From 169971607cece48384cb94632b829bd57336af0f Mon Sep 17 00:00:00 2001
From: Armin Novak <armin.novak@thincast.com>
Date: Tue, 17 Feb 2026 08:38:04 +0100
Subject: [PATCH] [codec,nsc] fix use of nsc_process_message

the second width/height argument should reflect the destination buffer
pixel size
---
 libfreerdp/codec/clear.c | 10 ++++++----
 libfreerdp/codec/nsc.c   | 12 +++++++-----
 libfreerdp/gdi/gdi.c     |  5 +++--
 3 files changed, 16 insertions(+), 11 deletions(-)

Index: FreeRDP-3.10.3/libfreerdp/codec/clear.c
===================================================================
--- FreeRDP-3.10.3.orig/libfreerdp/codec/clear.c
+++ FreeRDP-3.10.3/libfreerdp/codec/clear.c
@@ -133,7 +133,8 @@ static BOOL convert_color(BYTE* WINPR_RE
 static BOOL clear_decompress_nscodec(NSC_CONTEXT* WINPR_RESTRICT nsc, UINT32 width, UINT32 height,
                                      wStream* WINPR_RESTRICT s, UINT32 bitmapDataByteCount,
                                      BYTE* WINPR_RESTRICT pDstData, UINT32 DstFormat,
-                                     UINT32 nDstStep, UINT32 nXDstRel, UINT32 nYDstRel)
+                                     UINT32 nDstStep, UINT32 nXDstRel, UINT32 nYDstRel,
+                                     UINT32 nDstWidth, UINT32 nDstHeight)
 {
 	BOOL rc = 0;
 
@@ -141,8 +142,8 @@ static BOOL clear_decompress_nscodec(NSC
 		return FALSE;
 
 	rc = nsc_process_message(nsc, 32, width, height, Stream_Pointer(s), bitmapDataByteCount,
-	                         pDstData, DstFormat, nDstStep, nXDstRel, nYDstRel, width, height,
-	                         FREERDP_FLIP_NONE);
+	                         pDstData, DstFormat, nDstStep, nXDstRel, nYDstRel, nDstWidth,
+	                         nDstHeight, FREERDP_FLIP_NONE);
 	Stream_Seek(s, bitmapDataByteCount);
 	return rc;
 }
@@ -532,7 +533,8 @@ static BOOL clear_decompress_subcodecs_d
 
 			case 1: /* NSCodec */
 				if (!clear_decompress_nscodec(clear->nsc, width, height, s, bitmapDataByteCount,
-				                              pDstData, DstFormat, nDstStep, nXDstRel, nYDstRel))
+				                              pDstData, DstFormat, nDstStep, nXDstRel, nYDstRel,
+				                              nDstWidth, nDstHeight))
 					return FALSE;
 
 				break;
Index: FreeRDP-3.10.3/libfreerdp/gdi/gdi.c
===================================================================
--- FreeRDP-3.10.3.orig/libfreerdp/gdi/gdi.c
+++ FreeRDP-3.10.3/libfreerdp/gdi/gdi.c
@@ -1101,8 +1101,9 @@ static BOOL gdi_surface_bits(rdpContext*
 			if (!nsc_process_message(
 			        context->codecs->nsc, cmd->bmp.bpp, cmd->bmp.width, cmd->bmp.height,
 			        cmd->bmp.bitmapData, cmd->bmp.bitmapDataLength, gdi->primary_buffer, format,
-			        gdi->stride, cmdRect.left, cmdRect.top, cmdRect.right - cmdRect.left,
-			        cmdRect.bottom - cmdRect.top, FREERDP_FLIP_VERTICAL))
+			        gdi->stride, cmdRect.left, cmdRect.top,
+			        WINPR_ASSERTING_INT_CAST(UINT32, gdi->width),
+			        WINPR_ASSERTING_INT_CAST(UINT32, gdi->height), FREERDP_FLIP_VERTICAL))
 			{
 				WLog_ERR(TAG, "Failed to process NSCodec message");
 				goto out;