This is from libfreerdp-core/license_read_scope_list():

	stream_read_uint32(s, scopeCount); /* ScopeCount (4 bytes) */

	scopeList->count = scopeCount;
	scopeList->array = (LICENSE_BLOB*) xmalloc(sizeof(LICENSE_BLOB) * scopeCount);

Assuming that scopeCount is read from the wire, this results in an integer overflow in the size computation.  The array is subsequentially filled with pointers and constants, so this is probably not exploitable for anything but a crash:

	/* ScopeArray */
	for (i = 0; i < scopeCount; i++)
	{
		scopeList->array[i].type = BB_SCOPE_BLOB;
		license_read_binary_blob(s, &scopeList->array[i]);
	}

But I'm filing it as an embargoed security bug just to be sure.