Client crash via malformed planar bitmap data

Out-of-bounds write in FreeRDP planar bitmap decoding allows remote authenticated users to crash the client with crafted bitmap data. planar_skip_plane_rle advances through raw RLE bytes with pointer arithmetic before confirming that the resulting position remains within the source buffer, while zero-length cache bitmaps are accepted at the allocation boundary. The attacker must supply the bitmap through an authenticated RDP session; the resulting memory corruption interrupts the client, and code execution has not been established.