetryServerContext* telemetry;
 	RdpgfxServerContext* rdpgfx;
 	DispServerContext* disp;
+#if defined (CHANNEL_RDPECAM_SERVER)
+	CamDevEnumServerContext* camera_enumerator;
+	CameraDeviceServerContext* camera_device;
+#endif
 	audin = audin_server_context_new(NULL);
 	audin_server_context_free(audin);
 	rdpsnd = rdpsnd_server_context_new(NULL);
@@ -93,10 +104,20 @@ void freerdp_channels_dummy(void)
 	encomsp_server_context_free(encomsp);
 	rail = rail_server_context_new(NULL);
 	rail_server_context_free(rail);
+	telemetry = telemetry_server_context_new(NULL);
+	telemetry_server_context_free(telemetry);
 	rdpgfx = rdpgfx_server_context_new(NULL);
 	rdpgfx_server_context_free(rdpgfx);
 	disp = disp_server_context_new(NULL);
 	disp_server_context_free(disp);
+
+#if defined (CHANNEL_RDPECAM_SERVER)
+	camera_enumerator = cam_dev_enum_server_context_new(NULL);
+	cam_dev_enum_server_context_free(camera_enumerator);
+	camera_device = camera_device_server_context_new(NULL);
+	camera_device_server_context_free(camera_device);
+#endif
+
 #if defined(CHANNEL_AINPUT_SERVER)
 	{
 		ainput_server_context* ainput = ainput_server_context_new(NULL);

channels/telemetry/CMakeLists.txt

@@ -0,0 +1,22 @@
+# FreeRDP: A Remote Desktop Protocol Implementation
+# FreeRDP cmake build script
+#
+# Copyright 2022 Pascal Nowack <Pascal.Nowack@gmx.de>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+define_channel("telemetry")
+
+if(WITH_SERVER_CHANNELS)
+	add_channel_server(${MODULE_PREFIX} ${CHANNEL_NAME})
+endif()

channels/telemetry/ChannelOptions.cmake

@@ -0,0 +1,12 @@
+
+set(OPTION_DEFAULT OFF)
+set(OPTION_CLIENT_DEFAULT OFF)
+set(OPTION_SERVER_DEFAULT ON)
+
+define_channel_options(NAME "telemetry" TYPE "dynamic"
+	DESCRIPTION "Telemetry Virtual Channel Extension"
+	SPECIFICATIONS "[MS-RDPET]"
+	DEFAULT ${OPTION_DEFAULT})
+
+define_channel_server_options(${OPTION_SERVER_DEFAULT})
+

channels/telemetry/server/CMakeLists.txt

@@ -0,0 +1,26 @@
+# FreeRDP: A Remote Desktop Protocol Implementation
+# FreeRDP cmake build script
+#
+# Copyright 2022 Pascal Nowack <Pascal.Nowack@gmx.de>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+define_channel_server("telemetry")
+
+set(${MODULE_PREFIX}_SRCS
+	telemetry_main.c)
+
+add_channel_server_library(${MODULE_PREFIX} ${MODULE_NAME} ${CHANNEL_NAME} FALSE "DVCPluginEntry")
+
+target_link_libraries(${MODULE_NAME} freerdp)
+set_property(TARGET ${MODULE_NAME} PROPERTY FOLDER "Channels/${CHANNEL_NAME}/Server")

channels/telemetry/server/telemetry_main.c

@@ -0,0 +1,443 @@
+/**
+ * FreeRDP: A Remote Desktop Protocol Implementation
+ * Telemetry Virtual Channel Extension
+ *
+ * Copyright 2022 Pascal Nowack <Pascal.Nowack@gmx.de>
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *	 http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <freerdp/channels/log.h>
+#include <freerdp/server/telemetry.h>
+
+#define TAG CHANNELS_TAG("telemetry.server")
+
+typedef enum
+{
+	TELEMETRY_INITIAL,
+	TELEMETRY_OPENED,
+} eTelemetryChannelState;
+
+typedef struct
+{
+	TelemetryServerContext context;
+
+	HANDLE stopEvent;
+
+	HANDLE thread;
+	void* telemetry_channel;
+
+	DWORD SessionId;
+
+	BOOL isOpened;
+	BOOL externalThread;
+
+	/* Channel state */
+	eTelemetryChannelState state;
+
+	wStream* buffer;
+} telemetry_server;
+
+static UINT telemetry_server_initialize(TelemetryServerContext* context, BOOL externalThread)
+{
+	UINT error = CHANNEL_RC_OK;
+	telemetry_server* telemetry = (telemetry_server*)context;
+
+	WINPR_ASSERT(telemetry);
+
+	if (telemetry->isOpened)
+	{
+		WLog_WARN(TAG, "Application error: TELEMETRY channel already initialized, "
+		               "calling in this state is not possible!");
+		return ERROR_INVALID_STATE;
+	}
+
+	telemetry->externalThread = externalThread;
+
+	return error;
+}
+
+static UINT telemetry_server_open_channel(telemetry_server* telemetry)
+{
+	TelemetryServerContext* context = &telemetry->context;
+	DWORD Error = ERROR_SUCCESS;
+	HANDLE hEvent;
+	DWORD BytesReturned = 0;
+	PULONG pSessionId = NULL;
+	UINT32 channelId;
+	BOOL status = TRUE;
+
+	WINPR_ASSERT(telemetry);
+
+	if (WTSQuerySessionInformationA(telemetry->context.vcm, WTS_CURRENT_SESSION, WTSSessionId,
+	                                (LPSTR*)&pSessionId, &BytesReturned) == FALSE)
+	{
+		WLog_ERR(TAG, "WTSQuerySessionInformationA failed!");
+		return ERROR_INTERNAL_ERROR;
+	}
+
+	telemetry->SessionId = (DWORD)*pSessionId;
+	WTSFreeMemory(pSessionId);
+	hEvent = WTSVirtualChannelManagerGetEventHandle(telemetry->context.vcm);
+
+	if (WaitForSingleObject(hEvent, 1000) == WAIT_FAILED)
+	{
+		Error = GetLastError();
+		WLog_ERR(TAG, "WaitForSingleObject failed with error %" PRIu32 "!", Error);
+		return Error;
+	}
+
+	telemetry->telemetry_channel = WTSVirtualChannelOpenEx(
+	    telemetry->SessionId, TELEMETRY_DVC_CHANNEL_NAME, WTS_CHANNEL_OPTION_DYNAMIC);
+	if (!telemetry->telemetry_channel)
+	{
+		Error = GetLastError();
+		WLog_ERR(TAG, "WTSVirtualChannelOpenEx failed with error %" PRIu32 "!", Error);
+		return Error;
+	}
+
+	channelId = WTSChannelGetIdByHandle(telemetry->telemetry_channel);
+
+	IFCALLRET(context->ChannelIdAssigned, status, context, channelId);
+	if (!status)
+	{
+		WLog_ERR(TAG, "context->ChannelIdAssigned failed!");
+		return ERROR_INTERNAL_ERROR;
+	}
+
+	return Error;
+}
+
+static UINT telemetry_server_recv_rdp_telemetry_pdu(TelemetryServerContext* context, wStream* s)
+{
+	TELEMETRY_RDP_TELEMETRY_PDU pdu;
+	UINT error = CHANNEL_RC_OK;
+
+	if (Stream_GetRemainingLength(s) < 16)
+	{
+		WLog_ERR(TAG, "telemetry_server_recv_rdp_telemetry_pdu: Not enough data!");
+		return ERROR_NO_DATA;
+	}
+
+	Stream_Read_UINT32(s, pdu.PromptForCredentialsMillis);
+	Stream_Read_UINT32(s, pdu.PromptForCredentialsDoneMillis);
+	Stream_Read_UINT32(s, pdu.GraphicsChannelOpenedMillis);
+	Stream_Read_UINT32(s, pdu.FirstGraphicsReceivedMillis);
+
+	IFCALLRET(context->RdpTelemetry, error, context, &pdu);
+	if (error)
+		WLog_ERR(TAG, "context->RdpTelemetry failed with error %" PRIu32 "", error);
+
+	return error;
+}
+
+static UINT telemetry_process_message(telemetry_server* telemetry)
+{
+	BOOL rc;
+	UINT error = ERROR_INTERNAL_ERROR;
+	ULONG BytesReturned;
+	BYTE MessageId;
+	BYTE Length;
+	wStream* s;
+
+	WINPR_ASSERT(telemetry);
+	WINPR_ASSERT(telemetry->telemetry_channel);
+
+	s = telemetry->buffer;
+	WINPR_ASSERT(s);
+
+	Stream_SetPosition(s, 0);
+	rc = WTSVirtualChannelRead(telemetry->telemetry_channel, 0, NULL, 0, &BytesReturned);
+	if (!rc)
+		goto out;
+
+	if (BytesReturned < 1)
+	{
+		error = CHANNEL_RC_OK;
+		goto out;
+	}
+
+	if (!Stream_EnsureRemainingCapacity(s, BytesReturned))
+	{
+		WLog_ERR(TAG, "Stream_EnsureRemainingCapacity failed!");
+		error = CHANNEL_RC_NO_MEMORY;
+		goto out;
+	}
+
+	if (WTSVirtualChannelRead(telemetry->telemetry_channel, 0, (PCHAR)Stream_Buffer(s),
+	                          (ULONG)Stream_Capacity(s), &BytesReturned) == FALSE)
+	{
+		WLog_ERR(TAG, "WTSVirtualChannelRead failed!");
+		goto out;
+	}
+
+	Stream_SetLength(s, BytesReturned);
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, 2))
+		return ERROR_NO_DATA;
+
+	Stream_Read_UINT8(s, MessageId);
+	Stream_Read_UINT8(s, Length);
+
+	switch (MessageId)
+	{
+		case 0x01:
+			error = telemetry_server_recv_rdp_telemetry_pdu(&telemetry->context, s);
+			break;
+		default:
+			WLog_ERR(TAG, "telemetry_process_message: unknown MessageId %" PRIu8 "", MessageId);
+			break;
+	}
+
+out:
+	if (error)
+		WLog_ERR(TAG, "Response failed with error %" PRIu32 "!", error);
+
+	return error;
+}
+
+static UINT telemetry_server_context_poll_int(TelemetryServerContext* context)
+{
+	telemetry_server* telemetry = (telemetry_server*)context;
+	UINT error = ERROR_INTERNAL_ERROR;
+
+	WINPR_ASSERT(telemetry);
+
+	switch (telemetry->state)
+	{
+		case TELEMETRY_INITIAL:
+			error = telemetry_server_open_channel(telemetry);
+			if (error)
+				WLog_ERR(TAG, "telemetry_server_open_channel failed with error %" PRIu32 "!",
+				         error);
+			else
+				telemetry->state = TELEMETRY_OPENED;
+			break;
+		case TELEMETRY_OPENED:
+			error = telemetry_process_message(telemetry);
+			break;
+	}
+
+	return error;
+}
+
+static HANDLE telemetry_server_get_channel_handle(telemetry_server* telemetry)
+{
+	void* buffer = NULL;
+	DWORD BytesReturned = 0;
+	HANDLE ChannelEvent = NULL;
+
+	WINPR_ASSERT(telemetry);
+
+	if (WTSVirtualChannelQuery(telemetry->telemetry_channel, WTSVirtualEventHandle, &buffer,
+	                           &BytesReturned) == TRUE)
+	{
+		if (BytesReturned == sizeof(HANDLE))
+			CopyMemory(&ChannelEvent, buffer, sizeof(HANDLE));
+
+		WTSFreeMemory(buffer);
+	}
+
+	return ChannelEvent;
+}
+
+static DWORD WINAPI telemetry_server_thread_func(LPVOID arg)
+{
+	DWORD nCount;
+	HANDLE events[2] = { 0 };
+	telemetry_server* telemetry = (telemetry_server*)arg;
+	UINT error = CHANNEL_RC_OK;
+	DWORD status;
+
+	WINPR_ASSERT(telemetry);
+
+	nCount = 0;
+	events[nCount++] = telemetry->stopEvent;
+
+	while ((error == CHANNEL_RC_OK) && (WaitForSingleObject(events[0], 0) != WAIT_OBJECT_0))
+	{
+		switch (telemetry->state)
+		{
+			case TELEMETRY_INITIAL:
+				error = telemetry_server_context_poll_int(&telemetry->context);
+				if (error == CHANNEL_RC_OK)
+				{
+					events[1] = telemetry_server_get_channel_handle(telemetry);
+					nCount = 2;
+				}
+				break;
+			case TELEMETRY_OPENED:
+				status = WaitForMultipleObjects(nCount, events, FALSE, INFINITE);
+				switch (status)
+				{
+					case WAIT_OBJECT_0:
+						break;
+					case WAIT_OBJECT_0 + 1:
+					case WAIT_TIMEOUT:
+						error = telemetry_server_context_poll_int(&telemetry->context);
+						break;
+
+					case WAIT_FAILED:
+					default:
+						error = ERROR_INTERNAL_ERROR;
+						break;
+				}
+				break;
+		}
+	}
+
+	WTSVirtualChannelClose(telemetry->telemetry_channel);
+	telemetry->telemetry_channel = NULL;
+
+	if (error && telemetry->context.rdpcontext)
+		setChannelError(telemetry->context.rdpcontext, error,
+		                "telemetry_server_thread_func reported an error");
+
+	ExitThread(error);
+	return error;
+}
+
+static UINT telemetry_server_open(TelemetryServerContext* context)
+{
+	telemetry_server* telemetry = (telemetry_server*)context;
+
+	WINPR_ASSERT(telemetry);
+
+	if (!telemetry->externalThread && (telemetry->thread == NULL))
+	{
+		telemetry->stopEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
+		if (!telemetry->stopEvent)
+		{
+			WLog_ERR(TAG, "CreateEvent failed!");
+			return ERROR_INTERNAL_ERROR;
+		}
+
+		telemetry->thread = CreateThread(NULL, 0, telemetry_server_thread_func, telemetry, 0, NULL);
+		if (!telemetry->thread)
+		{
+			WLog_ERR(TAG, "CreateThread failed!");
+			CloseHandle(telemetry->stopEvent);
+			telemetry->stopEvent = NULL;
+			return ERROR_INTERNAL_ERROR;
+		}
+	}
+	telemetry->isOpened = TRUE;
+
+	return CHANNEL_RC_OK;
+}
+
+static UINT telemetry_server_close(TelemetryServerContext* context)
+{
+	UINT error = CHANNEL_RC_OK;
+	telemetry_server* telemetry = (telemetry_server*)context;
+
+	WINPR_ASSERT(telemetry);
+
+	if (!telemetry->externalThread && telemetry->thread)
+	{
+		SetEvent(telemetry->stopEvent);
+
+		if (WaitForSingleObject(telemetry->thread, INFINITE) == WAIT_FAILED)
+		{
+			error = GetLastError();
+			WLog_ERR(TAG, "WaitForSingleObject failed with error %" PRIu32 "", error);
+			return error;
+		}
+
+		CloseHandle(telemetry->thread);
+		CloseHandle(telemetry->stopEvent);
+		telemetry->thread = NULL;
+		telemetry->stopEvent = NULL;
+	}
+	if (telemetry->externalThread)
+	{
+		if (telemetry->state != TELEMETRY_INITIAL)
+		{
+			WTSVirtualChannelClose(telemetry->telemetry_channel);
+			telemetry->telemetry_channel = NULL;
+			telemetry->state = TELEMETRY_INITIAL;
+		}
+	}
+	telemetry->isOpened = FALSE;
+
+	return error;
+}
+
+static UINT telemetry_server_context_poll(TelemetryServerContext* context)
+{
+	telemetry_server* telemetry = (telemetry_server*)context;
+
+	WINPR_ASSERT(telemetry);
+
+	if (!telemetry->externalThread)
+		return ERROR_INTERNAL_ERROR;
+
+	return telemetry_server_context_poll_int(context);
+}
+
+static BOOL telemetry_server_context_handle(TelemetryServerContext* context, HANDLE* handle)
+{
+	telemetry_server* telemetry = (telemetry_server*)context;
+
+	WINPR_ASSERT(telemetry);
+	WINPR_ASSERT(handle);
+
+	if (!telemetry->externalThread)
+		return FALSE;
+	if (telemetry->state == TELEMETRY_INITIAL)
+		return FALSE;
+
+	*handle = telemetry_server_get_channel_handle(telemetry);
+
+	return TRUE;
+}
+
+TelemetryServerContext* telemetry_server_context_new(HANDLE vcm)
+{
+	telemetry_server* telemetry = (telemetry_server*)calloc(1, sizeof(telemetry_server));
+
+	if (!telemetry)
+		return NULL;
+
+	telemetry->context.vcm = vcm;
+	telemetry->context.Initialize = telemetry_server_initialize;
+	telemetry->context.Open = telemetry_server_open;
+	telemetry->context.Close = telemetry_server_close;
+	telemetry->context.Poll = telemetry_server_context_poll;
+	telemetry->context.ChannelHandle = telemetry_server_context_handle;
+
+	telemetry->buffer = Stream_New(NULL, 4096);
+	if (!telemetry->buffer)
+		goto fail;
+
+	return &telemetry->context;
+fail:
+	telemetry_server_context_free(&telemetry->context);
+	return NULL;
+}
+
+void telemetry_server_context_free(TelemetryServerContext* context)
+{
+	telemetry_server* telemetry = (telemetry_server*)context;
+
+	if (telemetry)
+	{
+		telemetry_server_close(context);
+		Stream_Free(telemetry->buffer, TRUE);
+	}
+
+	free(telemetry);
+}

channels/tsmf/client/ffmpeg/tsmf_ffmpeg.c

@@ -195,9 +195,12 @@ static BOOL tsmf_ffmpeg_init_stream(ITSMFDecoder* decoder, const TS_AM_MEDIA_TYP
 		if (media_type->SubType == TSMF_SUB_TYPE_AVC1 &&
 		    media_type->FormatType == TSMF_FORMAT_TYPE_MPEG2VIDEOINFO)
 		{
+			size_t required = 6;
 			/* The extradata format that FFmpeg uses is following CodecPrivate in Matroska.
 			   See http://haali.su/mkv/codecs.pdf */
 			p = mdecoder->codec_context->extradata;
+			if (mdecoder->codec_context->extradata_size < required)
+				return FALSE;
 			*p++ = 1;                         /* Reserved? */
 			*p++ = media_type->ExtraData[8];  /* Profile */
 			*p++ = 0;                         /* Profile */
@@ -206,23 +209,36 @@ static BOOL tsmf_ffmpeg_init_stream(ITSMFDecoder* decoder, const TS_AM_MEDIA_TYP
 			*p++ = 0xe0 | 0x01;               /* Reserved | #sps */
 			s = media_type->ExtraData + 20;
 			size = ((UINT32)(*s)) * 256 + ((UINT32)(*(s + 1)));
+			required += size + 2;
+			if (mdecoder->codec_context->extradata_size < required)
+				return FALSE;
 			memcpy(p, s, size + 2);
 			s += size + 2;
 			p += size + 2;
+			required++;
+			if (mdecoder->codec_context->extradata_size < required)
+				return FALSE;
 			*p++ = 1; /* #pps */
 			size = ((UINT32)(*s)) * 256 + ((UINT32)(*(s + 1)));
+			required += size + 2;
+			if (mdecoder->codec_context->extradata_size < required)
+				return FALSE;
 			memcpy(p, s, size + 2);
 		}
 		else
 		{
 			memcpy(mdecoder->codec_context->extradata, media_type->ExtraData,
 			       media_type->ExtraDataSize);
+			if (mdecoder->codec_context->extradata_size < media_type->ExtraDataSize + 8)
+				return FALSE;
 			memset(mdecoder->codec_context->extradata + media_type->ExtraDataSize, 0, 8);
 		}
 	}
 
+#if LIBAVCODEC_VERSION_INT < AV_VERSION_INT(59, 18, 100)
 	if (mdecoder->codec->capabilities & AV_CODEC_CAP_TRUNCATED)
 		mdecoder->codec_context->flags |= AV_CODEC_FLAG_TRUNCATED;
+#endif
 
 	return TRUE;
 }
@@ -245,6 +261,9 @@ static BOOL tsmf_ffmpeg_set_format(ITSMFDecoder* decoder, TS_AM_MEDIA_TYPE* medi
 {
 	TSMFFFmpegDecoder* mdecoder = (TSMFFFmpegDecoder*)decoder;
 
+	WINPR_ASSERT(mdecoder);
+	WINPR_ASSERT(media_type);
+
 	switch (media_type->MajorType)
 	{
 		case TSMF_MAJOR_TYPE_VIDEO:
@@ -297,6 +316,9 @@ static BOOL tsmf_ffmpeg_set_format(ITSMFDecoder* decoder, TS_AM_MEDIA_TYPE* medi
 			   http://msdn.microsoft.com/en-us/library/dd757806.aspx */
 			if (media_type->ExtraData)
 			{
+				if (media_type->ExtraDataSize < 12)
+					return FALSE;
+
 				media_type->ExtraData += 12;
 				media_type->ExtraDataSize -= 12;
 			}

channels/tsmf/client/gstreamer/tsmf_gstreamer.c

@@ -420,6 +420,8 @@ static BOOL tsmf_gstreamer_set_format(ITSMFDecoder* decoder, TS_AM_MEDIA_TYPE* m
 			   http://msdn.microsoft.com/en-us/library/dd757806.aspx */
 			if (media_type->ExtraData)
 			{
+				if (media_type->ExtraDataSize < 12)
+					return FALSE;
 				media_type->ExtraData += 12;
 				media_type->ExtraDataSize -= 12;
 			}

channels/tsmf/client/tsmf_codec.c

@@ -386,7 +386,12 @@ static BOOL tsmf_read_format_type(TS_AM_MEDIA_TYPE* mediatype, wStream* s, UINT3
 
 			if (cbFormat > 176)
 			{
-				mediatype->ExtraDataSize = cbFormat - 176;
+				const size_t nsize = cbFormat - 176;
+				if (mediatype->ExtraDataSize < nsize)
+					return FALSE;
+				if (!Stream_CheckAndLogRequiredLength(TAG, s, nsize))
+					return FALSE;
+				mediatype->ExtraDataSize = nsize;
 				mediatype->ExtraData = Stream_Pointer(s);
 			}
 			break;

channels/tsmf/client/tsmf_ifman.c

@@ -69,16 +69,20 @@ UINT tsmf_ifman_rim_exchange_capability_request(TSMF_IFMAN* ifman)
  */
 UINT tsmf_ifman_exchange_capability_request(TSMF_IFMAN* ifman)
 {
-	UINT32 i;
-	UINT32 v;
-	UINT32 pos;
-	UINT32 CapabilityType;
-	UINT32 cbCapabilityLength;
-	UINT32 numHostCapabilities;
+	UINT32 i = 0;
+	UINT32 v = 0;
+	UINT32 pos = 0;
+	UINT32 CapabilityType = 0;
+	UINT32 cbCapabilityLength = 0;
+	UINT32 numHostCapabilities = 0;
 
+	WINPR_ASSERT(ifman);
 	if (!Stream_EnsureRemainingCapacity(ifman->output, ifman->input_size + 4))
 		return ERROR_OUTOFMEMORY;
 
+	if (Stream_GetRemainingLength(ifman->input) < ifman->input_size)
+		return ERROR_INVALID_DATA;
+
 	pos = Stream_GetPosition(ifman->output);
 	Stream_Copy(ifman->input, ifman->output, ifman->input_size);
 	Stream_SetPosition(ifman->output, pos);

channels/urbdrc/client/data_transfer.c

@@ -97,7 +97,13 @@ static wStream* urb_create_iocompletion(UINT32 InterfaceField, UINT32 MessageId,
                                         UINT32 OutputBufferSize)
 {
 	const UINT32 InterfaceId = (STREAM_ID_PROXY << 30) | (InterfaceField & 0x3FFFFFFF);
-	wStream* out = Stream_New(NULL, OutputBufferSize + 28);
+
+#if UINT32_MAX >= SIZE_MAX
+	if (OutputBufferSize > UINT32_MAX - 28ull)
+		return NULL;
+#endif
+
+	wStream* out = Stream_New(NULL, OutputBufferSize + 28ull);
 
 	if (!out)
 		return NULL;
@@ -241,6 +247,10 @@ static UINT urbdrc_process_io_control(IUDEVICE* pdev, URBDRC_CHANNEL_CALLBACK* c
 
 	Stream_Read_UINT32(s, OutputBufferSize);
 	Stream_Read_UINT32(s, RequestId);
+
+	if (OutputBufferSize > UINT32_MAX - 4)
+		return ERROR_INVALID_DATA;
+
 	InterfaceId = ((STREAM_ID_PROXY << 30) | pdev->get_ReqCompletion(pdev));
 	out = urb_create_iocompletion(InterfaceId, MessageId, RequestId, OutputBufferSize + 4);
 
@@ -673,7 +683,11 @@ static UINT urb_control_transfer(IUDEVICE* pdev, URBDRC_CHANNEL_CALLBACK* callba
 	buffer = Stream_Pointer(out);
 
 	if (transferDir == USBD_TRANSFER_DIRECTION_OUT)
+	{
+		if (!Stream_CheckAndLogRequiredLength(TAG, s, OutputBufferSize))
+			return ERROR_INVALID_DATA;
 		Stream_Copy(s, out, OutputBufferSize);
+	}
 
 	/**  process TS_URB_CONTROL_TRANSFER */
 	if (!pdev->control_transfer(pdev, RequestId, EndpointAddress, TransferFlags, bmRequestType,
@@ -720,6 +734,15 @@ static UINT urb_bulk_or_interrupt_transfer(IUDEVICE* pdev, URBDRC_CHANNEL_CALLBA
 	Stream_Read_UINT32(s, TransferFlags); /** TransferFlags */
 	Stream_Read_UINT32(s, OutputBufferSize);
 	EndpointAddress = (PipeHandle & 0x000000ff);
+
+	if (transferDir == USBD_TRANSFER_DIRECTION_OUT)
+	{
+		if (!Stream_CheckAndLogRequiredLength(TAG, s, OutputBufferSize))
+		{
+			return ERROR_INVALID_DATA;
+		}
+	}
+
 	/**  process TS_URB_BULK_OR_INTERRUPT_TRANSFER */
 	return pdev->bulk_or_interrupt_transfer(
 	    pdev, callback, MessageId, RequestId, EndpointAddress, TransferFlags, noAck,
@@ -804,6 +827,13 @@ static UINT urb_isoch_transfer(IUDEVICE* pdev, URBDRC_CHANNEL_CALLBACK* callback
 	packetDescriptorData = Stream_Pointer(s);
 	Stream_Seek(s, NumberOfPackets * 12);
 	Stream_Read_UINT32(s, OutputBufferSize);
+
+	if (transferDir == USBD_TRANSFER_DIRECTION_OUT)
+	{
+		if (!Stream_CheckAndLogRequiredLength(TAG, s, OutputBufferSize))
+			return ERROR_INVALID_DATA;
+	}
+
 	return pdev->isoch_transfer(
 	    pdev, callback, MessageId, RequestId, EndpointAddress, TransferFlags, StartFrame,
 	    ErrorCount, noAck, packetDescriptorData, NumberOfPackets, OutputBufferSize,
@@ -1749,6 +1779,13 @@ static UINT urbdrc_process_transfer_request(IUDEVICE* pdev, URBDRC_CHANNEL_CALLB
 			break;
 	}
 
+	if (error)
+	{
+		WLog_Print(urbdrc->log, WLOG_WARN,
+		           "USB transfer request URB Function %08" PRIx32 " failed with %08" PRIx32,
+		           URB_Function, error);
+	}
+
 	return error;
 }
 

channels/urbdrc/client/libusb/libusb_udevice.c

@@ -237,7 +237,7 @@ static void async_transfer_user_data_free(ASYNC_TRANSFER_USER_DATA* user_data)
 	}
 }
 
-static void func_iso_callback(struct libusb_transfer* transfer)
+static void LIBUSB_CALL func_iso_callback(struct libusb_transfer* transfer)
 {
 	ASYNC_TRANSFER_USER_DATA* user_data = (ASYNC_TRANSFER_USER_DATA*)transfer->user_data;
 	const UINT32 streamID = stream_id_from_buffer(transfer);
@@ -336,7 +336,7 @@ static const LIBUSB_ENDPOINT_DESCEIPTOR* func_get_ep_desc(LIBUSB_CONFIG_DESCRIPT
 	return NULL;
 }
 
-static void func_bulk_transfer_cb(struct libusb_transfer* transfer)
+static void LIBUSB_CALL func_bulk_transfer_cb(struct libusb_transfer* transfer)
 {
 	ASYNC_TRANSFER_USER_DATA* user_data;
 	uint32_t streamID;
@@ -490,17 +490,19 @@ static LIBUSB_DEVICE* udev_get_libusb_dev(libusb_context* context, uint8_t bus_n
 
 	for (i = 0; i < total_device; i++)
 	{
-		uint8_t cbus = libusb_get_bus_number(libusb_list[i]);
-		uint8_t caddr = libusb_get_device_address(libusb_list[i]);
-
-		if ((bus_number == cbus) && (dev_number == caddr))
+		LIBUSB_DEVICE* dev = libusb_list[i];
+		if ((bus_number == libusb_get_bus_number(dev)) &&
+		    (dev_number == libusb_get_device_address(dev)))
 		{
-			device = libusb_list[i];
-			break;
+			device = dev;
+		}
+		else
+		{
+			libusb_unref_device(dev);
 		}
 	}
 
-	libusb_free_device_list(libusb_list, 1);
+	libusb_free_device_list(libusb_list, 0);
 	return device;
 }
 
@@ -522,7 +524,6 @@ static LIBUSB_DEVICE_DESCRIPTOR* udev_new_descript(URBDRC_PLUGIN* urbdrc, LIBUSB
 	return descriptor;
 }
 
-
 static int libusb_udev_select_interface(IUDEVICE* idev, BYTE InterfaceNumber, BYTE AlternateSetting)
 {
 	int error = 0, diff = 0;
@@ -1012,6 +1013,9 @@ static BOOL libusb_udev_detach_kernel_driver(IUDEVICE* idev)
 	if (!pdev || !pdev->LibusbConfig || !pdev->libusb_handle || !pdev->urbdrc)
 		return FALSE;
 
+#ifdef _WIN32
+	return TRUE;
+#else
 	urbdrc = pdev->urbdrc;
 
 	if ((pdev->status & URBDRC_DEVICE_DETACH_KERNEL) == 0)
@@ -1032,6 +1036,7 @@ static BOOL libusb_udev_detach_kernel_driver(IUDEVICE* idev)
 	}
 
 	return TRUE;
+#endif
 }
 
 static BOOL libusb_udev_attach_kernel_driver(IUDEVICE* idev)
@@ -1048,12 +1053,14 @@ static BOOL libusb_udev_attach_kernel_driver(IUDEVICE* idev)
 
 		log_libusb_result(pdev->urbdrc->log, WLOG_DEBUG, "libusb_release_interface", err);
 
+#ifndef _WIN32
 		if (err != LIBUSB_ERROR_NO_DEVICE)
 		{
 			err = libusb_attach_kernel_driver(pdev->libusb_handle, i);
 			log_libusb_result(pdev->urbdrc->log, WLOG_DEBUG, "libusb_attach_kernel_driver if=%d",
 			                  err, i);
 		}
+#endif
 	}
 
 	return TRUE;
@@ -1214,12 +1221,18 @@ static int libusb_udev_isoch_transfer(IUDEVICE* idev, URBDRC_CHANNEL_CALLBACK* c
 	if (!Buffer)
 		Stream_Seek(user_data->data, (NumberOfPackets * 12));
 
-	iso_packet_size = BufferSize / NumberOfPackets;
-	iso_transfer = libusb_alloc_transfer(NumberOfPackets);
+	if (NumberOfPackets > 0)
+	{
+		iso_packet_size = BufferSize / NumberOfPackets;
+		iso_transfer = libusb_alloc_transfer((int)NumberOfPackets);
+	}
 
 	if (iso_transfer == NULL)
 	{
-		WLog_Print(urbdrc->log, WLOG_ERROR, "Error: libusb_alloc_transfer.");
+		WLog_Print(urbdrc->log, WLOG_ERROR,
+		           "Error: libusb_alloc_transfer [NumberOfPackets=%" PRIu32 ", BufferSize=%" PRIu32
+		           " ]",
+		           NumberOfPackets, BufferSize);
 		async_transfer_user_data_free(user_data);
 		return -1;
 	}
@@ -1474,6 +1487,7 @@ static void udev_free(IUDEVICE* idev)
 	ArrayList_Free(udev->request_queue);
 	/* free the config descriptor that send from windows */
 	msusb_msconfig_free(udev->MsConfig);
+	libusb_unref_device(udev->libusb_dev);
 	libusb_close(udev->libusb_handle);
 	libusb_close(udev->hub_handle);
 	free(udev->devDescriptor);
@@ -1522,8 +1536,8 @@ static void udev_load_interface(UDEVICE* pdev)
 	pdev->iface.free = udev_free;
 }
 
-static int udev_get_hub_handle(URBDRC_PLUGIN* urbdrc, libusb_context* ctx, UDEVICE* pdev,
-                               UINT16 bus_number, UINT16 dev_number)
+static int udev_get_device_handle(URBDRC_PLUGIN* urbdrc, libusb_context* ctx, UDEVICE* pdev,
+                                  UINT16 bus_number, UINT16 dev_number)
 {
 	int error;
 	ssize_t i, total_device;
@@ -1535,21 +1549,19 @@ static int udev_get_hub_handle(URBDRC_PLUGIN* urbdrc, libusb_context* ctx, UDEVI
 
 	for (i = 0; i < total_device; i++)
 	{
-		LIBUSB_DEVICE_HANDLE* handle;
-		uint8_t cbus = libusb_get_bus_number(libusb_list[i]);
-		uint8_t caddr = libusb_get_device_address(libusb_list[i]);
+		LIBUSB_DEVICE* dev = libusb_list[i];
 
-		if ((bus_number != cbus) || (dev_number != caddr))
+		if ((bus_number != libusb_get_bus_number(dev)) ||
+		    (dev_number != libusb_get_device_address(dev)))
 			continue;
 
-		error = libusb_open(libusb_list[i], &handle);
+		error = libusb_open(dev, &pdev->libusb_handle);
 
 		if (log_libusb_result(urbdrc->log, WLOG_ERROR, "libusb_open", error))
 			break;
 
 		/* get port number */
-		error = libusb_get_port_numbers(libusb_list[i], port_numbers, sizeof(port_numbers));
-		libusb_close(handle);
+		error = libusb_get_port_numbers(dev, port_numbers, sizeof(port_numbers));
 
 		if (error < 1)
 		{
@@ -1567,29 +1579,40 @@ static int udev_get_hub_handle(URBDRC_PLUGIN* urbdrc, libusb_context* ctx, UDEVI
 		WLog_Print(urbdrc->log, WLOG_DEBUG, "  DevPath: %s", pdev->path);
 		break;
 	}
+	libusb_free_device_list(libusb_list, 1);
+
+	if (error < 0)
+		return -1;
+	return 0;
+}
+
+static int udev_get_hub_handle(URBDRC_PLUGIN* urbdrc, libusb_context* ctx, UDEVICE* pdev,
+                               UINT16 bus_number, UINT16 dev_number)
+{
+	int error;
+	ssize_t i, total_device;
+	LIBUSB_DEVICE** libusb_list;
+	LIBUSB_DEVICE_HANDLE* handle;
+	total_device = libusb_get_device_list(ctx, &libusb_list);
 
 	/* Look for device hub. */
-	if (error == 0)
+	error = -1;
+
+	for (i = 0; i < total_device; i++)
 	{
-		error = -1;
+		LIBUSB_DEVICE* dev = libusb_list[i];
 
-		for (i = 0; i < total_device; i++)
-		{
-			LIBUSB_DEVICE_HANDLE* handle;
-			uint8_t cbus = libusb_get_bus_number(libusb_list[i]);
-			uint8_t caddr = libusb_get_device_address(libusb_list[i]);
+		if ((bus_number != libusb_get_bus_number(dev)) ||
+		    (1 != libusb_get_device_address(dev))) /* Root hub allways first on bus. */
+			continue;
 
-			if ((bus_number != cbus) || (1 != caddr)) /* Root hub allways first on bus. */
-				continue;
+		WLog_Print(urbdrc->log, WLOG_DEBUG, "  Open hub: %" PRIu16 "", bus_number);
+		error = libusb_open(dev, &handle);
 
-			WLog_Print(urbdrc->log, WLOG_DEBUG, "  Open hub: %" PRIu16 "", bus_number);
-			error = libusb_open(libusb_list[i], &handle);
+		if (!log_libusb_result(urbdrc->log, WLOG_ERROR, "libusb_open", error))
+			pdev->hub_handle = handle;
 
-			if (!log_libusb_result(urbdrc->log, WLOG_ERROR, "libusb_open", error))
-				pdev->hub_handle = handle;
-
-			break;
-		}
+		break;
 	}
 
 	libusb_free_device_list(libusb_list, 1);
@@ -1640,30 +1663,26 @@ static IUDEVICE* udev_init(URBDRC_PLUGIN* urbdrc, libusb_context* context, LIBUS
 	if (urbdrc->listener_callback)
 		udev_set_channelManager(&pdev->iface, urbdrc->listener_callback->channel_mgr);
 
+	/* Get DEVICE handle */
+	status = udev_get_device_handle(urbdrc, context, pdev, bus_number, dev_number);
+	if (status != LIBUSB_SUCCESS)
+	{
+		struct libusb_device_descriptor desc;
+		const uint8_t port = libusb_get_port_number(pdev->libusb_dev);
+		libusb_get_device_descriptor(pdev->libusb_dev, &desc);
+
+		log_libusb_result(urbdrc->log, WLOG_ERROR,
+		                  "libusb_open [b=0x%02X,p=0x%02X,a=0x%02X,VID=0x%04X,PID=0x%04X]", status,
+		                  bus_number, port, dev_number, desc.idVendor, desc.idProduct);
+		goto fail;
+	}
+
 	/* Get HUB handle */
 	status = udev_get_hub_handle(urbdrc, context, pdev, bus_number, dev_number);
 
 	if (status < 0)
 		pdev->hub_handle = NULL;
 
-	{
-		struct libusb_device_descriptor desc;
-		const uint8_t bus = libusb_get_bus_number(pdev->libusb_dev);
-		const uint8_t port = libusb_get_port_number(pdev->libusb_dev);
-		const uint8_t addr = libusb_get_device_address(pdev->libusb_dev);
-		libusb_get_device_descriptor(pdev->libusb_dev, &desc);
-
-		status = libusb_open(pdev->libusb_dev, &pdev->libusb_handle);
-
-		if (status != LIBUSB_SUCCESS)
-		{
-			log_libusb_result(urbdrc->log, WLOG_ERROR,
-			                  "libusb_open [b=0x%02X,p=0x%02X,a=0x%02X,VID=0x%04X,PID=0x%04X]",
-			                  status, bus, port, addr, desc.idVendor, desc.idProduct);
-			goto fail;
-		}
-	}
-
 	pdev->devDescriptor = udev_new_descript(urbdrc, pdev->libusb_dev);
 
 	if (!pdev->devDescriptor)
@@ -1734,8 +1753,6 @@ size_t udev_new_by_id(URBDRC_PLUGIN* urbdrc, libusb_context* ctx, UINT16 idVendo
 {
 	LIBUSB_DEVICE** libusb_list;
 	UDEVICE** array;
-	UINT16 bus_number;
-	UINT16 dev_number;
 	ssize_t i, total_device;
 	size_t num = 0;
 
@@ -1752,23 +1769,27 @@ size_t udev_new_by_id(URBDRC_PLUGIN* urbdrc, libusb_context* ctx, UINT16 idVendo
 
 	for (i = 0; i < total_device; i++)
 	{
-		LIBUSB_DEVICE_DESCRIPTOR* descriptor = udev_new_descript(urbdrc, libusb_list[i]);
+		LIBUSB_DEVICE* dev = libusb_list[i];
+		LIBUSB_DEVICE_DESCRIPTOR* descriptor = udev_new_descript(urbdrc, dev);
 
 		if ((descriptor->idVendor == idVendor) && (descriptor->idProduct == idProduct))
 		{
-			bus_number = libusb_get_bus_number(libusb_list[i]);
-			dev_number = libusb_get_device_address(libusb_list[i]);
-			array[num] = (PUDEVICE)udev_init(urbdrc, ctx, libusb_list[i], bus_number, dev_number);
+			array[num] = (PUDEVICE)udev_init(urbdrc, ctx, dev, libusb_get_bus_number(dev),
+			                                 libusb_get_device_address(dev));
 
 			if (array[num] != NULL)
 				num++;
 		}
+		else
+		{
+			libusb_unref_device(dev);
+		}
 
 		free(descriptor);
 	}
 
 fail:
-	libusb_free_device_list(libusb_list, 1);
+	libusb_free_device_list(libusb_list, 0);
 	*devArray = (IUDEVICE**)array;
 	return num;
 }

channels/urbdrc/client/libusb/libusb_udevman.c

@@ -195,6 +195,12 @@ static size_t udevman_register_udevice(IUDEVMAN* idevman, BYTE bus_number, BYTE
 		/* register all device that match pid vid */
 		num = udev_new_by_id(urbdrc, udevman->context, idVendor, idProduct, &devArray);
 
+		if (num == 0)
+		{
+			WLog_Print(urbdrc->log, WLOG_WARN,
+			           "Could not find or redirect any usb devices by id %04x:%04x", idVendor, idProduct);
+		}
+
 		for (i = 0; i < num; i++)
 		{
 			UINT32 id;
@@ -505,12 +511,7 @@ static BOOL filter_by_class(uint8_t bDeviceClass, uint8_t bDeviceSubClass)
 
 static BOOL append(char* dst, size_t length, const char* src)
 {
-	size_t slen = strlen(src);
-	size_t dlen = strnlen(dst, length);
-	if (dlen + slen >= length)
-		return FALSE;
-	strcat(dst, src);
-	return TRUE;
+	return winpr_str_append(src, dst, length, NULL);
 }
 
 static BOOL device_is_filtered(struct libusb_device* dev,
@@ -580,8 +581,8 @@ static BOOL device_is_filtered(struct libusb_device* dev,
 	return filtered;
 }
 
-static int hotplug_callback(struct libusb_context* ctx, struct libusb_device* dev,
-                            libusb_hotplug_event event, void* user_data)
+static int LIBUSB_CALL hotplug_callback(struct libusb_context* ctx, struct libusb_device* dev,
+                                        libusb_hotplug_event event, void* user_data)
 {
 	VID_PID_PAIR pair;
 	struct libusb_device_descriptor desc;
@@ -834,7 +835,7 @@ static BOOL poll_libusb_events(UDEVMAN* udevman)
 {
 	int rc = LIBUSB_SUCCESS;
 	struct timeval tv = { 0, 500 };
-	if (libusb_try_lock_events(udevman->context))
+	if (libusb_try_lock_events(udevman->context) == 0)
 	{
 		if (libusb_event_handling_ok(udevman->context))
 		{
@@ -859,7 +860,7 @@ static BOOL poll_libusb_events(UDEVMAN* udevman)
 	return rc > 0;
 }
 
-static DWORD poll_thread(LPVOID lpThreadParameter)
+static DWORD WINAPI poll_thread(LPVOID lpThreadParameter)
 {
 	libusb_hotplug_callback_handle handle;
 	UDEVMAN* udevman = (UDEVMAN*)lpThreadParameter;
@@ -921,7 +922,7 @@ UINT freerdp_urbdrc_client_subsystem_entry(PFREERDP_URBDRC_SERVICE_ENTRY_POINTS
 	udevman->next_device_id = BASE_USBDEVICE_NUM;
 	udevman->iface.plugin = pEntryPoints->plugin;
 	rc = libusb_init(&udevman->context);
-
+	
 	if (rc != LIBUSB_SUCCESS)
 		goto fail;
 

channels/video/client/CMakeLists.txt

@@ -25,8 +25,10 @@ include_directories(..)
 
 add_channel_client_library(${MODULE_PREFIX} ${MODULE_NAME} ${CHANNEL_NAME} TRUE "DVCPluginEntry")
 
-
-
+if (NOT BUILTIN_CHANNELS)
+	set(${MODULE_PREFIX}_LIBS ${${MODULE_PREFIX}_LIBS} freerdp-client)
+	set(${MODULE_PREFIX}_LIBS ${${MODULE_PREFIX}_LIBS} rdpgfx-client)
+endif()
 set(${MODULE_PREFIX}_LIBS ${${MODULE_PREFIX}_LIBS} winpr)
 
 target_link_libraries(${MODULE_NAME} ${${MODULE_PREFIX}_LIBS})

channels/video/client/video_main.c

@@ -930,6 +930,8 @@ static UINT video_data_on_data_received(IWTSVirtualChannelCallback* pChannelCall
 	Stream_Read_UINT16(s, data.PacketsInSample);
 	Stream_Read_UINT32(s, data.SampleNumber);
 	Stream_Read_UINT32(s, data.cbSample);
+	if (!Stream_CheckAndLogRequiredLength(TAG, s, data.cbSample))
+		return ERROR_INVALID_DATA;
 	data.pSample = Stream_Pointer(s);
 
 	/*

client/Wayland/wlf_input.c

@@ -134,26 +134,44 @@ BOOL wlf_handle_pointer_buttons(freerdp* instance, const UwacPointerButtonEvent*
 }
 
 BOOL wlf_handle_pointer_axis(freerdp* instance, const UwacPointerAxisEvent* ev)
+{
+	wlfContext* context;
+	if (!instance || !instance->context || !ev)
+		return FALSE;
+
+	context = (wlfContext*)instance->context;
+	ArrayList_Add(context->events, ev);
+	return TRUE;
+}
+
+BOOL wlf_handle_pointer_axis_discrete(freerdp* instance, const UwacPointerAxisEvent* ev)
+{
+	wlfContext* context;
+	if (!instance || !instance->context || !ev)
+		return FALSE;
+
+	context = (wlfContext*)instance->context;
+	ArrayList_Add(context->events, ev);
+	return TRUE;
+}
+
+static BOOL wlf_handle_wheel(freerdp* instance, uint32_t x, uint32_t y, uint32_t axis,
+                             int32_t value)
 {
 	rdpInput* input;
 	UINT16 flags = 0;
 	int32_t direction;
-	uint32_t x, y;
-	uint32_t i;
+	uint32_t avalue = abs(value);
 
-	if (!instance || !ev || !instance->input)
-		return FALSE;
-
-	x = ev->x;
-	y = ev->y;
+	input = instance->input;
 
 	if (!wlf_scale_coordinates(instance->context, &x, &y, TRUE))
 		return FALSE;
 
 	input = instance->input;
 
-	direction = ev->value;
-	switch (ev->axis)
+	direction = value;
+	switch (axis)
 	{
 		case WL_POINTER_AXIS_VERTICAL_SCROLL:
 			flags |= PTR_FLAGS_WHEEL;
@@ -176,16 +194,102 @@ BOOL wlf_handle_pointer_axis(freerdp* instance, const UwacPointerAxisEvent* ev)
 	 * positive: 0 ... 0xFF  -> slow ... fast
 	 * negative: 0 ... 0xFF  -> fast ... slow
 	 */
-	for (i = 0; i < abs(direction); i++)
+
+	while (avalue > 0)
 	{
-		uint32_t cflags = flags | 0x78;
+		const uint32_t cval = avalue > 0xFF ? 0xFF : avalue;
+		uint32_t cflags = flags | cval;
 		/* Convert negative values to 9bit twos complement */
 		if (flags & PTR_FLAGS_WHEEL_NEGATIVE)
-			cflags = (flags & 0xFF00) | (0x100 - (cflags & 0xFF));
+			cflags = (flags & 0xFF00) | (0x100 - cval);
 		if (!freerdp_input_send_mouse_event(input, cflags, (UINT16)x, (UINT16)y))
 			return FALSE;
+
+		avalue -= cval;
+	}
+	return TRUE;
+}
+
+BOOL wlf_handle_pointer_frame(freerdp* instance, const UwacPointerFrameEvent* ev)
+{
+	BOOL success = TRUE;
+	BOOL handle = FALSE;
+	size_t x;
+	wlfContext* context;
+	enum wl_pointer_axis_source source;
+
+	if (!instance || !ev || !instance->input || !instance->context)
+		return FALSE;
+
+	context = (wlfContext*)instance->context;
+
+	for (x = 0; x < ArrayList_Count(context->events); x++)
+	{
+		UwacEvent* ev = ArrayList_GetItem(context->events, x);
+		if (!ev)
+			continue;
+		if (ev->type == UWAC_EVENT_POINTER_SOURCE)
+		{
+			handle = TRUE;
+			source = ev->mouse_source.axis_source;
+		}
 	}
 
+	/* We need source events to determine how to interpret the data */
+	if (handle)
+	{
+		for (x = 0; x < ArrayList_Count(context->events); x++)
+		{
+			UwacEvent* ev = ArrayList_GetItem(context->events, x);
+			if (!ev)
+				continue;
+
+			switch (source)
+			{
+				/* If we have a mouse wheel, just use discrete data */
+				case WL_POINTER_AXIS_SOURCE_WHEEL:
+#if defined(WL_POINTER_AXIS_SOURCE_WHEEL_TILT_SINCE_VERSION)
+				case WL_POINTER_AXIS_SOURCE_WHEEL_TILT:
+#endif
+					if (ev->type == UWAC_EVENT_POINTER_AXIS_DISCRETE)
+					{
+						/* Get the number of steps, multiply by default step width of 120 */
+						int32_t val = ev->mouse_axis.value * 0x78;
+						/* No wheel event received, success! */
+						if (!wlf_handle_wheel(instance, ev->mouse_axis.x, ev->mouse_axis.y,
+						                      ev->mouse_axis.axis, val))
+							success = FALSE;
+					}
+					break;
+					/* If we have a touch pad we get actual data, scale */
+				case WL_POINTER_AXIS_SOURCE_FINGER:
+				case WL_POINTER_AXIS_SOURCE_CONTINUOUS:
+					if (ev->type == UWAC_EVENT_POINTER_AXIS)
+					{
+						double dval = wl_fixed_to_double(ev->mouse_axis.value);
+						int32_t val = dval * 0x78 / 10.0;
+						if (!wlf_handle_wheel(instance, ev->mouse_axis.x, ev->mouse_axis.y,
+						                      ev->mouse_axis.axis, val))
+							success = FALSE;
+					}
+					break;
+				default:
+					break;
+			}
+		}
+	}
+	ArrayList_Clear(context->events);
+	return success;
+}
+
+BOOL wlf_handle_pointer_source(freerdp* instance, const UwacPointerSourceEvent* ev)
+{
+	wlfContext* context;
+	if (!instance || !instance->context || !ev)
+		return FALSE;
+
+	context = (wlfContext*)instance->context;
+	ArrayList_Add(context->events, ev);
 	return TRUE;
 }
 

client/Wayland/wlf_input.h

@@ -30,6 +30,9 @@ BOOL wlf_handle_pointer_enter(freerdp* instance, const UwacPointerEnterLeaveEven
 BOOL wlf_handle_pointer_motion(freerdp* instance, const UwacPointerMotionEvent* ev);
 BOOL wlf_handle_pointer_buttons(freerdp* instance, const UwacPointerButtonEvent* ev);
 BOOL wlf_handle_pointer_axis(freerdp* instance, const UwacPointerAxisEvent* ev);
+BOOL wlf_handle_pointer_axis_discrete(freerdp* instance, const UwacPointerAxisEvent* ev);
+BOOL wlf_handle_pointer_frame(freerdp* instance, const UwacPointerFrameEvent* ev);
+BOOL wlf_handle_pointer_source(freerdp* instance, const UwacPointerSourceEvent* ev);
 BOOL wlf_handle_touch_up(freerdp* instance, const UwacTouchUp* ev);
 BOOL wlf_handle_touch_down(freerdp* instance, const UwacTouchDown* ev);
 BOOL wlf_handle_touch_motion(freerdp* instance, const UwacTouchMotion* ev);

client/Wayland/wlfreerdp.c

@@ -225,6 +225,7 @@ static BOOL wl_post_connect(freerdp* instance)
 	wlfContext* context;
 	rdpSettings* settings;
 	char* title = "FreeRDP";
+	char* app_id = "wlfreerdp";
 	UINT32 w, h;
 
 	if (!instance || !instance->context)
@@ -266,6 +267,7 @@ static BOOL wl_post_connect(freerdp* instance)
 
 	UwacWindowSetFullscreenState(window, NULL, instance->context->settings->Fullscreen);
 	UwacWindowSetTitle(window, title);
+	UwacWindowSetAppId(window, app_id);
 	UwacWindowSetOpaqueRegion(context->window, 0, 0, w, h);
 	instance->update->BeginPaint = wl_begin_paint;
 	instance->update->EndPaint = wl_end_paint;
@@ -360,12 +362,22 @@ static BOOL handle_uwac_events(freerdp* instance, UwacDisplay* display)
 				break;
 
 			case UWAC_EVENT_POINTER_AXIS:
+				if (!wlf_handle_pointer_axis(instance, &event.mouse_axis))
+					return FALSE;
 				break;
 
 			case UWAC_EVENT_POINTER_AXIS_DISCRETE:
-				if (!wlf_handle_pointer_axis(instance, &event.mouse_axis))
+				if (!wlf_handle_pointer_axis_discrete(instance, &event.mouse_axis))
 					return FALSE;
+				break;
 
+			case UWAC_EVENT_POINTER_FRAME:
+				if (!wlf_handle_pointer_frame(instance, &event.mouse_frame))
+					return FALSE;
+				break;
+			case UWAC_EVENT_POINTER_SOURCE:
+				if (!wlf_handle_pointer_source(instance, &event.mouse_source))
+					return FALSE;
 				break;
 
 			case UWAC_EVENT_KEY:
@@ -559,8 +571,37 @@ static int wlf_logon_error_info(freerdp* instance, UINT32 data, UINT32 type)
 	return 1;
 }
 
+static void wlf_client_free(freerdp* instance, rdpContext* context)
+{
+	wlfContext* wlf = (wlfContext*)instance->context;
+
+	if (!context)
+		return;
+
+	if (wlf->display)
+		UwacCloseDisplay(&wlf->display);
+
+	if (wlf->displayHandle)
+		CloseHandle(wlf->displayHandle);
+	ArrayList_Free(wlf->events);
+	DeleteCriticalSection(&wlf->critical);
+}
+
+static void* uwac_event_clone(const void* val)
+{
+	UwacEvent* copy;
+	UwacEvent* ev = (UwacEvent*)val;
+
+	copy = calloc(1, sizeof(UwacEvent));
+	if (!copy)
+		return NULL;
+	*copy = *ev;
+	return copy;
+}
+
 static BOOL wlf_client_new(freerdp* instance, rdpContext* context)
 {
+	wObject* obj;
 	UwacReturnCode status;
 	wlfContext* wfl = (wlfContext*)context;
 
@@ -588,26 +629,19 @@ static BOOL wlf_client_new(freerdp* instance, rdpContext* context)
 	if (!wfl->displayHandle)
 		return FALSE;
 
+	wfl->events = ArrayList_New(FALSE);
+	if (!wfl->events)
+		return FALSE;
+
+	obj = ArrayList_Object(wfl->events);
+	obj->fnObjectNew = uwac_event_clone;
+	obj->fnObjectFree = free;
+
 	InitializeCriticalSection(&wfl->critical);
 
 	return TRUE;
 }
 
-static void wlf_client_free(freerdp* instance, rdpContext* context)
-{
-	wlfContext* wlf = (wlfContext*)instance->context;
-
-	if (!context)
-		return;
-
-	if (wlf->display)
-		UwacCloseDisplay(&wlf->display);
-
-	if (wlf->displayHandle)
-		CloseHandle(wlf->displayHandle);
-	DeleteCriticalSection(&wlf->critical);
-}
-
 static int wfl_client_start(rdpContext* context)
 {
 	WINPR_UNUSED(context);

client/Wayland/wlfreerdp.h

@@ -53,6 +53,7 @@ struct wlf_context
 	wlfDispContext* disp;
 	wLog* log;
 	CRITICAL_SECTION critical;
+	wArrayList* events;
 };
 
 BOOL wlf_scale_coordinates(rdpContext* context, UINT32* px, UINT32* py, BOOL fromLocalToRDP);

client/X11/xf_client.c

@@ -815,8 +815,6 @@ void xf_lock_x11_(xfContext* xfc, const char* fkt)
 	else
 		XLockDisplay(xfc->display);
 
-	if (xfc->locked)
-		WLog_WARN(TAG, "%s:\t[%" PRIu32 "] recursive lock from %s", __FUNCTION__, xfc->locked, fkt);
 	xfc->locked++;
 	WLog_VRB(TAG, "%s:\t[%" PRIu32 "] from %s", __FUNCTION__, xfc->locked, fkt);
 }
@@ -1256,6 +1254,7 @@ static BOOL xf_post_connect(freerdp* instance)
 	context = instance->context;
 	settings = instance->settings;
 	update = context->update;
+	BOOL serverIsWindowsPlatform;
 
 	if (!gdi_init(instance, xf_get_local_color_format(xfc, TRUE)))
 		return FALSE;
@@ -1325,7 +1324,8 @@ static BOOL xf_post_connect(freerdp* instance)
 	update->SetKeyboardIndicators = xf_keyboard_set_indicators;
 	update->SetKeyboardImeStatus = xf_keyboard_set_ime_status;
 
-	if (!(xfc->clipboard = xf_clipboard_new(xfc)))
+	serverIsWindowsPlatform = (settings->OsMajorType == OSMAJORTYPE_WINDOWS);
+	if (!(xfc->clipboard = xf_clipboard_new(xfc, !serverIsWindowsPlatform)))
 		return FALSE;
 
 	if (!(xfc->xfDisp = xf_disp_new(xfc)))
@@ -1384,7 +1384,10 @@ static int xf_logon_error_info(freerdp* instance, UINT32 data, UINT32 type)
 	const char* str_data = freerdp_get_logon_error_info_data(data);
 	const char* str_type = freerdp_get_logon_error_info_type(type);
 	WLog_INFO(TAG, "Logon Error Info %s [%s]", str_data, str_type);
-	xf_rail_disable_remoteapp_mode(xfc);
+	if(type != LOGON_MSG_SESSION_CONTINUE)
+	{
+	    xf_rail_disable_remoteapp_mode(xfc);
+	}
 	return 1;
 }
 

client/X11/xf_cliprdr.c

@@ -1756,7 +1756,27 @@ static UINT xf_cliprdr_clipboard_file_range_failure(wClipboardDelegate* delegate
 	return clipboard->context->ClientFileContentsResponse(clipboard->context, &response);
 }
 
-xfClipboard* xf_clipboard_new(xfContext* xfc)
+static BOOL xf_cliprdr_clipboard_is_valid_unix_filename(LPCWSTR filename)
+{
+	LPCWSTR c;
+
+	if (!filename)
+		return FALSE;
+
+	if (filename[0] == L'\0')
+		return FALSE;
+
+	/* Reserved characters */
+	for (c = filename; *c; ++c)
+	{
+		if (*c == L'/')
+			return FALSE;
+	}
+
+	return TRUE;
+}
+
+xfClipboard* xf_clipboard_new(xfContext* xfc, BOOL relieveFilenameRestriction)
 {
 	int i, n = 0;
 	rdpChannels* channels;
@@ -1885,6 +1905,13 @@ xfClipboard* xf_clipboard_new(xfContext* xfc)
 	clipboard->delegate->ClipboardFileSizeFailure = xf_cliprdr_clipboard_file_size_failure;
 	clipboard->delegate->ClipboardFileRangeSuccess = xf_cliprdr_clipboard_file_range_success;
 	clipboard->delegate->ClipboardFileRangeFailure = xf_cliprdr_clipboard_file_range_failure;
+
+	if (relieveFilenameRestriction)
+	{
+		WLog_DBG(TAG, "Relieving CLIPRDR filename restriction");
+		clipboard->delegate->IsFileNameComponentValid = xf_cliprdr_clipboard_is_valid_unix_filename;
+	}
+
 	return clipboard;
 error:
 

client/X11/xf_cliprdr.h

@@ -25,7 +25,7 @@
 
 #include <freerdp/client/cliprdr.h>
 
-xfClipboard* xf_clipboard_new(xfContext* xfc);
+xfClipboard* xf_clipboard_new(xfContext* xfc, BOOL relieveFilenameRestriction);
 void xf_clipboard_free(xfClipboard* clipboard);
 
 void xf_cliprdr_init(xfContext* xfc, CliprdrClientContext* cliprdr);

client/X11/xf_disp.c

@@ -93,7 +93,7 @@ static BOOL xf_update_last_sent(xfDispContext* xfDisp)
 
 static BOOL xf_disp_sendResize(xfDispContext* xfDisp)
 {
-	DISPLAY_CONTROL_MONITOR_LAYOUT layout;
+	DISPLAY_CONTROL_MONITOR_LAYOUT layout = { 0 };
 	xfContext* xfc;
 	rdpSettings* settings;
 
@@ -242,7 +242,24 @@ static void xf_disp_OnTimer(void* context, TimerEventArgs* e)
 	if (!xf_disp_check_context(context, &xfc, &xfDisp, &settings))
 		return;
 
-	if (!xfDisp->activated || settings->Fullscreen)
+	if (!xfDisp->activated || xfc->fullscreen)
+		return;
+
+	xf_disp_sendResize(xfDisp);
+}
+
+static void xf_disp_OnWindowStateChange(void* context, WindowStateChangeEventArgs* e)
+{
+	xfContext* xfc;
+	xfDispContext* xfDisp;
+	rdpSettings* settings;
+
+	WINPR_UNUSED(e);
+
+	if (!xf_disp_check_context(context, &xfc, &xfDisp, &settings))
+		return;
+
+	if (!xfDisp->activated || !xfc->fullscreen)
 		return;
 
 	xf_disp_sendResize(xfDisp);
@@ -274,6 +291,7 @@ xfDispContext* xf_disp_new(xfContext* xfc)
 	PubSub_SubscribeActivated(xfc->context.pubSub, xf_disp_OnActivated);
 	PubSub_SubscribeGraphicsReset(xfc->context.pubSub, xf_disp_OnGraphicsReset);
 	PubSub_SubscribeTimer(xfc->context.pubSub, xf_disp_OnTimer);
+	PubSub_SubscribeWindowStateChange(xfc->context.pubSub, xf_disp_OnWindowStateChange);
 	return ret;
 }
 
@@ -287,6 +305,7 @@ void xf_disp_free(xfDispContext* disp)
 		PubSub_UnsubscribeActivated(disp->xfc->context.pubSub, xf_disp_OnActivated);
 		PubSub_UnsubscribeGraphicsReset(disp->xfc->context.pubSub, xf_disp_OnGraphicsReset);
 		PubSub_UnsubscribeTimer(disp->xfc->context.pubSub, xf_disp_OnTimer);
+		PubSub_UnsubscribeWindowStateChange(disp->xfc->context.pubSub, xf_disp_OnWindowStateChange);
 	}
 
 	free(disp);

client/X11/xf_event.c

@@ -24,6 +24,8 @@
 #include <X11/Xlib.h>
 #include <X11/Xutil.h>
 
+#include <winpr/assert.h>
+
 #include <freerdp/log.h>
 #include <freerdp/locale/keyboard.h>
 
@@ -33,6 +35,7 @@
 #include "xf_disp.h"
 #include "xf_input.h"
 #include "xf_gfx.h"
+#include "xf_graphics.h"
 
 #include "xf_event.h"
 #include "xf_input.h"
@@ -518,6 +521,29 @@ static BOOL xf_event_KeyRelease(xfContext* xfc, const XKeyEvent* event, BOOL app
 	return TRUE;
 }
 
+/* Release a key, but ignore the event in case of autorepeat.
+ */
+static BOOL xf_event_KeyReleaseOrIgnore(xfContext* xfc, const XKeyEvent* event, BOOL app)
+{
+	WINPR_ASSERT(xfc);
+	WINPR_ASSERT(event);
+
+	if ((event->type == KeyRelease) && XEventsQueued(xfc->display, QueuedAfterReading))
+	{
+		XEvent nev = { 0 };
+		XPeekEvent(xfc->display, &nev);
+
+		if ((nev.type == KeyPress) && (nev.xkey.time == event->time) &&
+		    (nev.xkey.keycode == event->keycode))
+		{
+			/* Key wasn’t actually released */
+			return TRUE;
+		}
+	}
+
+	return xf_event_KeyRelease(xfc, event, app);
+}
+
 static BOOL xf_event_FocusIn(xfContext* xfc, const XFocusInEvent* event, BOOL app)
 {
 	if (event->mode == NotifyGrab)
@@ -537,6 +563,7 @@ static BOOL xf_event_FocusIn(xfContext* xfc, const XFocusInEvent* event, BOOL ap
 	/* Release all keys, should already be done at FocusOut but might be missed
 	 * if the WM decided to use an alternate event order */
 	xf_keyboard_release_all_keypress(xfc);
+	xf_pointer_update_scale(xfc);
 
 	if (app)
 	{
@@ -668,6 +695,9 @@ static BOOL xf_event_ConfigureNotify(xfContext* xfc, const XConfigureEvent* even
 	rdpSettings* settings;
 	settings = xfc->context.settings;
 
+	WLog_DBG(TAG, "%s: x=%" PRId32 ", y=%" PRId32 ", w=%" PRId32 ", h=%" PRId32, __func__, event->x,
+	         event->y, event->width, event->height);
+
 	if (!app)
 	{
 		if (!xfc->window)
@@ -710,43 +740,42 @@ static BOOL xf_event_ConfigureNotify(xfContext* xfc, const XConfigureEvent* even
 			/* ask the server to resize using the display channel */
 			xf_disp_handle_configureNotify(xfc, alignedWidth, alignedHeight);
 		}
-
-		return TRUE;
 	}
-
-	appWindow = xf_AppWindowFromX11Window(xfc, event->window);
-
-	if (appWindow)
+	else
 	{
-		/*
-		 * ConfigureNotify coordinates are expressed relative to the window parent.
-		 * Translate these to root window coordinates.
-		 */
-		XTranslateCoordinates(xfc->display, appWindow->handle, RootWindowOfScreen(xfc->screen), 0,
-		                      0, &appWindow->x, &appWindow->y, &childWindow);
-		appWindow->width = event->width;
-		appWindow->height = event->height;
+		appWindow = xf_AppWindowFromX11Window(xfc, event->window);
 
-		/*
-		 * Additional checks for not in a local move and not ignoring configure to send
-		 * position update to server, also should the window not be focused then do not
-		 * send to server yet (i.e. resizing using window decoration).
-		 * The server will be updated when the window gets refocused.
-		 */
-		if (appWindow->decorations)
+		if (appWindow)
 		{
-			/* moving resizing using window decoration */
-			xf_rail_adjust_position(xfc, appWindow);
-		}
-		else
-		{
-			if ((!event->send_event || appWindow->local_move.state == LMS_NOT_ACTIVE) &&
-			    !appWindow->rail_ignore_configure && xfc->focused)
+			/*
+			 * ConfigureNotify coordinates are expressed relative to the window parent.
+			 * Translate these to root window coordinates.
+			 */
+			XTranslateCoordinates(xfc->display, appWindow->handle, RootWindowOfScreen(xfc->screen),
+			                      0, 0, &appWindow->x, &appWindow->y, &childWindow);
+			appWindow->width = event->width;
+			appWindow->height = event->height;
+
+			/*
+			 * Additional checks for not in a local move and not ignoring configure to send
+			 * position update to server, also should the window not be focused then do not
+			 * send to server yet (i.e. resizing using window decoration).
+			 * The server will be updated when the window gets refocused.
+			 */
+			if (appWindow->decorations)
+			{
+				/* moving resizing using window decoration */
 				xf_rail_adjust_position(xfc, appWindow);
+			}
+			else
+			{
+				if ((!event->send_event || appWindow->local_move.state == LMS_NOT_ACTIVE) &&
+				    !appWindow->rail_ignore_configure && xfc->focused)
+					xf_rail_adjust_position(xfc, appWindow);
+			}
 		}
 	}
-
-	return TRUE;
+	return xf_pointer_update_scale(xfc);
 }
 
 static BOOL xf_event_MapNotify(xfContext* xfc, const XMapEvent* event, BOOL app)
@@ -759,14 +788,14 @@ static BOOL xf_event_MapNotify(xfContext* xfc, const XMapEvent* event, BOOL app)
 	{
 		appWindow = xf_AppWindowFromX11Window(xfc, event->window);
 
-		if (appWindow)
+		if (appWindow && (appWindow->rail_state == WINDOW_SHOW))
 		{
 			/* local restore event */
 			/* This is now handled as part of the PropertyNotify
 			 * Doing this here would inhibit the ability to restore a maximized window
 			 * that is minimized back to the maximized state
 			 */
-			xf_rail_send_client_system_command(xfc, appWindow->windowId, SC_RESTORE);
+			// xf_rail_send_client_system_command(xfc, appWindow->windowId, SC_RESTORE);
 			appWindow->is_mapped = TRUE;
 		}
 	}
@@ -777,6 +806,10 @@ static BOOL xf_event_MapNotify(xfContext* xfc, const XMapEvent* event, BOOL app)
 static BOOL xf_event_UnmapNotify(xfContext* xfc, const XUnmapEvent* event, BOOL app)
 {
 	xfAppWindow* appWindow;
+
+	WINPR_ASSERT(xfc);
+	WINPR_ASSERT(event);
+
 	xf_keyboard_release_all_keypress(xfc);
 
 	if (!app)
@@ -796,6 +829,9 @@ static BOOL xf_event_UnmapNotify(xfContext* xfc, const XUnmapEvent* event, BOOL
 
 static BOOL xf_event_PropertyNotify(xfContext* xfc, const XPropertyEvent* event, BOOL app)
 {
+	WINPR_ASSERT(xfc);
+	WINPR_ASSERT(event);
+
 	/*
 	 * This section handles sending the appropriate commands to the rail server
 	 * when the window has been minimized, maximized, restored locally
@@ -830,18 +866,27 @@ static BOOL xf_event_PropertyNotify(xfContext* xfc, const XPropertyEvent* event,
 
 			if (status)
 			{
+				if (appWindow)
+				{
+					appWindow->maxVert = FALSE;
+					appWindow->maxHorz = FALSE;
+				}
 				for (i = 0; i < nitems; i++)
 				{
 					if ((Atom)((UINT16**)prop)[i] ==
 					    XInternAtom(xfc->display, "_NET_WM_STATE_MAXIMIZED_VERT", False))
 					{
 						maxVert = TRUE;
+						if (appWindow)
+							appWindow->maxVert = TRUE;
 					}
 
 					if ((Atom)((UINT16**)prop)[i] ==
 					    XInternAtom(xfc->display, "_NET_WM_STATE_MAXIMIZED_HORZ", False))
 					{
 						maxHorz = TRUE;
+						if (appWindow)
+							appWindow->maxHorz = TRUE;
 					}
 				}
 
@@ -858,9 +903,17 @@ static BOOL xf_event_PropertyNotify(xfContext* xfc, const XPropertyEvent* event,
 			{
 				/* If the window is in the iconic state */
 				if (((UINT32)*prop == 3))
+				{
 					minimized = TRUE;
+					if (appWindow)
+						appWindow->minimized = TRUE;
+				}
 				else
+				{
 					minimized = FALSE;
+					if (appWindow)
+						appWindow->minimized = FALSE;
+				}
 
 				minimizedChanged = TRUE;
 				XFree(prop);
@@ -869,22 +922,30 @@ static BOOL xf_event_PropertyNotify(xfContext* xfc, const XPropertyEvent* event,
 
 		if (app)
 		{
-			if (maxVert && maxHorz && !minimized &&
-			    (appWindow->rail_state != WINDOW_SHOW_MAXIMIZED))
+			WINPR_ASSERT(appWindow);
+			if (appWindow->maxVert && appWindow->maxHorz && !appWindow->minimized)
 			{
-				appWindow->rail_state = WINDOW_SHOW_MAXIMIZED;
-				xf_rail_send_client_system_command(xfc, appWindow->windowId, SC_MAXIMIZE);
+				if (appWindow->rail_state != WINDOW_SHOW_MAXIMIZED)
+				{
+					appWindow->rail_state = WINDOW_SHOW_MAXIMIZED;
+					xf_rail_send_client_system_command(xfc, appWindow->windowId, SC_MAXIMIZE);
+				}
 			}
-			else if (minimized && (appWindow->rail_state != WINDOW_SHOW_MINIMIZED))
+			else if (appWindow->minimized)
 			{
-				appWindow->rail_state = WINDOW_SHOW_MINIMIZED;
-				xf_rail_send_client_system_command(xfc, appWindow->windowId, SC_MINIMIZE);
+				if (appWindow->rail_state != WINDOW_SHOW_MINIMIZED)
+				{
+					appWindow->rail_state = WINDOW_SHOW_MINIMIZED;
+					xf_rail_send_client_system_command(xfc, appWindow->windowId, SC_MINIMIZE);
+				}
 			}
-			else if (!minimized && !maxVert && !maxHorz && (appWindow->rail_state != WINDOW_SHOW) &&
-			         (appWindow->rail_state != WINDOW_HIDE))
+			else
 			{
-				appWindow->rail_state = WINDOW_SHOW;
-				xf_rail_send_client_system_command(xfc, appWindow->windowId, SC_RESTORE);
+				if (appWindow->rail_state != WINDOW_SHOW && appWindow->rail_state != WINDOW_HIDE)
+				{
+					appWindow->rail_state = WINDOW_SHOW;
+					xf_rail_send_client_system_command(xfc, appWindow->windowId, SC_RESTORE);
+				}
 			}
 		}
 		else if (minimizedChanged)
@@ -1048,7 +1109,7 @@ BOOL xf_event_process(freerdp* instance, const XEvent* event)
 			break;
 
 		case KeyRelease:
-			status = xf_event_KeyRelease(xfc, &event->xkey, xfc->remote_app);
+			status = xf_event_KeyReleaseOrIgnore(xfc, &event->xkey, xfc->remote_app);
 			break;
 
 		case FocusIn:

client/X11/xf_gdi.c

@@ -1066,7 +1066,7 @@ static BOOL xf_gdi_surface_bits(rdpContext* context, const SURFACE_BITS_COMMAND*
 		case RDP_CODEC_ID_NONE:
 			pSrcData = cmd->bmp.bitmapData;
 			format = gdi_get_pixel_format(cmd->bmp.bpp);
-			size = cmd->bmp.width * cmd->bmp.height * GetBytesPerPixel(format) * 1ULL;
+			size = 1ull * cmd->bmp.width * cmd->bmp.height * GetBytesPerPixel(format);
 			if (size > cmd->bmp.bitmapDataLength)
 			{
 				WLog_ERR(TAG, "Short nocodec message: got %" PRIu32 " bytes, require %" PRIuz,

client/X11/xf_gfx.c

@@ -288,7 +288,7 @@ static UINT xf_CreateSurface(RdpgfxClientContext* context,
 
 	surface->gdi.scanline = surface->gdi.width * GetBytesPerPixel(surface->gdi.format);
 	surface->gdi.scanline = x11_pad_scanline(surface->gdi.scanline, xfc->scanline_pad);
-	size = surface->gdi.scanline * surface->gdi.height * 1ULL;
+	size = 1ull * surface->gdi.scanline * surface->gdi.height;
 	surface->gdi.data = (BYTE*)_aligned_malloc(size, 16);
 
 	if (!surface->gdi.data)
@@ -312,7 +312,7 @@ static UINT xf_CreateSurface(RdpgfxClientContext* context,
 		UINT32 bytes = GetBytesPerPixel(gdi->dstFormat);
 		surface->stageScanline = width * bytes;
 		surface->stageScanline = x11_pad_scanline(surface->stageScanline, xfc->scanline_pad);
-		size = surface->stageScanline * surface->gdi.height * 1ULL;
+		size = 1ull * surface->stageScanline * surface->gdi.height;
 		surface->stage = (BYTE*)_aligned_malloc(size, 16);
 
 		if (!surface->stage)

client/X11/xf_graphics.c

@@ -30,6 +30,9 @@
 #include <X11/Xcursor/Xcursor.h>
 #endif
 
+#include <float.h>
+#include <math.h>
+
 #include <winpr/crt.h>
 
 #include <freerdp/codec/bitmap.h>
@@ -42,6 +45,8 @@
 #include <freerdp/log.h>
 #define TAG CLIENT_TAG("x11")
 
+static BOOL xf_Pointer_Set(rdpContext* context, const rdpPointer* pointer);
+
 BOOL xf_decode_color(xfContext* xfc, const UINT32 srcColor, XColor* color)
 {
 	rdpGdi* gdi;
@@ -227,14 +232,14 @@ static BOOL xf_Bitmap_SetSurface(rdpContext* context, rdpBitmap* bitmap, BOOL pr
 	return TRUE;
 }
 
-static BOOL _xf_Pointer_GetCursorForCurrentScale(rdpContext* context, const rdpPointer* pointer,
-                                                 Cursor* cursor)
+static BOOL xf_Pointer_GetCursorForCurrentScale(rdpContext* context, const rdpPointer* pointer,
+                                                Cursor* cursor)
 {
 #ifdef WITH_XCURSOR
 	UINT32 CursorFormat;
 	xfContext* xfc = (xfContext*)context;
 	xfPointer* xpointer = (xfPointer*)pointer;
-	XcursorImage ci;
+	XcursorImage ci = { 0 };
 	rdpSettings* settings;
 	UINT32 xTargetSize;
 	UINT32 yTargetSize;
@@ -253,8 +258,11 @@ static BOOL _xf_Pointer_GetCursorForCurrentScale(rdpContext* context, const rdpP
 
 	xscale = (settings->SmartSizing ? xfc->scaledWidth / (double)settings->DesktopWidth : 1);
 	yscale = (settings->SmartSizing ? xfc->scaledHeight / (double)settings->DesktopHeight : 1);
-	xTargetSize = pointer->width * xscale;
-	yTargetSize = pointer->height * yscale;
+	xTargetSize = MAX(1, pointer->width * xscale);
+	yTargetSize = MAX(1, pointer->height * yscale);
+
+	WLog_DBG(TAG, "%s: scaled: %" PRIu32 "x%" PRIu32 ", desktop: %" PRIu32 "x%" PRIu32, __func__,
+	         xfc->scaledWidth, xfc->savedHeight, settings->DesktopWidth, settings->DesktopHeight);
 
 	for (int i = 0; i < xpointer->nCursors; i++)
 	{
@@ -297,23 +305,29 @@ static BOOL _xf_Pointer_GetCursorForCurrentScale(rdpContext* context, const rdpP
 			}
 		}
 
-		ZeroMemory(&ci, sizeof(ci));
 		ci.version = XCURSOR_IMAGE_VERSION;
 		ci.size = sizeof(ci);
 		ci.width = xTargetSize;
 		ci.height = yTargetSize;
 		ci.xhot = pointer->xPos * xscale;
 		ci.yhot = pointer->yPos * yscale;
-		size = ci.height * ci.width * GetBytesPerPixel(CursorFormat) * 1ULL;
+		size = 1ull * ci.height * ci.width * GetBytesPerPixel(CursorFormat);
 
-		if (xscale != 1 || yscale != 1)
+		if (!(ci.pixels = (XcursorPixel*)_aligned_malloc(size, 16)))
 		{
-			if (!(ci.pixels = (XcursorPixel*)_aligned_malloc(size, 16)))
-			{
-				xf_unlock_x11(xfc);
-				return FALSE;
-			}
+			xf_unlock_x11(xfc);
+			return FALSE;
+		}
 
+		const double xs = fabs(fabs(xscale) - 1.0);
+		const double ys = fabs(fabs(yscale) - 1.0);
+		WLog_DBG(TAG,
+		         "%s: cursorIndex %" PRId32 " scaling pointer %" PRIu32 "x%" PRIu32 " --> %" PRIu32
+		         "x%" PRIu32 " [%lfx%lf]",
+		         __func__, cursorIndex, pointer->width, pointer->height, ci.width, ci.height,
+		         xscale, yscale);
+		if ((xs > DBL_EPSILON) || (ys > DBL_EPSILON))
+		{
 			if (!freerdp_image_scale((BYTE*)ci.pixels, CursorFormat, 0, 0, 0, ci.width, ci.height,
 			                         (BYTE*)xpointer->cursorPixels, CursorFormat, 0, 0, 0,
 			                         pointer->width, pointer->height))
@@ -325,7 +339,7 @@ static BOOL _xf_Pointer_GetCursorForCurrentScale(rdpContext* context, const rdpP
 		}
 		else
 		{
-			ci.pixels = xpointer->cursorPixels;
+			memcpy(ci.pixels, xpointer->cursorPixels, size);
 		}
 
 		cursorIndex = xpointer->nCursors;
@@ -333,11 +347,14 @@ static BOOL _xf_Pointer_GetCursorForCurrentScale(rdpContext* context, const rdpP
 		xpointer->cursorHeights[cursorIndex] = ci.height;
 		xpointer->cursors[cursorIndex] = XcursorImageLoadCursor(xfc->display, &ci);
 		xpointer->nCursors += 1;
-		if (xscale != 1 || yscale != 1)
-			_aligned_free(ci.pixels);
+		_aligned_free(ci.pixels);
 
 		xf_unlock_x11(xfc);
 	}
+	else
+	{
+		WLog_DBG(TAG, "%s: using cached cursor %" PRId32, __func__, cursorIndex);
+	}
 
 	cursor[0] = xpointer->cursors[cursorIndex];
 #endif
@@ -372,8 +389,21 @@ static Window xf_Pointer_get_window(xfContext* xfc)
 	}
 }
 
+BOOL xf_pointer_update_scale(xfContext* xfc)
+{
+	xfPointer* pointer;
+	WINPR_ASSERT(xfc);
+
+	pointer = xfc->pointer;
+	if (!pointer)
+		return TRUE;
+
+	return xf_Pointer_Set(&xfc->context, &xfc->pointer->pointer);
+}
+
 static BOOL xf_Pointer_New(rdpContext* context, rdpPointer* pointer)
 {
+	BOOL rc = FALSE;
 #ifdef WITH_XCURSOR
 	UINT32 CursorFormat;
 	size_t size;
@@ -381,7 +411,7 @@ static BOOL xf_Pointer_New(rdpContext* context, rdpPointer* pointer)
 	xfPointer* xpointer = (xfPointer*)pointer;
 
 	if (!context || !pointer || !context->gdi)
-		return FALSE;
+		goto fail;
 
 	if (!xfc->invert)
 		CursorFormat = (!xfc->big_endian) ? PIXEL_FORMAT_RGBA32 : PIXEL_FORMAT_ABGR32;
@@ -391,10 +421,10 @@ static BOOL xf_Pointer_New(rdpContext* context, rdpPointer* pointer)
 	xpointer->nCursors = 0;
 	xpointer->mCursors = 0;
 
-	size = pointer->height * pointer->width * GetBytesPerPixel(CursorFormat) * 1ULL;
+	size = 1ull * pointer->height * pointer->width * GetBytesPerPixel(CursorFormat);
 
 	if (!(xpointer->cursorPixels = (XcursorPixel*)_aligned_malloc(size, 16)))
-		return FALSE;
+		goto fail;
 
 	if (!freerdp_image_copy_from_pointer_data(
 	        (BYTE*)xpointer->cursorPixels, CursorFormat, 0, 0, 0, pointer->width, pointer->height,
@@ -404,15 +434,18 @@ static BOOL xf_Pointer_New(rdpContext* context, rdpPointer* pointer)
 		_aligned_free(xpointer->cursorPixels);
 		return FALSE;
 	}
+	rc = TRUE;
 
-	if (!_xf_Pointer_GetCursorForCurrentScale(context, pointer, &(xpointer->cursor)))
-		return FALSE;
 #endif
-	return TRUE;
+fail:
+	WLog_DBG(TAG, "%s: %ld", __func__, rc ? pointer : -1);
+	return rc;
 }
 
 static void xf_Pointer_Free(rdpContext* context, rdpPointer* pointer)
 {
+	WLog_DBG(TAG, "%s: %p", __func__, pointer);
+
 #ifdef WITH_XCURSOR
 	xfContext* xfc = (xfContext*)context;
 	xfPointer* xpointer = (xfPointer*)pointer;
@@ -438,6 +471,8 @@ static void xf_Pointer_Free(rdpContext* context, rdpPointer* pointer)
 
 static BOOL xf_Pointer_Set(rdpContext* context, const rdpPointer* pointer)
 {
+	WLog_DBG(TAG, "%s: %p", __func__, pointer);
+
 #ifdef WITH_XCURSOR
 	xfContext* xfc = (xfContext*)context;
 	Window handle = xf_Pointer_get_window(xfc);
@@ -447,18 +482,23 @@ static BOOL xf_Pointer_Set(rdpContext* context, const rdpPointer* pointer)
 
 	if (handle)
 	{
-		if (!_xf_Pointer_GetCursorForCurrentScale(context, pointer, &(xfc->pointer->cursor)))
+		if (!xf_Pointer_GetCursorForCurrentScale(context, pointer, &(xfc->pointer->cursor)))
 			return FALSE;
 		xf_lock_x11(xfc);
 		XDefineCursor(xfc->display, handle, xfc->pointer->cursor);
 		xf_unlock_x11(xfc);
 	}
+	else
+	{
+		WLog_WARN(TAG, "%s: handle=%ld", __func__, handle);
+	}
 #endif
 	return TRUE;
 }
 
 static BOOL xf_Pointer_SetNull(rdpContext* context)
 {
+	WLog_DBG(TAG, "%s", __func__);
 #ifdef WITH_XCURSOR
 	xfContext* xfc = (xfContext*)context;
 	static Cursor nullcursor = None;
@@ -515,11 +555,12 @@ static BOOL xf_Pointer_SetPosition(rdpContext* context, UINT32 x, UINT32 y)
 
 	if (!handle)
 	{
-		WLog_WARN(TAG, "xf_Pointer_SetPosition: focus %d, handle%lu", xfc->focused, handle);
+		WLog_WARN(TAG, "%s: focus %d, handle%lu", __func__, xfc->focused, handle);
 		return TRUE;
 	}
 
-	if (xfc->remote_app && !xfc->focused)
+	WLog_DBG(TAG, "%s: %" PRIu32 "x%" PRIu32, __func__, x, y);
+	if (!xfc->focused)
 		return TRUE;
 
 	xf_adjust_coordinates_to_screen(xfc, &x, &y);
@@ -529,7 +570,7 @@ static BOOL xf_Pointer_SetPosition(rdpContext* context, UINT32 x, UINT32 y)
 	rc = XGetWindowAttributes(xfc->display, handle, &current);
 	if (rc == 0)
 	{
-		WLog_WARN(TAG, "xf_Pointer_SetPosition: XGetWindowAttributes==%d", rc);
+		WLog_WARN(TAG, "%s: XGetWindowAttributes==%d", __func__, rc);
 		goto out;
 	}
 
@@ -538,17 +579,17 @@ static BOOL xf_Pointer_SetPosition(rdpContext* context, UINT32 x, UINT32 y)
 	rc = XChangeWindowAttributes(xfc->display, handle, CWEventMask, &tmp);
 	if (rc == 0)
 	{
-		WLog_WARN(TAG, "xf_Pointer_SetPosition: XChangeWindowAttributes==%d", rc);
+		WLog_WARN(TAG, "%s: XChangeWindowAttributes==%d", __func__, rc);
 		goto out;
 	}
 
-	rc = XWarpPointer(xfc->display, None, handle, 0, 0, 0, 0, x, y);
+	rc = XWarpPointer(xfc->display, handle, handle, 0, 0, 0, 0, x, y);
 	if (rc == 0)
-		WLog_WARN(TAG, "xf_Pointer_SetPosition: XWarpPointer==%d", rc);
+		WLog_WARN(TAG, "%s: XWarpPointer==%d", __func__, rc);
 	tmp.event_mask = current.your_event_mask;
 	rc = XChangeWindowAttributes(xfc->display, handle, CWEventMask, &tmp);
 	if (rc == 0)
-		WLog_WARN(TAG, "xf_Pointer_SetPosition: 2.try XChangeWindowAttributes==%d", rc);
+		WLog_WARN(TAG, "%s: 2.try XChangeWindowAttributes==%d", __func__, rc);
 	ret = TRUE;
 out:
 	xf_unlock_x11(xfc);
@@ -729,6 +770,8 @@ UINT32 xf_get_local_color_format(xfContext* xfc, BOOL aligned)
 
 	if (xfc->depth == 32)
 		DstFormat = (!invert) ? PIXEL_FORMAT_RGBA32 : PIXEL_FORMAT_BGRA32;
+	else if (xfc->depth == 30)
+		DstFormat = (!invert) ? PIXEL_FORMAT_RGBX32_DEPTH30 : PIXEL_FORMAT_BGRX32_DEPTH30;
 	else if (xfc->depth == 24)
 	{
 		if (aligned)

client/X11/xf_graphics.h

@@ -29,4 +29,6 @@ BOOL xf_register_graphics(rdpGraphics* graphics);
 BOOL xf_decode_color(xfContext* xfc, const UINT32 srcColor, XColor* color);
 UINT32 xf_get_local_color_format(xfContext* xfc, BOOL aligned);
 
+BOOL xf_pointer_update_scale(xfContext* xfc);
+
 #endif /* FREERDP_CLIENT_X11_GRAPHICS_H */

client/X11/xf_keyboard.c

@@ -400,18 +400,19 @@ static int xf_keyboard_execute_action_script(xfContext* xfc, XF_MODIFIER_KEYS* m
 	}
 
 	if (mod->Shift)
-		strcat(combination, "Shift+");
+		winpr_str_append("Shift", combination, sizeof(combination), "+");
 
 	if (mod->Ctrl)
-		strcat(combination, "Ctrl+");
+		winpr_str_append("Ctrl", combination, sizeof(combination), "+");
 
 	if (mod->Alt)
-		strcat(combination, "Alt+");
+		winpr_str_append("Alt", combination, sizeof(combination), "+");
 
 	if (mod->Super)
-		strcat(combination, "Super+");
+		winpr_str_append("Super", combination, sizeof(combination), "+");
+
+	winpr_str_append(keyStr, combination, sizeof(combination), NULL);
 
-	strcat(combination, keyStr);
 	count = ArrayList_Count(xfc->keyCombinations);
 
 	for (index = 0; index < count; index++)

client/X11/xf_rail.c

@@ -136,10 +136,10 @@ void xf_rail_adjust_position(xfContext* xfc, xfAppWindow* appWindow)
 		 * Calculate new size/position for the rail window(new values for
 		 * windowOffsetX/windowOffsetY/windowWidth/windowHeight) on the server
 		 */
-		windowMove.left = appWindow->x;
-		windowMove.top = appWindow->y;
-		windowMove.right = windowMove.left + appWindow->width;
-		windowMove.bottom = windowMove.top + appWindow->height;
+		windowMove.left = appWindow->x - appWindow->resizeMarginLeft;
+		windowMove.top = appWindow->y - appWindow->resizeMarginTop;
+		windowMove.right = appWindow->x + appWindow->width + appWindow->resizeMarginRight;
+		windowMove.bottom = appWindow->y + appWindow->height + appWindow->resizeMarginBottom;
 		xfc->rail->ClientWindowMove(xfc->rail, &windowMove);
 	}
 }
@@ -163,12 +163,12 @@ void xf_rail_end_local_move(xfContext* xfc, xfAppWindow* appWindow)
 	 * windowOffsetX/windowOffsetY/windowWidth/windowHeight) on the server
 	 *
 	 */
-	windowMove.left = appWindow->x;
-	windowMove.top = appWindow->y;
+	windowMove.left = appWindow->x - appWindow->resizeMarginLeft;
+	windowMove.top = appWindow->y - appWindow->resizeMarginTop;
 	windowMove.right =
-	    windowMove.left +
-	    appWindow->width; /* In the update to RDP the position is one past the window */
-	windowMove.bottom = windowMove.top + appWindow->height;
+	    appWindow->x +
+	    appWindow->width + appWindow->resizeMarginRight; /* In the update to RDP the position is one past the window */
+	windowMove.bottom = appWindow->y + appWindow->height + appWindow->resizeMarginBottom;
 	xfc->rail->ClientWindowMove(xfc->rail, &windowMove);
 	/*
 	 * Simulate button up at new position to end the local move (per RDP spec)
@@ -344,6 +344,18 @@ static BOOL xf_rail_window_common(rdpContext* context, const WINDOW_ORDER_INFO*
 		appWindow->windowWidth = windowState->windowWidth;
 		appWindow->windowHeight = windowState->windowHeight;
 	}
+	
+	if (fieldFlags & WINDOW_ORDER_FIELD_RESIZE_MARGIN_X)
+	{
+		appWindow->resizeMarginLeft = windowState->resizeMarginLeft;
+		appWindow->resizeMarginRight = windowState->resizeMarginRight;
+	}
+	
+	if (fieldFlags & WINDOW_ORDER_FIELD_RESIZE_MARGIN_Y)
+	{
+		appWindow->resizeMarginTop = windowState->resizeMarginTop;
+		appWindow->resizeMarginBottom = windowState->resizeMarginBottom;
+	}
 
 	if (fieldFlags & WINDOW_ORDER_FIELD_OWNER)
 	{
@@ -532,7 +544,7 @@ static xfRailIconCache* RailIconCache_New(rdpSettings* settings)
 
 	cache->numCaches = settings->RemoteAppNumIconCaches;
 	cache->numCacheEntries = settings->RemoteAppNumIconCacheEntries;
-	cache->entries = calloc(cache->numCaches * cache->numCacheEntries * 1ULL, sizeof(xfRailIcon));
+	cache->entries = calloc(1ull * cache->numCaches * cache->numCacheEntries, sizeof(xfRailIcon));
 
 	if (!cache->entries)
 	{
@@ -602,7 +614,7 @@ static BOOL convert_rail_icon(const ICON_INFO* iconInfo, xfRailIcon* railIcon)
 	long* pixels;
 	int i;
 	int nelements;
-	argbPixels = calloc(iconInfo->width * iconInfo->height * 1ULL, 4);
+	argbPixels = calloc(1ull * iconInfo->width * iconInfo->height, 4);
 
 	if (!argbPixels)
 		goto error;

client/X11/xf_window.c

@@ -36,6 +36,7 @@
 #include <sys/stat.h>
 #include <fcntl.h>
 
+#include <winpr/assert.h>
 #include <winpr/thread.h>
 #include <winpr/crt.h>
 #include <winpr/string.h>
@@ -775,6 +776,9 @@ int xf_AppWindowCreate(xfContext* xfc, xfAppWindow* appWindow)
 	appWindow->is_mapped = FALSE;
 	appWindow->is_transient = FALSE;
 	appWindow->rail_state = 0;
+	appWindow->maxVert = FALSE;
+	appWindow->maxHorz = FALSE;
+	appWindow->minimized = FALSE;
 	appWindow->rail_ignore_configure = FALSE;
 	appWindow->handle = XCreateWindow(xfc->display, RootWindowOfScreen(xfc->screen), appWindow->x,
 	                                  appWindow->y, appWindow->width, appWindow->height, 0,
@@ -930,6 +934,9 @@ void xf_MoveWindow(xfContext* xfc, xfAppWindow* appWindow, int x, int y, int wid
 
 void xf_ShowWindow(xfContext* xfc, xfAppWindow* appWindow, BYTE state)
 {
+	WINPR_ASSERT(xfc);
+	WINPR_ASSERT(appWindow);
+
 	switch (state)
 	{
 		case WINDOW_HIDE:
@@ -937,11 +944,14 @@ void xf_ShowWindow(xfContext* xfc, xfAppWindow* appWindow, BYTE state)
 			break;
 
 		case WINDOW_SHOW_MINIMIZED:
+			appWindow->minimized = TRUE;
 			XIconifyWindow(xfc->display, appWindow->handle, xfc->screen_number);
 			break;
 
 		case WINDOW_SHOW_MAXIMIZED:
 			/* Set the window as maximized */
+			appWindow->maxHorz = TRUE;
+			appWindow->maxVert = TRUE;
 			xf_SendClientEvent(xfc, appWindow->handle, xfc->_NET_WM_STATE, 4, _NET_WM_STATE_ADD,
 			                   xfc->_NET_WM_STATE_MAXIMIZED_VERT, xfc->_NET_WM_STATE_MAXIMIZED_HORZ,
 			                   0);

client/X11/xf_window.h

@@ -126,6 +126,11 @@ struct xf_app_window
 
 	UINT32 localWindowOffsetCorrX;
 	UINT32 localWindowOffsetCorrY;
+	
+	UINT32 resizeMarginLeft;
+	UINT32 resizeMarginTop;
+	UINT32 resizeMarginRight;
+	UINT32 resizeMarginBottom;
 
 	GC gc;
 	int shmid;
@@ -137,6 +142,9 @@ struct xf_app_window
 	BOOL is_transient;
 	xfLocalMove local_move;
 	BYTE rail_state;
+	BOOL maxVert;
+	BOOL maxHorz;
+	BOOL minimized;
 	BOOL rail_ignore_configure;
 };
 

client/common/client.c

@@ -782,7 +782,7 @@ BOOL client_auto_reconnect_ex(freerdp* instance, BOOL (*window_events)(freerdp*
 		if (freerdp_reconnect(instance))
 			return TRUE;
 
-		switch (freerdp_get_last_error(instance))
+		switch (freerdp_get_last_error(instance->context))
 		{
 			case FREERDP_ERROR_CONNECT_CANCELLED:
 				WLog_WARN(TAG, "Autoreconnect aborted by user");

client/common/cmdline.c

@@ -24,9 +24,10 @@
 #endif
 
 #include <ctype.h>
-#include <assert.h>
 #include <errno.h>
 
+#include <winpr/assert.h>
+
 #include <winpr/crt.h>
 #include <winpr/wlog.h>
 #include <winpr/path.h>
@@ -46,6 +47,7 @@
 #include "cmdline.h"
 
 #include <freerdp/log.h>
+
 #define TAG CLIENT_TAG("common.cmdline")
 
 static BOOL freerdp_client_print_codepages(const char* arg)
@@ -209,6 +211,7 @@ static BOOL copy_value(const char* value, char** dst)
 static BOOL append_value(const char* value, char** dst)
 {
 	size_t x = 0, y;
+	size_t size;
 	char* tmp;
 	if (!dst || !value)
 		return FALSE;
@@ -216,14 +219,16 @@ static BOOL append_value(const char* value, char** dst)
 	if (*dst)
 		x = strlen(*dst);
 	y = strlen(value);
-	tmp = realloc(*dst, x + y + 2);
+
+	size = x + y + 2;
+	tmp = realloc(*dst, size);
 	if (!tmp)
 		return FALSE;
 	if (x == 0)
 		tmp[0] = '\0';
 	else
-		strcat(tmp, ",");
-	strcat(tmp, value);
+		winpr_str_append(",", tmp, size, NULL);
+	winpr_str_append(value, tmp, size, NULL);
 	*dst = tmp;
 	return TRUE;
 }
@@ -1567,6 +1572,28 @@ static BOOL parseSizeValue(const char* input, unsigned long* v1, unsigned long*
 	return TRUE;
 }
 
+static BOOL prepare_default_settings(rdpSettings* settings, const COMMAND_LINE_ARGUMENT_A* args,
+                                     BOOL rdp_file)
+{
+	size_t x;
+	const char* arguments[] = { "network", "gfx", "rfx", "bpp" };
+	WINPR_ASSERT(settings);
+	WINPR_ASSERT(args);
+
+	if (rdp_file)
+		return FALSE;
+
+	for (x = 0; x < ARRAYSIZE(arguments); x++)
+	{
+		const char* arg = arguments[x];
+		COMMAND_LINE_ARGUMENT_A* p = CommandLineFindArgumentA(args, arg);
+		if (p && (p->Flags & COMMAND_LINE_ARGUMENT_PRESENT))
+			return FALSE;
+	}
+
+	return freerdp_set_connection_type(settings, CONNECTION_TYPE_AUTODETECT);
+}
+
 int freerdp_client_settings_parse_command_line_arguments(rdpSettings* settings, int argc,
                                                          char** argv, BOOL allowUnknown)
 {
@@ -1637,6 +1664,8 @@ int freerdp_client_settings_parse_command_line_arguments(rdpSettings* settings,
 
 		if (status < 0)
 			return status;
+
+		prepare_default_settings(settings, largs, ext);
 	}
 
 	CommandLineFindArgumentA(largs, "v");
@@ -2265,8 +2294,10 @@ int freerdp_client_settings_parse_command_line_arguments(rdpSettings* settings,
 		{
 			if (_stricmp(arg->Value, "rpc") == 0)
 			{
-				settings->GatewayRpcTransport = TRUE;
-				settings->GatewayHttpTransport = FALSE;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_GatewayRpcTransport, TRUE) ||
+				    !freerdp_settings_set_bool(settings, FreeRDP_GatewayHttpTransport, FALSE) ||
+				    !freerdp_settings_set_bool(settings, FreeRDP_GatewayHttpUseWebsockets, FALSE))
+					return COMMAND_LINE_ERROR_UNEXPECTED_VALUE;
 			}
 			else
 			{
@@ -2275,21 +2306,24 @@ int freerdp_client_settings_parse_command_line_arguments(rdpSettings* settings,
 				{
 					*c++ = '\0';
 					if (_stricmp(c, "no-websockets") != 0)
-					{
 						return COMMAND_LINE_ERROR_UNEXPECTED_VALUE;
-					}
-					freerdp_settings_set_bool(settings, FreeRDP_GatewayHttpUseWebsockets, FALSE);
+
+					if (!freerdp_settings_set_bool(settings, FreeRDP_GatewayHttpUseWebsockets,
+					                               FALSE))
+						return COMMAND_LINE_ERROR_UNEXPECTED_VALUE;
 				}
 
 				if (_stricmp(arg->Value, "http") == 0)
 				{
-					settings->GatewayRpcTransport = FALSE;
-					settings->GatewayHttpTransport = TRUE;
+					if (!freerdp_settings_set_bool(settings, FreeRDP_GatewayRpcTransport, FALSE) ||
+					    !freerdp_settings_set_bool(settings, FreeRDP_GatewayHttpTransport, TRUE))
+						return COMMAND_LINE_ERROR_UNEXPECTED_VALUE;
 				}
 				else if (_stricmp(arg->Value, "auto") == 0)
 				{
-					settings->GatewayRpcTransport = TRUE;
-					settings->GatewayHttpTransport = TRUE;
+					if (!freerdp_settings_set_bool(settings, FreeRDP_GatewayRpcTransport, TRUE) ||
+					    !freerdp_settings_set_bool(settings, FreeRDP_GatewayHttpTransport, TRUE))
+						return COMMAND_LINE_ERROR_UNEXPECTED_VALUE;
 				}
 			}
 		}
@@ -2694,7 +2728,10 @@ int freerdp_client_settings_parse_command_line_arguments(rdpSettings* settings,
 			if (strcmp(arg->Value, "video") == 0)
 				settings->RemoteFxCodecMode = 0x00;
 			else if (strcmp(arg->Value, "image") == 0)
+			{
+				settings->RemoteFxImageCodec = TRUE;
 				settings->RemoteFxCodecMode = 0x02;
+			}
 		}
 		CommandLineSwitchCase(arg, "frame-ack")
 		{
@@ -2884,6 +2921,12 @@ int freerdp_client_settings_parse_command_line_arguments(rdpSettings* settings,
 
 			settings->TlsSecLevel = (UINT32)val;
 		}
+		CommandLineSwitchCase(arg, "enforce-tlsv1_2")
+		{
+			if (!(freerdp_settings_set_uint16(settings, FreeRDP_TLSMinVersion, TLS1_2_VERSION) &&
+			      freerdp_settings_set_uint16(settings, FreeRDP_TLSMaxVersion, TLS1_2_VERSION)))
+				return COMMAND_LINE_ERROR_UNEXPECTED_VALUE;
+		}
 		CommandLineSwitchCase(arg, "cert")
 		{
 			int rc = 0;
@@ -2956,6 +2999,10 @@ int freerdp_client_settings_parse_command_line_arguments(rdpSettings* settings,
 		{
 			settings->GrabKeyboard = enable;
 		}
+		CommandLineSwitchCase(arg, "grab-mouse")
+		{
+			settings->GrabMouse = enable;
+		}
 		CommandLineSwitchCase(arg, "unmap-buttons")
 		{
 			settings->UnmapButtons = enable;

client/common/cmdline.h

@@ -184,6 +184,7 @@ static const COMMAND_LINE_ARGUMENT_A args[] = {
 	{ "gp", COMMAND_LINE_VALUE_REQUIRED, "<password>", NULL, NULL, -1, NULL, "Gateway password" },
 	{ "grab-keyboard", COMMAND_LINE_VALUE_BOOL, NULL, BoolValueTrue, NULL, -1, NULL,
 	  "Grab keyboard" },
+	{ "grab-mouse", COMMAND_LINE_VALUE_BOOL, NULL, BoolValueTrue, NULL, -1, NULL, "Grab mouse" },
 	{ "gt", COMMAND_LINE_VALUE_REQUIRED, "[rpc|http[,no-websockets]|auto[,no-websockets]]", NULL,
 	  NULL, -1, NULL, "Gateway transport type" },
 	{ "gu", COMMAND_LINE_VALUE_REQUIRED, "[[<domain>\\]<user>|<user>[@<domain>]]", NULL, NULL, -1,
@@ -353,6 +354,9 @@ static const COMMAND_LINE_ARGUMENT_A args[] = {
 	  "Allowed TLS ciphers" },
 	{ "tls-seclevel", COMMAND_LINE_VALUE_REQUIRED, "<level>", "1", NULL, -1, NULL,
 	  "TLS security level - defaults to 1" },
+	{ "enforce-tlsv1_2", COMMAND_LINE_VALUE_BOOL, NULL, BoolValueFalse, NULL, -1, NULL,
+	  "Force use of TLS1.2 for connection. Some servers have a buggy TLS version negotiation and "
+	  "might fail without this" },
 	{ "toggle-fullscreen", COMMAND_LINE_VALUE_BOOL, NULL, BoolValueTrue, NULL, -1, NULL,
 	  "Alt+Ctrl+Enter to toggle fullscreen" },
 	{ "tune", COMMAND_LINE_VALUE_REQUIRED, "<setting:value>,<setting:value>", "", NULL, -1, NULL,

cmake/ClangDetectTool.cmake

@@ -0,0 +1,48 @@
+function (clang_detect_tool VAR NAME OPTS)
+	set(NAMES "")
+	foreach(CNT RANGE 12 22)
+		list(APPEND NAMES "${NAME}-${CNT}")
+	endforeach()
+	list(REVERSE NAMES)
+	list(APPEND NAMES ${NAME})
+
+	find_program(${VAR}
+		NAMES ${NAMES}
+		${OPTS}
+	)
+	if (NOT ${VAR})
+		message(WARNING "clang tool ${NAME} (${VAR}) not detected, skipping")
+		unset(${VAR})
+		return()
+	endif()
+
+	execute_process(
+		COMMAND ${${VAR}} "--version"
+		OUTPUT_VARIABLE _CLANG_TOOL_VERSION
+		RESULT_VARIABLE _CLANG_TOOL_VERSION_FAILED
+	)
+
+	if (_CLANG_TOOL_VERSION_FAILED)
+		message(WARNING "A problem was encounterd with ${${VAR}}")
+		message(WARNING "${_CLANG_TOOL_VERSION_FAILED}")
+		unset(${VAR})
+		return()
+	endif()
+
+	string(REGEX MATCH "([7-9]|[1-9][0-9])\\.[0-9]\\.[0-9]" CLANG_TOOL_VERSION
+		"${_CLANG_TOOL_VERSION}")
+
+	if (NOT CLANG_TOOL_VERSION)
+		message(WARNING "problem parsing ${NAME} version for ${${VAR}}")
+		unset(${VAR})
+		return()
+	endif()
+
+	set(_CLANG_TOOL_MINIMUM_VERSION "12.0.0")
+	if (${CLANG_TOOL_VERSION} VERSION_LESS ${_CLANG_TOOL_MINIMUM_VERSION})
+		message(WARNING "clang-format version ${CLANG_TOOL_VERSION} not supported")
+		message(WARNING "Minimum version required: ${_CLANG_TOOL_MINIMUM_VERSION}")
+		unset(${VAR})
+		return()
+	endif()
+endfunction()

cmake/ClangFormat.cmake

@@ -1,43 +1,12 @@
 # get all project files
 file(GLOB_RECURSE ALL_SOURCE_FILES *.cpp *.c *.h *.m *.java)
-# minimum version required
-set(_CLANG_FORMAT_MINIMUM_VERSION 7.0.0)
 
-find_program(CLANG_FORMAT
-	NAMES
-	clang-format-8
-	clang-format-7
-	clang-format
-	)
+include(ClangDetectTool)
+clang_detect_tool(CLANG_FORMAT clang-format "")
 
 if (NOT CLANG_FORMAT)
 	message(WARNING "clang-format not found in path! code format target not available.")
 else()
-	execute_process(
-		COMMAND ${CLANG_FORMAT} "--version"
-		OUTPUT_VARIABLE _CLANG_FORMAT_VERSION
-		RESULT_VARIABLE _CLANG_FORMAT_VERSION_FAILED
-		)
-
-	if (_CLANG_FORMAT_VERSION_FAILED)
-		message(WARNING "A problem was encounterd with ${CLANG_FORMAT}")
-		return()
-	endif()
-
-	string(REGEX MATCH "([7-9]|[1-9][0-9])\\.[0-9]\\.[0-9]" CLANG_FORMAT_VERSION
-		"${_CLANG_FORMAT_VERSION}")
-
-	if (NOT CLANG_FORMAT_VERSION)
-		message(WARNING "problem parsing clang-fromat version for ${CLANG_FORMAT}")
-		return()
-	endif()
-
-	if (${CLANG_FORMAT_VERSION} VERSION_LESS ${_CLANG_FORMAT_MINIMUM_VERSION})
-		message(WARNING "clang-format version ${CLANG_FORMAT_VERSION} not supported")
-		message(WARNING "Minimum version required: ${_CLANG_FORMAT_MINIMUM_VERSION}")
-		return()
-	endif()
-
 	add_custom_target(
 			clangformat
 			COMMAND ${CLANG_FORMAT}

cmake/ConfigOptions.cmake

@@ -47,12 +47,12 @@ if(NOT WIN32)
 	CMAKE_DEPENDENT_OPTION(WITH_SANITIZE_ADDRESS "Compile with gcc/clang address sanitizer." OFF
 		"NOT WITH_VALGRIND_MEMCHECK; NOT WITH_SANITIZE_MEMORY; NOT WITH_SANITIZE_THREAD" OFF)
 	CMAKE_DEPENDENT_OPTION(WITH_SANITIZE_MEMORY "Compile with gcc/clang memory sanitizer." OFF
-        "NOT WITH_VALGRIND_MEMCHECK; NOT WITH_SANITIZE_ADDRESS; NOT WITH_SANITIZE_THREAD" OFF)
+		"NOT WITH_VALGRIND_MEMCHECK; NOT WITH_SANITIZE_ADDRESS; NOT WITH_SANITIZE_THREAD" OFF)
 	CMAKE_DEPENDENT_OPTION(WITH_SANITIZE_THREAD "Compile with gcc/clang thread sanitizer." OFF
 		"NOT WITH_VALGRIND_MEMCHECK; NOT WITH_SANITIZE_ADDRESS; NOT WITH_SANITIZE_MEMORY" OFF)
 else()
 	if(NOT UWP)
-		option(WITH_MEDIA_FOUNDATION "Enable H264 media foundation decoder." ON)
+		option(WITH_MEDIA_FOUNDATION "Enable H264 media foundation decoder." OFF)
 	endif()
 endif()
 
@@ -98,7 +98,7 @@ option(WITH_SERVER_INTERFACE "Build servers as a library with an interface" ON)
 option(WITH_DEBUG_ALL "Print all debug messages." OFF)
 
 if(WITH_DEBUG_ALL)
-    message(WARNING "WITH_DEBUG_ALL=ON, the build will be slow and might leak sensitive information, do not use with release builds!")
+	message(WARNING "WITH_DEBUG_ALL=ON, the build will be slow and might leak sensitive information, do not use with release builds!")
 	set(DEFAULT_DEBUG_OPTION "ON")
 else()
 	set(DEFAULT_DEBUG_OPTION "OFF")
@@ -106,7 +106,7 @@ endif()
 
 option(WITH_DEBUG_CERTIFICATE "Print certificate related debug messages." ${DEFAULT_DEBUG_OPTION})
 if(WITH_DEBUG_CERTIFICATE)
-    message(WARNING "WITH_DEBUG_CERTIFICATE=ON, the build might leak sensitive information, do not use with release builds!")
+	message(WARNING "WITH_DEBUG_CERTIFICATE=ON, the build might leak sensitive information, do not use with release builds!")
 endif()
 option(WITH_DEBUG_CAPABILITIES "Print capability negotiation debug messages." ${DEFAULT_DEBUG_OPTION})
 option(WITH_DEBUG_CHANNELS "Print channel manager debug messages." ${DEFAULT_DEBUG_OPTION})
@@ -116,23 +116,23 @@ option(WITH_DEBUG_DVC "Print dynamic virtual channel debug messages." ${DEFAULT_
 CMAKE_DEPENDENT_OPTION(WITH_DEBUG_TSMF "Print TSMF virtual channel debug messages." ${DEFAULT_DEBUG_OPTION} "CHANNEL_TSMF" OFF)
 option(WITH_DEBUG_KBD "Print keyboard related debug messages." OFF)
 if(WITH_DEBUG_KBD)
-    message(WARNING "WITH_DEBUG_KBD=ON, the build might leak sensitive information, do not use with release builds!")
+	message(WARNING "WITH_DEBUG_KBD=ON, the build might leak sensitive information, do not use with release builds!")
 endif()
 option(WITH_DEBUG_LICENSE "Print license debug messages." OFF)
 if(WITH_DEBUG_LICENSE)
-    message(WARNING "WITH_DEBUG_LICENSE=ON, the build might leak sensitive information, do not use with release builds!")
+	message(WARNING "WITH_DEBUG_LICENSE=ON, the build might leak sensitive information, do not use with release builds!")
 endif()
 option(WITH_DEBUG_NEGO "Print negotiation related debug messages." OFF)
 if(WITH_DEBUG_NEGO)
-    message(WARNING "WITH_DEBUG_NEGO=ON, the build might leak sensitive information, do not use with release builds!")
+	message(WARNING "WITH_DEBUG_NEGO=ON, the build might leak sensitive information, do not use with release builds!")
 endif()
 option(WITH_DEBUG_NLA "Print authentication related debug messages." OFF)
 if(WITH_DEBUG_NLA)
-    message(WARNING "WITH_DEBUG_NLA=ON, the build might leak sensitive information, do not use with release builds!")
+	message(WARNING "WITH_DEBUG_NLA=ON, the build might leak sensitive information, do not use with release builds!")
 endif()
 option(WITH_DEBUG_NTLM "Print NTLM debug messages" OFF)
 if(WITH_DEBUG_NTLM)
-    message(WARNING "WITH_DEBUG_NTLM=ON, the build might leak sensitive information, do not use with release builds!")
+	message(WARNING "WITH_DEBUG_NTLM=ON, the build might leak sensitive information, do not use with release builds!")
 endif()
 option(WITH_DEBUG_TSG "Print Terminal Server Gateway debug messages" ${DEFAULT_DEBUG_OPTION})
 option(WITH_DEBUG_RAIL "Print RemoteApp debug messages" ${DEFAULT_DEBUG_OPTION})
@@ -163,13 +163,13 @@ option(WITH_GSSAPI "Compile support for kerberos authentication. (EXPERIMENTAL)"
 
 option(WITH_DSP_EXPERIMENTAL "Enable experimental sound encoder/decoder formats" OFF)
 if (WITH_FFMPEG)
-    option(WITH_DSP_FFMPEG "Use FFMPEG for audio encoding/decoding" OFF)
-    option(WITH_VAAPI "Use FFMPEG VAAPI (EXPERIMENTAL)" OFF)
+	option(WITH_DSP_FFMPEG "Use FFMPEG for audio encoding/decoding" OFF)
+	option(WITH_VAAPI "Use FFMPEG VAAPI (EXPERIMENTAL)" OFF)
 endif(WITH_FFMPEG)
 
 option(USE_VERSION_FROM_GIT_TAG "Extract FreeRDP version from git tag." OFF)
 
-option(WITH_CAIRO    "Use CAIRO image library for screen resizing" OFF)
+option(WITH_CAIRO	"Use CAIRO image library for screen resizing" OFF)
 option(WITH_SWSCALE  "Use SWScale image library for screen resizing" OFF)
 
 option(DEFINE_NO_DEPRECATED "Compile without legacy functions and symbols" OFF)

cmake/FindFFmpeg.cmake

@@ -27,12 +27,20 @@ find_library(AVUTIL_LIBRARY avutil PATHS ${AVUTIL_LIBRARY_DIRS})
 
 # swresample
 find_path(SWRESAMPLE_INCLUDE_DIR libswresample/swresample.h PATHS ${SWRESAMPLE_INCLUDE_DIRS})
-find_library(SWRESAMPLE_LIBRARY swresample PATHS ${SWRESAMPLE_LIBRARY_DIRS})
+find_library(SWRESAMPLE_LIBRARY NAMES swresample swresample-3 PATHS ${SWRESAMPLE_LIBRARY_DIRS})
+
+if (SWRESAMPLE_INCLUDE_DIR AND SWRESAMPLE_LIBRARY)
+	set(SWRESAMPLE_FOUND ON)
+endif()
 
 # avresample
 find_path(AVRESAMPLE_INCLUDE_DIR libavresample/avresample.h PATHS ${AVRESAMPLE_INCLUDE_DIRS})
 find_library(AVRESAMPLE_LIBRARY avresample PATHS ${AVRESAMPLE_LIBRARY_DIRS})
 
+if (AVRESAMPLE_INCLUDE_DIR AND AVRESAMPLE_LIBRARY)
+	set(AVRESAMPLE_FOUND ON)
+endif()
+
 if (AVCODEC_INCLUDE_DIR AND AVCODEC_LIBRARY)
 	set(AVCODEC_FOUND TRUE)
 endif(AVCODEC_INCLUDE_DIR AND AVCODEC_LIBRARY)

cmake/FindOpenSSL.cmake

@@ -55,7 +55,7 @@ FIND_PATH(OPENSSL_INCLUDE_DIR
   NAMES
     openssl/ssl.h
   PATH_SUFFIXES
-	"include"
+    "include"
   HINTS
     ${_OPENSSL_INCLUDEDIR}
   ${_OPENSSL_ROOT_HINTS_AND_PATHS}
@@ -172,8 +172,8 @@ ELSEIF(WIN32 AND NOT CYGWIN)
     )
 
     set( OPENSSL_DEBUG_LIBRARIES ${SSL_EAY_DEBUG} ${LIB_EAY_DEBUG} )
-	set( OPENSSL_RELEASE_LIBRARIES ${SSL_EAY_RELEASE} ${LIB_EAY_RELEASE} )
-	set( OPENSSL_LIBRARIES ${OPENSSL_RELEASE_LIBRARIES} )
+    set( OPENSSL_RELEASE_LIBRARIES ${SSL_EAY_RELEASE} ${LIB_EAY_RELEASE} )
+    set( OPENSSL_LIBRARIES ${OPENSSL_RELEASE_LIBRARIES} )
 
     MARK_AS_ADVANCED(SSL_EAY_DEBUG SSL_EAY_RELEASE)
     MARK_AS_ADVANCED(LIB_EAY_DEBUG LIB_EAY_RELEASE)
@@ -313,25 +313,50 @@ if (OPENSSL_INCLUDE_DIR)
 
     string(REGEX REPLACE "^.*OPENSSL_VERSION_NUMBER[\t ]+0x([0-9a-fA-F])([0-9a-fA-F][0-9a-fA-F])([0-9a-fA-F][0-9a-fA-F])([0-9a-fA-F][0-9a-fA-F])([0-9a-fA-F]).*$"
            "\\1;\\2;\\3;\\4;\\5" OPENSSL_VERSION_LIST "${openssl_version_str}")
-    list(GET OPENSSL_VERSION_LIST 0 OPENSSL_VERSION_MAJOR)
-    list(GET OPENSSL_VERSION_LIST 1 OPENSSL_VERSION_MINOR)
-    from_hex("${OPENSSL_VERSION_MINOR}" OPENSSL_VERSION_MINOR)
-    list(GET OPENSSL_VERSION_LIST 2 OPENSSL_VERSION_FIX)
-    from_hex("${OPENSSL_VERSION_FIX}" OPENSSL_VERSION_FIX)
-    list(GET OPENSSL_VERSION_LIST 3 OPENSSL_VERSION_PATCH)
+     if (OPENSSL_VERSION_LIST)
+        list(GET OPENSSL_VERSION_LIST 0 OPENSSL_VERSION_MAJOR)
+        list(GET OPENSSL_VERSION_LIST 1 OPENSSL_VERSION_MINOR)
+        from_hex("${OPENSSL_VERSION_MINOR}" OPENSSL_VERSION_MINOR)
+        list(GET OPENSSL_VERSION_LIST 2 OPENSSL_VERSION_FIX)
+        from_hex("${OPENSSL_VERSION_FIX}" OPENSSL_VERSION_FIX)
+        list(GET OPENSSL_VERSION_LIST 3 OPENSSL_VERSION_PATCH)
 
-    if (NOT OPENSSL_VERSION_PATCH STREQUAL "00")
-      from_hex("${OPENSSL_VERSION_PATCH}" _tmp)
-      # 96 is the ASCII code of 'a' minus 1
-      math(EXPR OPENSSL_VERSION_PATCH_ASCII "${_tmp} + 96")
-      unset(_tmp)
-      # Once anyone knows how OpenSSL would call the patch versions beyond 'z'
-      # this should be updated to handle that, too. This has not happened yet
-      # so it is simply ignored here for now.
-      string(ASCII "${OPENSSL_VERSION_PATCH_ASCII}" OPENSSL_VERSION_PATCH_STRING)
-    endif (NOT OPENSSL_VERSION_PATCH STREQUAL "00")
+        if (NOT OPENSSL_VERSION_PATCH STREQUAL "00")
+          from_hex("${OPENSSL_VERSION_PATCH}" _tmp)
+          # 96 is the ASCII code of 'a' minus 1
+          math(EXPR OPENSSL_VERSION_PATCH_ASCII "${_tmp} + 96")
+          unset(_tmp)
+          # Once anyone knows how OpenSSL would call the patch versions beyond 'z'
+          # this should be updated to handle that, too. This has not happened yet
+          # so it is simply ignored here for now.
+          string(ASCII "${OPENSSL_VERSION_PATCH_ASCII}" OPENSSL_VERSION_PATCH_STRING)
+        endif (NOT OPENSSL_VERSION_PATCH STREQUAL "00")
 
-    set(OPENSSL_VERSION "${OPENSSL_VERSION_MAJOR}.${OPENSSL_VERSION_MINOR}.${OPENSSL_VERSION_FIX}${OPENSSL_VERSION_PATCH_STRING}")
+        set(OPENSSL_VERSION "${OPENSSL_VERSION_MAJOR}.${OPENSSL_VERSION_MINOR}.${OPENSSL_VERSION_FIX}${OPENSSL_VERSION_PATCH_STRING}")
+    endif()
+
+    if (NOT OPENSSL_VERSION_LIST)
+      file(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h" openssl_version_str_str
+        REGEX "^#[\t ]*define[\t ]+OPENSSL_VERSION_STR[\t ]\"([0-9a-fA-F]+)\\.([0-9a-fA-F]+)\\.([0-9a-fA-F]+).*\".*$")
+      string(REGEX REPLACE "^.*OPENSSL_VERSION_STR[\t ]+\"([0-9a-fA-F]+)\\.([0-9a-fA-F]+)\\.([0-9a-fA-F]+).*\".*$"
+        "\\1.\\2.\\3" OPENSSL_VERSION "${openssl_version_str_str}")
+    endif()
+
+    if (NOT OPENSSL_VERSION_LIST)
+      file(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h" openssl_version_major_str
+        REGEX "^#[\t ]*define[\t ]+OPENSSL_VERSION_MAJOR[\t ]+([0-9a-fA-F]+).*$")
+      string(REGEX REPLACE "^#[\t ]*define[\t ]+OPENSSL_VERSION_MAJOR[\t ]+([0-9a-fA-F]+).*$"
+          "\\1" OPENSSL_VERSION_MAJOR "${openssl_version_major_str}")
+      file(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h" openssl_version_minor_str
+        REGEX "^#[\t ]*define[\t ]+OPENSSL_VERSION_MINOR[\t ]+([0-9a-fA-F]+).*$")
+      string(REGEX REPLACE "^#[\t ]*define[\t ]+OPENSSL_VERSION_MINOR[\t ]+([0-9a-fA-F]+).*$"
+        "\\1" OPENSSL_VERSION_MINOR "${openssl_version_minor_str}")
+      file(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/opensslv.h" openssl_version_patch_str
+        REGEX "^#[\t ]*define[\t ]+OPENSSL_VERSION_PATCH[\t ]+([0-9a-fA-F]+).*$")
+      string(REGEX REPLACE "^#[\t ]*define[\t ]+OPENSSL_VERSION_PATCH[\t ]+([0-9a-fA-F]+).*$"
+          "\\1" OPENSSL_VERSION_PATCH "${openssl_version_patch_str}")
+      set(OPENSSL_VERSION "${OPENSSL_VERSION_MAJOR}.${OPENSSL_VERSION_MINOR}.${OPENSSL_VERSION_PATCH}")
+    endif()
   endif (_OPENSSL_VERSION)
 endif (OPENSSL_INCLUDE_DIR)
 

config.h.in

@@ -111,6 +111,9 @@
 #cmakedefine CHANNEL_RDPDR
 #cmakedefine CHANNEL_RDPDR_CLIENT
 #cmakedefine CHANNEL_RDPDR_SERVER
+#cmakedefine CHANNEL_RDPECAM
+#cmakedefine CHANNEL_RDPECAM_CLIENT
+#cmakedefine CHANNEL_RDPECAM_SERVER
 #cmakedefine CHANNEL_RDPEI
 #cmakedefine CHANNEL_RDPEI_CLIENT
 #cmakedefine CHANNEL_RDPEI_SERVER
@@ -132,6 +135,9 @@
 #cmakedefine CHANNEL_SSHAGENT
 #cmakedefine CHANNEL_SSHAGENT_CLIENT
 #cmakedefine CHANNEL_SSHAGENT_SERVER
+#cmakedefine CHANNEL_TELEMETRY
+#cmakedefine CHANNEL_TELEMETRY_CLIENT
+#cmakedefine CHANNEL_TELEMETRY_SERVER
 #cmakedefine CHANNEL_TSMF
 #cmakedefine CHANNEL_TSMF_CLIENT
 #cmakedefine CHANNEL_TSMF_SERVER
@@ -177,4 +183,10 @@
 /* Proxy */
 #cmakedefine WITH_PROXY_MODULES
 
+#cmakedefine WITH_INTERNAL_MD4
+#cmakedefine WITH_INTERNAL_MD5
+
+/* Uwac */
+#cmakedefine HAVE_PIXMAN_REGION
+
 #endif /* FREERDP_CONFIG_H */

debian/.gitignore

@@ -1,33 +0,0 @@
-*.log
-freerdp2-x11/
-freerdp2-x11-dbg/
-libfreerdp-client2/
-libfreerdp-server2/
-libfreerdp2-dev/
-libfreerdp2/
-libwinpr2-dev/
-libwinpr2/
-tmp/
-*.substvars
-.debhelper/
-files
-freerdp2-shadow-x11-dbg/
-freerdp2-shadow-x11/
-freerdp2-dev/
-libfreerdp-client2-dbg/
-libfreerdp-server2-dbg/
-libfreerdp2-dbg/
-libwinpr2-dbg/
-winpr-utils-dbg/
-winpr-utils/
-freerdp2-wayland-dbg/
-freerdp2-wayland/
-libfreerdp-shadow2-dbg/
-libfreerdp-shadow2/
-libuwac0-dbg/
-libuwac0-dev/
-libuwac0/
-debhelper-build-stamp
-libxfreerdp-client2
-libxfreerdp-client2-dbg
-libwinpr-tools2

debian/changelog

@@ -1,3 +1,232 @@
+freerdp2 (2.11.7+dfsg1-6) unstable; urgency=medium
+
+  * Team upload
+  * d/tests/connect: use /cert-tofu to avoid errors with proxies
+
+ -- Adrien Nader <adrien.nader@canonical.com>  Wed, 18 Dec 2024 13:02:02 +0100
+
+freerdp2 (2.11.7+dfsg1-5) unstable; urgency=medium
+
+  * autopkgtest: add Depends: ca-certificates
+
+ -- Jeremy Bícha <jbicha@ubuntu.com>  Mon, 16 Dec 2024 22:57:23 -0500
+
+freerdp2 (2.11.7+dfsg1-4) unstable; urgency=medium
+
+  * Replace autopkgtests with the tests used by freerdp3 (Closes: #1079025)
+
+ -- Jeremy Bícha <jbicha@ubuntu.com>  Fri, 04 Oct 2024 16:21:36 -0400
+
+freerdp2 (2.11.7+dfsg1-3) unstable; urgency=high
+
+  * Team upload
+
+  [ Jeremy Bícha ]
+  * SECURITY UPDATE: NULL access and crash (Closes: #1072112
+    - debian/patches/CVE-2024-32661.patch: fix missing check in
+      rdp_write_logon_info_v1 in libfreerdp/core/info.c.
+    - CVE-2024-32661
+  * Cherry-pick several patches to fix build with gcc-14
+    (Closes: #1074969) (LP: #2075965)
+  * Remove obsolete 32-bit time transition lintian overrides
+
+  [ Sébastien Noel ]
+  * Add patch to fix build with ffmpeg 7 (Closes: #1072413)
+
+  [ Bernhard Übelacker ]
+  * Apply multiple fixes to autopkgtests (Closes: #1079025)
+
+ -- Jeremy Bícha <jbicha@ubuntu.com>  Thu, 03 Oct 2024 11:10:42 -0400
+
+freerdp2 (2.11.7+dfsg1-2) unstable; urgency=medium
+
+  * debian/tests/control:
+    + Add xauth. Fix tests on Debian, where xvfb does not pull-in xauth as
+      dependency (other than in Ubuntu).
+
+ -- Mike Gabriel <sunweaver@debian.org>  Sat, 20 Jul 2024 15:37:09 +0200
+
+freerdp2 (2.11.7+dfsg1-1) unstable; urgency=medium
+
+  [ Mike Gabriel ]
+  * New upstream release. (Closes: #1069728).
+    + CVE-2024-32041 [Low[ OutOfBound Read in zgfx_decompress_segment.
+    + CVE-2024-32039 [Moderate] Integer overflow & OutOfBound Write in
+      clear_decompress_residual_data.
+    + CVE-2024-32040 [Low] integer underflow in nsc_rle_decode.
+    + CVE-2024-32458 [Low] OutOfBound Read in planar_skip_plane_rle.
+    + CVE-2024-32459 [Low] OutOfBound Read in ncrush_decompress.
+    + CVE-2024-32460 [Low] OutOfBound Read in interleaved_decompress.
+
+  [ Nathan Pratta Teodosio ]
+  * Add autopkgtest to test whether a client can connect
+    to an XRDP server via freerdp2 and that the login screen shows up
+    (Closes: #1073156) (LP: #2060976)
+
+ -- Mike Gabriel <sunweaver@debian.org>  Mon, 15 Jul 2024 16:46:25 +0200
+
+freerdp2 (2.11.5+dfsg1-1) unstable; urgency=medium
+
+  * New upstream release.
+    - CVE-2024-22211: Fix integer overflow in progressive decoder. (Closes:
+      #1061173).
+  * Upload time_t64 changes to unstable. (Closes: #1061952).
+  * debian/watch:
+    + Adjust so we only see 2.x release.
+  * debian/control:
+    + Switch from pkg-config to pkgconf. Thanks, lintian.
+
+ -- Mike Gabriel <sunweaver@debian.org>  Mon, 25 Mar 2024 16:09:04 +0100
+
+freerdp2 (2.11.2+dfsg1-1.1~exp2) experimental; urgency=medium
+
+  * Non-maintainer upload.
+  * Rename libraries for 64-bit time_t transition.
+  * Account for additional t64 Breaks/Replaces (Closes #1061982).
+
+ -- Lukas Märdian <slyon@debian.org>  Tue, 30 Jan 2024 13:19:02 +0000
+
+freerdp2 (2.11.2+dfsg1-1) unstable; urgency=medium
+
+  * New upstream release. (Closes: #1051638).
+  * Fixed security issues since v2.11.0:
+    - CVE-2023-40589: [codec,ncrush] fix index checks properly verify all
+      offsets while decoding data.
+    - CVE-2023-40567: Fix out-of-bounds write in the
+      `clear_decompress_bands_data` function.
+    - CVE-2023-40188: Fix out-of-bounds read in the `general_LumaToYUV444`
+      function.
+    - CVE-2023-40186: Fix out-of-bounds write in the `gdi_CreateSurface`
+      function.
+    - CVE-2023-40181: Fix out-of-bounds read in the `zgfx_decompress_segment`
+      function.
+    - CVE-2023-39356: Fix out-of-bounds read in the `gdi_multi_opaque_rect`
+      function.
+    - CVE-2023-39355: Fix use-after-free in processing
+      `RDPGFX_CMDID_RESETGRAPHICS` packets.
+    - CVE-2023-39354: Fix out-of-bounds read in the `nsc_rle_decompress_data`
+      function.
+    - CVE-2023-39353: Fix missing offset validation leading to out-of-bounds
+      read in the `libfreerdp/codec/rfx.c` file.
+    - CVE-2023-39352: Fix invalid offset validation leading to out-of-bounds
+      write.
+    - CVE-2023-39351: Fix null-pointer-dereference leading a crash in the
+      RemoteFX (rfx) handling.
+    - CVE-2023-39350: Fix integer underflow leading to DOS (e.g. abort due to
+      `WINPR_ASSERT` with default compilation flags).
+  * debian/patches:
+    + Drop 0001_fix_ftbfs_1041377.patch. Applied upstream.
+  * debian/control:
+    + Add B-D: libkrb5-dev.
+  * debian/rules:
+    + Add -DWITH_KERBEROS=ON configure option. (Closes: #1036095).
+  * debian/watch:
+    + Rework file. Find all released versions of freerdp2. (Closes: #1053317).
+      Thanks to Tobias Frost for sending a patch.
+
+ -- Mike Gabriel <sunweaver@debian.org>  Sun, 01 Oct 2023 23:21:15 +0200
+
+freerdp2 (2.10.0+dfsg1-1.1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * debian/patches/0001_fix_ftbfs_1041377.patch:
+    - include upstream fix for FTBFS with FFmpeg 6.0
+      (Closes: #1041377)
+
+ -- Héctor Orón Martínez <zumbi@debian.org>  Fri, 04 Aug 2023 04:08:40 -0400
+
+freerdp2 (2.10.0+dfsg1-1) unstable; urgency=medium
+
+  * New upstream release.
+    - Fix android build scripts, use CMake from SDK.
+    - Fix connection negotiation with mstsc/msrdc.
+    - [ntlm]: use rfc5929 binding hash algorithm.
+    - [channels,printer] Fixed reference counting.
+    - Fix uwac pixman.
+    - Fix Rdp security.
+    - [client,x11] Detect key autorepeat.
+    - [build] add channel path to RPATH.
+    - Fix build with BUILTIN_CHANNELS=OFF.
+    - revert changes so that the osmajortype/osminortype is not overwritten.
+    - [uwac] do not use iso C functions.
+    - [winpr,sam] fix inalid NULL arguments.
+    - Fix incompatible function pointer types.
+    - Ignore data PDUs for DVCs that were not opened successfully.
+    - [channel,urbdrc] fix type of usb hotplug callback.
+    - Extended info enforce limits.
+    - [core] add missing redirection fields.
+  * debian/control:
+    + Bump Standards-Version: to 4.6.2. No changes needed.
+  * debian/copyright:
+    + Update copyright attributions.
+    + Update auto-generated copyright.in file.
+  * debian/libfreerdp2-2.symbols:
+    + Update symbols.
+
+ -- Mike Gabriel <sunweaver@debian.org>  Sun, 26 Feb 2023 21:59:16 +0100
+
+freerdp2 (2.9.0+dfsg1-1) unstable; urgency=medium
+
+  * New upstream release. (Closes: #1024511).
+    - CVE-2022-39316: Resolve out of bound read in ZGFX decoder component.
+    - CVE-2022-39317: Resolve missing a range check for input offset index
+      in ZGFX decoder.
+    - CVE-2022-39318: Resolve missing input validation in `urbdrc` channel.
+    - CVE-2022-39319: Resolve missing input length validation in the `urbdrc`
+      channel
+    - CVE-2022-39320: Resolve attempting integer addition on too narrow types
+      leading to allocation of a buffer too small holding the data written.
+    - CVE-2022-39347: Resolve missing path canonicalization and base path check
+      for `drive` channel.
+    - CVE-2022-41877: Resolv missing input length validation in `drive` channel.
+    - Test if packages' executables can be run without 'undefined symbol:
+      winpr_PathMakePath' error. (Closes: #1024758).
+  * debian/copyright:
+    + Update auto-generated copyright.in file.
+    + Update copyright attributions.
+  * debian/*.symbols:
+    + Update .symbols files.
+
+ -- Mike Gabriel <sunweaver@debian.org>  Mon, 28 Nov 2022 09:51:57 +0100
+
+freerdp2 (2.8.1+dfsg1-1) unstable; urgency=medium
+
+  * New upstream release. (Closes: #1021659).
+    - Fixes CVE-2022-39282, CVE-2022-39283.
+  * debian/patches:
+    + Drop 1001_amend-DumpThreadHandles-inclusion.patch. Resolved upstream.
+
+ -- Mike Gabriel <sunweaver@debian.org>  Wed, 12 Oct 2022 23:26:31 +0200
+
+freerdp2 (2.8.0+dfsg1-1) unstable; urgency=medium
+
+  * New upstream version. (Closes: #1016491).
+  * debian/control:
+    + Bump Standards-Version: to 4.6.1. No changes needed.
+  * debian/copyright:
+    + Update auto-generated copyright.in file.
+    + Update copyright attributions.
+  * debian/patches:
+    + Drop 1001_keep-symbol-DumpThreadHandles-if-debugging-is-disabled.patch.
+      Similar solution applied upstream, but only partially, it seems.
+    + Add 1001_amend-DumpThreadHandles-inclusion.patch. Amend missing adjustment
+      in thread.h.
+  * debian/*.symbols:
+    + Update .symbols files for 2.8.0.
+
+ -- Mike Gabriel <sunweaver@debian.org>  Tue, 16 Aug 2022 23:19:34 +0200
+
+freerdp2 (2.7.0+dfsg1-1) unstable; urgency=medium
+
+  * New upstream release.
+  * debian/copyright:
+    + Update auto-generated copyright.in file.
+    + Update copyright attributions.
+  * debian/*.symbols:
+    + Update .symbols for 2.7.0.
+
+ -- Mike Gabriel <sunweaver@debian.org>  Wed, 27 Apr 2022 16:49:43 +0200
+
 freerdp2 (2.6.1+dfsg1-3) unstable; urgency=medium
 
   * debian/patches:

debian/control

@@ -17,6 +17,7 @@ Build-Depends:
  libgsm1-dev,
  libicu-dev,
  libjpeg-dev,
+ libkrb5-dev,
  libpam0g-dev,
  libpcsclite-dev,
  libpulse-dev,
@@ -39,11 +40,11 @@ Build-Depends:
  libxrender-dev,
  libxtst-dev,
  libxv-dev,
- pkg-config,
+ pkgconf,
  uuid-dev,
  xmlto,
  xsltproc,
-Standards-Version: 4.6.0
+Standards-Version: 4.6.2
 Rules-Requires-Root: no
 Homepage: https://www.freerdp.com/
 Vcs-Browser: https://salsa.debian.org/debian-remote-team/freerdp2
@@ -54,7 +55,7 @@ Architecture: any
 Depends:
  ${misc:Depends},
  ${shlibs:Depends},
- libfreerdp-client2-2 (= ${binary:Version}),
+ libfreerdp-client2-2t64 (= ${binary:Version}),
 Provides:
  freerdp,
 Replaces:
@@ -80,7 +81,8 @@ Description: RDP client for Windows Terminal Services (X11 client)
  .
  This package contains the X11 based client.
 
-Package: libfreerdp2-2
+Package: libfreerdp2-2t64
+Provides: ${t64:Provides}
 Architecture: any
 Section: libs
 Pre-Depends:
@@ -88,10 +90,12 @@ Pre-Depends:
 Depends:
  ${misc:Depends},
  ${shlibs:Depends},
- libwinpr2-2 (= ${binary:Version}),
+ libwinpr2-2t64 (= ${binary:Version}),
 Breaks:
+ libfreerdp2-2 (<< ${source:Version}),
  libfreerdp2 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Replaces:
+ libfreerdp2-2,
  libfreerdp2 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Multi-Arch: same
 Suggests:
@@ -102,7 +106,8 @@ Description: Free Remote Desktop Protocol library (core library)
  .
  This package contains the shared library with all core functionality.
 
-Package: libfreerdp-client2-2
+Package: libfreerdp-client2-2t64
+Provides: ${t64:Provides}
 Architecture: any
 Section: libs
 Pre-Depends:
@@ -110,10 +115,12 @@ Pre-Depends:
 Depends:
  ${misc:Depends},
  ${shlibs:Depends},
- libfreerdp2-2 (= ${binary:Version}),
+ libfreerdp2-2t64 (= ${binary:Version}),
 Breaks:
+ libfreerdp-client2-2 (<< ${source:Version}),
  libfreerdp-client2 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Replaces:
+ libfreerdp-client2-2,
  libfreerdp-client2 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Multi-Arch: same
 Description: Free Remote Desktop Protocol library (client library)
@@ -122,7 +129,8 @@ Description: Free Remote Desktop Protocol library (client library)
  .
  This package contains the shared library for common client functionality.
 
-Package: libfreerdp-server2-2
+Package: libfreerdp-server2-2t64
+Provides: ${t64:Provides}
 Architecture: any
 Section: libs
 Pre-Depends:
@@ -130,10 +138,12 @@ Pre-Depends:
 Depends:
  ${misc:Depends},
  ${shlibs:Depends},
- libfreerdp2-2 (= ${binary:Version}),
+ libfreerdp2-2t64 (= ${binary:Version}),
 Breaks:
+ libfreerdp-server2-2 (<< ${source:Version}),
  libfreerdp-server2 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Replaces:
+ libfreerdp-server2-2,
  libfreerdp-server2 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Multi-Arch: same
 Description: Free Remote Desktop Protocol library (server library)
@@ -142,7 +152,8 @@ Description: Free Remote Desktop Protocol library (server library)
  .
  This package contains the shared library with common server functionality.
 
-Package: libwinpr2-2
+Package: libwinpr2-2t64
+Provides: ${t64:Provides}
 Architecture: any
 Section: libs
 Pre-Depends:
@@ -151,8 +162,10 @@ Depends:
  ${misc:Depends},
  ${shlibs:Depends},
 Breaks:
+ libwinpr2-2 (<< ${source:Version}),
  libwinpr2 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Replaces:
+ libwinpr2-2,
  libwinpr2 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Multi-Arch: same
 Suggests:
@@ -169,7 +182,8 @@ Description: Windows Portable Runtime library
  .
  This package contains the WinPR shared library.
 
-Package: libwinpr-tools2-2
+Package: libwinpr-tools2-2t64
+Provides: ${t64:Provides}
 Architecture: any
 Section: libs
 Pre-Depends:
@@ -177,10 +191,12 @@ Pre-Depends:
 Depends:
  ${misc:Depends},
  ${shlibs:Depends},
- libwinpr2-2 (= ${binary:Version}),
+ libwinpr2-2t64 (= ${binary:Version}),
 Breaks:
+ libwinpr-tools2-2 (<< ${source:Version}),
  libwinpr-tools2 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Replaces:
+ libwinpr-tools2-2,
  libwinpr-tools2 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Multi-Arch: same
 Description: Windows Portable Runtime Tools library
@@ -196,8 +212,8 @@ Architecture: any
 Multi-Arch: same
 Depends:
  libssl-dev,
- libwinpr-tools2-2 (= ${binary:Version}),
- libwinpr2-2 (= ${binary:Version}),
+ libwinpr-tools2-2t64 (= ${binary:Version}),
+ libwinpr2-2t64 (= ${binary:Version}),
  ${misc:Depends},
 Description: Windows Portable Runtime library (development files)
  WinPR is a spin-off project of FreeRDP which aims at providing a portable
@@ -215,11 +231,11 @@ Package: freerdp2-dev
 Section: devel
 Architecture: any
 Depends:
- libfreerdp-client2-2 (= ${binary:Version}),
- libfreerdp-server2-2 (= ${binary:Version}),
- libfreerdp-shadow-subsystem2-2 (= ${binary:Version}),
- libfreerdp-shadow2-2 (= ${binary:Version}),
- libfreerdp2-2 (= ${binary:Version}),
+ libfreerdp-client2-2t64 (= ${binary:Version}),
+ libfreerdp-server2-2t64 (= ${binary:Version}),
+ libfreerdp-shadow-subsystem2-2t64 (= ${binary:Version}),
+ libfreerdp-shadow2-2t64 (= ${binary:Version}),
+ libfreerdp2-2t64 (= ${binary:Version}),
  libwinpr2-dev (= ${binary:Version}),
  winpr-utils (= ${binary:Version}),
  ${misc:Depends},
@@ -236,7 +252,7 @@ Architecture: any
 Depends:
  ${misc:Depends},
  ${shlibs:Depends},
- libwinpr-tools2-2 (= ${binary:Version}),
+ libwinpr-tools2-2t64 (= ${binary:Version}),
 Description: Windows Portable Runtime library command line utilities
  WinPR is a spin-off project of FreeRDP which aims at providing a portable
  implementation of important portions of the Windows API. Just like FreeRDP,
@@ -249,7 +265,8 @@ Description: Windows Portable Runtime library command line utilities
  .
  This package contains WinPR command line utils (winpr-hash, winpr-makecert).
 
-Package: libfreerdp-shadow2-2
+Package: libfreerdp-shadow2-2t64
+Provides: ${t64:Provides}
 Architecture: any
 Section: libs
 Pre-Depends:
@@ -257,11 +274,13 @@ Pre-Depends:
 Depends:
  ${misc:Depends},
  ${shlibs:Depends},
- libfreerdp-server2-2 (= ${binary:Version}),
- libwinpr-tools2-2 (= ${binary:Version}),
+ libfreerdp-server2-2t64 (= ${binary:Version}),
+ libwinpr-tools2-2t64 (= ${binary:Version}),
 Breaks:
+ libfreerdp-shadow2-2 (<< ${source:Version}),
  libfreerdp-shadow2 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Replaces:
+ libfreerdp-shadow2-2,
  libfreerdp-shadow2 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Multi-Arch: same
 Description: FreeRDP Remote Desktop Protocol shadow libraries
@@ -270,7 +289,8 @@ Description: FreeRDP Remote Desktop Protocol shadow libraries
  .
  This package contains the shadow libraries.
 
-Package: libfreerdp-shadow-subsystem2-2
+Package: libfreerdp-shadow-subsystem2-2t64
+Provides: ${t64:Provides}
 Architecture: any
 Section: libs
 Pre-Depends:
@@ -278,10 +298,12 @@ Pre-Depends:
 Depends:
  ${misc:Depends},
  ${shlibs:Depends},
- libfreerdp-shadow2-2 (= ${binary:Version}),
+ libfreerdp-shadow2-2t64 (= ${binary:Version}),
 Breaks:
+ libfreerdp-shadow-subsystem2-2 (<< ${source:Version}),
  libfreerdp-shadow2 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Replaces:
+ libfreerdp-shadow-subsystem2-2,
  libfreerdp-shadow2 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Multi-Arch: same
 Description: FreeRDP Remote Desktop Protocol shadow subsystem libraries
@@ -295,7 +317,7 @@ Architecture: any
 Depends:
  ${misc:Depends},
  ${shlibs:Depends},
- libfreerdp-shadow-subsystem2-2 (= ${binary:Version}),
+ libfreerdp-shadow-subsystem2-2t64 (= ${binary:Version}),
 Provides:
  freerdp,
 Description: FreeRDP x11 shadowing server
@@ -305,7 +327,8 @@ Description: FreeRDP x11 shadowing server
  This package contains a "shadowing" server that can be used to
  share an already started X11 DISPLAY.
 
-Package: libuwac0-0
+Package: libuwac0-0t64
+Provides: ${t64:Provides}
 Architecture: linux-any
 Section: libs
 Pre-Depends:
@@ -313,10 +336,12 @@ Pre-Depends:
 Depends:
  ${misc:Depends},
  ${shlibs:Depends},
- libfreerdp2-2 (= ${binary:Version}),
+ libfreerdp2-2t64 (= ${binary:Version}),
 Breaks:
+ libuwac0-0 (<< ${source:Version}),
  libuwac0 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Replaces:
+ libuwac0-0,
  libuwac0 (<< 2.0.0~git20170725.1.1648deb+dfsg1-1~),
 Multi-Arch: same
 Description: Using wayland as a client library
@@ -330,7 +355,7 @@ Section: libdevel
 Architecture: linux-any
 Multi-Arch: same
 Depends:
- libuwac0-0 (= ${binary:Version}),
+ libuwac0-0t64 (= ${binary:Version}),
  ${misc:Depends},
 Description: Using wayland as a client (development files)
  Using wayland as a client (uwac) is a library to provide common
@@ -343,8 +368,8 @@ Architecture: linux-any
 Depends:
  ${misc:Depends},
  ${shlibs:Depends},
- libfreerdp-client2-2 (= ${binary:Version}),
- libuwac0-0 (= ${binary:Version}),
+ libfreerdp-client2-2t64 (= ${binary:Version}),
+ libuwac0-0t64 (= ${binary:Version}),
 Description: RDP client for Windows Terminal Services (wayland client)
  FreeRDP is a libre client/server implementation of the Remote
  Desktop Protocol (RDP).

debian/copyright

@@ -9,7 +9,7 @@ Files-Excluded:
  client/Mac
  client/Windows
  cmake/ConfigOptionsAndroid.cmake
- cmake/iOSToolchain.cmake
+ cmake/ios.toolchain.cmake
  docs/FreeRDP.vsd
  docs/README.android
  docs/README.ios
@@ -102,6 +102,7 @@ Files: .clang-format
  channels/rail/ChannelOptions.cmake
  channels/rdp2tcp/ChannelOptions.cmake
  channels/rdpdr/ChannelOptions.cmake
+ channels/rdpecam/ChannelOptions.cmake
  channels/rdpei/ChannelOptions.cmake
  channels/rdpgfx/ChannelOptions.cmake
  channels/rdpsnd/ChannelOptions.cmake
@@ -109,6 +110,7 @@ Files: .clang-format
  channels/serial/ChannelOptions.cmake
  channels/smartcard/ChannelOptions.cmake
  channels/sshagent/ChannelOptions.cmake
+ channels/telemetry/ChannelOptions.cmake
  channels/tsmf/ChannelOptions.cmake
  channels/urbdrc/ChannelOptions.cmake
  channels/video/ChannelOptions.cmake
@@ -304,6 +306,8 @@ Files: .clang-format
  winpr/libwinpr/crt/test/TestTypes.c
  winpr/libwinpr/crt/test/TestUnicodeConversion.c
  winpr/libwinpr/crypto/ModuleOptions.cmake
+ winpr/libwinpr/crypto/hmac_md5.c
+ winpr/libwinpr/crypto/hmac_md5.h
  winpr/libwinpr/crypto/test/CMakeLists.txt
  winpr/libwinpr/crypto/test/TestCryptoCertEnumCertificatesInStore.c
  winpr/libwinpr/crypto/test/TestCryptoCipher.c
@@ -535,8 +539,7 @@ Comment:
  No license header present. Assuming license from LICENSE file.
  No explicit copyright notice.
 
-Files:
- channels/CMakeLists.txt
+Files: channels/CMakeLists.txt
  channels/audin/CMakeLists.txt
  channels/audin/client/CMakeLists.txt
  channels/audin/client/alsa/CMakeLists.txt
@@ -856,6 +859,7 @@ Files:
  winpr/include/winpr/credui.h
  winpr/include/winpr/crt.h
  winpr/include/winpr/crypto.h
+ winpr/include/winpr/custom-crypto.h
  winpr/include/winpr/dsparse.h
  winpr/include/winpr/endian.h
  winpr/include/winpr/error.h
@@ -892,6 +896,7 @@ Files:
  winpr/include/winpr/thread.h
  winpr/include/winpr/timezone.h
  winpr/include/winpr/tools/makecert.h
+ winpr/include/winpr/wincrypt.h
  winpr/include/winpr/windows.h
  winpr/include/winpr/winhttp.h
  winpr/include/winpr/winpr.h
@@ -1109,6 +1114,90 @@ Copyright: 2009, Marc-Andre Moreau <marcandre.moreau@gmail.com>
   2015, Marc-Andre Moreau <marcandre.moreau@gmail.com>
 License: Apache-2.0
 
+Files: channels/audin/client/mac/CMakeLists.txt
+ channels/audin/client/mac/audin_mac.m
+ channels/printer/client/cups/CMakeLists.txt
+ channels/printer/client/win/CMakeLists.txt
+ channels/rdpsnd/client/fake/CMakeLists.txt
+ channels/rdpsnd/client/fake/rdpsnd_fake.c
+ channels/rdpsnd/client/proxy/CMakeLists.txt
+ channels/rdpsnd/common/CMakeLists.txt
+ channels/rdpsnd/common/rdpsnd_common.h
+ channels/tsmf/client/gstreamer/tsmf_X11.c
+ channels/tsmf/client/gstreamer/tsmf_platform.h
+ channels/urbdrc/common/CMakeLists.txt
+ channels/urbdrc/common/urbdrc_helpers.c
+ channels/urbdrc/common/urbdrc_helpers.h
+ client/Sample/tf_channels.c
+ client/Sample/tf_channels.h
+ client/Sample/tf_freerdp.h
+ client/Wayland/wlf_cliprdr.c
+ client/Wayland/wlf_cliprdr.h
+ client/Wayland/wlf_disp.c
+ client/Wayland/wlf_disp.h
+ client/Wayland/wlf_pointer.c
+ client/Wayland/wlf_pointer.h
+ cmake/Findsoxr.cmake
+ include/freerdp/channels/tsmf.h
+ include/freerdp/channels/urbdrc.h
+ include/freerdp/server/server-common.h
+ include/freerdp/utils/cliprdr_utils.h
+ include/freerdp/utils/string.h
+ libfreerdp/cache/bitmap.h
+ libfreerdp/cache/brush.h
+ libfreerdp/cache/cache.h
+ libfreerdp/cache/glyph.h
+ libfreerdp/cache/palette.h
+ libfreerdp/cache/pointer.h
+ libfreerdp/codec/dsp.h
+ libfreerdp/codec/dsp_ffmpeg.c
+ libfreerdp/codec/dsp_ffmpeg.h
+ libfreerdp/core/errbase.c
+ libfreerdp/core/errconnect.c
+ libfreerdp/core/settings.h
+ libfreerdp/core/utils.c
+ libfreerdp/core/utils.h
+ libfreerdp/crypto/test/TestKnownHosts.c
+ libfreerdp/gdi/test/helpers.c
+ libfreerdp/gdi/test/helpers.h
+ libfreerdp/utils/string.c
+ scripts/test-scard.cpp
+ winpr/include/winpr/assert.h
+ winpr/include/winpr/debug.h
+ winpr/libwinpr/nt/ntstatus.c
+ winpr/libwinpr/sysinfo/cpufeatures/CMakeLists.txt
+ winpr/libwinpr/utils/corkscrew/debug.c
+ winpr/libwinpr/utils/corkscrew/debug.h
+ winpr/libwinpr/utils/debug.c
+ winpr/libwinpr/utils/execinfo/debug.c
+ winpr/libwinpr/utils/execinfo/debug.h
+ winpr/libwinpr/utils/unwind/debug.c
+ winpr/libwinpr/utils/unwind/debug.h
+ winpr/libwinpr/utils/windows/debug.c
+ winpr/libwinpr/utils/windows/debug.h
+ winpr/libwinpr/utils/winpr.c
+Copyright: 2013, Armin Novak <armin.novak@thincast.com>
+  2013, Thincast Technologies GmbH
+  2014, Armin Novak <armin.novak@thincast.com>
+  2014, Thincast Technologies GmbH
+  2015, Armin Novak <armin.novak@thincast.com>
+  2015, Thincast Technologies GmbH
+  2016, Armin Novak <armin.novak@thincast.com>
+  2016, Thincast Technologies GmbH
+  2017, Armin Novak <armin.novak@thincast.com>
+  2017, Thincast Technologies GmbH
+  2018, Armin Novak <armin.novak@thincast.com>
+  2018, Thincast Technologies GmbH
+  2019, Armin Novak <armin.novak@thincast.com>
+  2019, Thincast Technologies GmbH
+  2020, Armin Novak <armin.novak@thincast.com>
+  2020, Thincast Technologies GmbH
+  2021, Armin Novak <armin.novak@thincast.com>
+  2021, Thincast Technologies GmbH
+  2022, Armin Novak <armin.novak@thincast.com>
+  2022, Thincast Technologies GmbH
+License: Apache-2.0
+
 Files: client/Sample/tf_freerdp.c
  client/X11/xf_gdi.h
  client/X11/xf_gfx.c
@@ -1170,83 +1259,14 @@ Copyright: 2010, Marc-Andre Moreau <marcandre.moreau@gmail.com>
   2014, Marc-Andre Moreau <marcandre.moreau@gmail.com>
   2016, 2018, Armin Novak <armin.novak@thincast.com>
   2016, 2018, Thincast Technologies GmbH
-  2016, Thincast Technologies GmbH
-  2017, Armin Novak <armin.novak@thincast.com>
-  2017, Thincast Technologies GmbH
-  2019, Armin Novak <armin.novak@thincast.com>
-  2019, Thincast Technologies GmbH
-  2020, Armin Novak <armin.novak@thincast.com>
-  2020, Thincast Technologies GmbH
-License: Apache-2.0
-
-Files: channels/audin/client/mac/CMakeLists.txt
- channels/audin/client/mac/audin_mac.m
- channels/printer/client/cups/CMakeLists.txt
- channels/printer/client/win/CMakeLists.txt
- channels/rdpsnd/client/fake/CMakeLists.txt
- channels/rdpsnd/client/fake/rdpsnd_fake.c
- channels/rdpsnd/client/proxy/CMakeLists.txt
- channels/rdpsnd/common/CMakeLists.txt
- channels/rdpsnd/common/rdpsnd_common.h
- channels/tsmf/client/gstreamer/tsmf_X11.c
- channels/tsmf/client/gstreamer/tsmf_platform.h
- channels/urbdrc/common/CMakeLists.txt
- channels/urbdrc/common/urbdrc_helpers.c
- channels/urbdrc/common/urbdrc_helpers.h
- client/Sample/tf_channels.c
- client/Sample/tf_channels.h
- client/Sample/tf_freerdp.h
- client/Wayland/wlf_cliprdr.c
- client/Wayland/wlf_cliprdr.h
- client/Wayland/wlf_disp.c
- client/Wayland/wlf_disp.h
- client/Wayland/wlf_pointer.c
- client/Wayland/wlf_pointer.h
- cmake/Findsoxr.cmake
- include/freerdp/channels/tsmf.h
- include/freerdp/channels/urbdrc.h
- include/freerdp/server/server-common.h
- libfreerdp/cache/bitmap.h
- libfreerdp/cache/brush.h
- libfreerdp/cache/cache.h
- libfreerdp/cache/glyph.h
- libfreerdp/cache/palette.h
- libfreerdp/cache/pointer.h
- libfreerdp/codec/dsp.h
- libfreerdp/codec/dsp_ffmpeg.c
- libfreerdp/codec/dsp_ffmpeg.h
- libfreerdp/core/errbase.c
- libfreerdp/core/errconnect.c
- libfreerdp/core/settings.h
- libfreerdp/core/utils.c
- libfreerdp/core/utils.h
- libfreerdp/crypto/test/TestKnownHosts.c
- libfreerdp/gdi/test/helpers.c
- libfreerdp/gdi/test/helpers.h
- scripts/test-scard.cpp
- winpr/include/winpr/debug.h
- winpr/libwinpr/nt/ntstatus.c
- winpr/libwinpr/sysinfo/cpufeatures/CMakeLists.txt
- winpr/libwinpr/utils/debug.c
- winpr/libwinpr/utils/winpr.c
-Copyright: 2013, Armin Novak <armin.novak@thincast.com>
-  2013, Thincast Technologies GmbH
-  2014, Armin Novak <armin.novak@thincast.com>
-  2014, Thincast Technologies GmbH
-  2015, Armin Novak <armin.novak@thincast.com>
-  2015, Thincast Technologies GmbH
   2016, Armin Novak <armin.novak@thincast.com>
   2016, Thincast Technologies GmbH
   2017, Armin Novak <armin.novak@thincast.com>
   2017, Thincast Technologies GmbH
-  2018, Armin Novak <armin.novak@thincast.com>
-  2018, Thincast Technologies GmbH
   2019, Armin Novak <armin.novak@thincast.com>
   2019, Thincast Technologies GmbH
   2020, Armin Novak <armin.novak@thincast.com>
   2020, Thincast Technologies GmbH
-  2021, Armin Novak <armin.novak@thincast.com>
-  2021, Thincast Technologies GmbH
 License: Apache-2.0
 
 Files: channels/audin/client/audin_main.h
@@ -1607,6 +1627,21 @@ Copyright: 2012, Corey Clayton <can.of.tuna@gmail.com>
   2013, Corey Clayton <can.of.tuna@gmail.com>
 License: Apache-2.0
 
+Files: channels/rdpecam/CMakeLists.txt
+ channels/rdpecam/server/CMakeLists.txt
+ channels/rdpecam/server/camera_device_enumerator_main.c
+ channels/rdpecam/server/camera_device_main.c
+ channels/telemetry/CMakeLists.txt
+ channels/telemetry/server/CMakeLists.txt
+ channels/telemetry/server/telemetry_main.c
+ include/freerdp/channels/rdpecam.h
+ include/freerdp/channels/telemetry.h
+ include/freerdp/server/rdpecam-enumerator.h
+ include/freerdp/server/rdpecam.h
+ include/freerdp/server/telemetry.h
+Copyright: 2022, Pascal Nowack <Pascal.Nowack@gmx.de>
+License: Apache-2.0
+
 Files: cmake/FindX11.cmake
  cmake/FindXKBFile.cmake
  cmake/FindXShm.cmake
@@ -1879,6 +1914,13 @@ Files: channels/audin/client/opensles/opensl_io.c
 Copyright: 2012, Victor Lazzarini
 License: BSD-3-clause
 
+Files: winpr/libwinpr/crypto/md4.c
+ winpr/libwinpr/crypto/md4.h
+ winpr/libwinpr/crypto/md5.c
+ winpr/libwinpr/crypto/md5.h
+Copyright: 2001, Alexander Peslyak and it is hereby released to the
+License: public-domain
+
 Files: include/freerdp/codec/rfx.h
  libfreerdp/codec/nsc_encode.c
  libfreerdp/codec/nsc_encode.h
@@ -2257,6 +2299,12 @@ Copyright: 2011, Anthony Tong <atong@trustedcs.com>
   2016, David PHAM-VAN <d.phamvan@inuvika.com>
 License: Apache-2.0
 
+Files: libfreerdp/utils/cliprdr_utils.c
+Copyright: 2013, Marc-Andre Moreau <marcandre.moreau@gmail.com>
+  2022, Armin Novak <anovak@thincast.com
+  2022, Thincast Technologies GmbH
+License: Apache-2.0
+
 Files: channels/printer/client/printer_main.c
 Copyright: 2010-2011, Vic Lee
   2015, DI (FH) Martin Haimberger <martin.haimberger@thincast.com>
@@ -2970,7 +3018,7 @@ License: BSD-3-clause
 
 Files: debian/*
 Copyright: 2015-2018, Bernhard Miklautz <bernhard.miklautz@thincast.com>
-  2016, Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
+  2016-2022, Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
 License: Apache-2.0 or BSD-2-clause or BSD-3-clause or BSL-1.0 or Expat or ISC or X11 or zlib/libpng or public-domain
 
 License: Apache-2.0

debian/libfreerdp-client2-2t64.symbols

@@ -1,4 +1,4 @@
-libfreerdp-client2.so.2 libfreerdp-client2-2 #MINVER#
+libfreerdp-client2.so.2 libfreerdp-client2-2t64 #MINVER#
 * Build-Depends-Package: freerdp2-dev
  add_device@Base 2.1.0+dfsg1
  client_auto_reconnect@Base 2.0.0~git20181120.1.e21b72c95+dfsg1
@@ -10,9 +10,9 @@ libfreerdp-client2.so.2 libfreerdp-client2-2 #MINVER#
  client_cli_verify_certificate_ex@Base 2.0.0~git20190204.1.2693389a+dfsg1
  client_cli_verify_changed_certificate@Base 2.0.0~git20160317.1.75ae3f5+dfsg1
  client_cli_verify_changed_certificate_ex@Base 2.0.0~git20190204.1.2693389a+dfsg1
- cliprdr_parse_file_list@Base 2.0.0~git20170725.1.1648deb+dfsg1
- cliprdr_serialize_file_list@Base 2.0.0~git20170725.1.1648deb+dfsg1
- cliprdr_serialize_file_list_ex@Base 2.3.0+dfsg1
+#MISSING: 2.8.0+dfsg1-1# cliprdr_parse_file_list@Base 2.0.0~git20170725.1.1648deb+dfsg1
+#MISSING: 2.8.0+dfsg1-1# cliprdr_serialize_file_list@Base 2.0.0~git20170725.1.1648deb+dfsg1
+#MISSING: 2.8.0+dfsg1-1# cliprdr_serialize_file_list_ex@Base 2.3.0+dfsg1
  del_device@Base 2.1.0+dfsg1
  freerdp_channels_addin_list_free@Base 2.0.0~git20160317.1.75ae3f5+dfsg1
  freerdp_channels_client_find_static_entry@Base 2.0.0~git20160317.1.75ae3f5+dfsg1