Bug#898448: Makes vinagre segfault on authentication failure

[Mike Gabriel]

Control: tags -1 patch

Hi Josh,

On  Mo 14 Mai 2018 19:43:42 CEST, Josh Triplett wrote:

On Mon, May 14, 2018 at 01:49:57PM +0000, Mike Gabriel wrote:

HI Josh,

On  Fr 11 Mai 2018 21:02:04 CEST, Josh Triplett wrote:

> Package: libfreerdp2-2
> Version: 2.0.0~git20180411.1.7a7b1802+dfsg1-1
> Severity: important
>
> After upgrading libfreerdp2-2, authentication failures (mistyped
> password) started causing segfaults:
>
> May 11 11:41:29 jtriplet-mobl2 vinagre.desktop[9277]: [11:41:29:080]
> [9277:9277] [ERROR][com.freerdp.core] - freerdp_set_last_error
> ERRCONNECT_LOGON_FAILURE [0x00020014]
> May 11 11:41:29 jtriplet-mobl2 vinagre.desktop[9277]: [11:41:29:080]
> [9277:9277] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback:
> CONNECTION_STATE_NLA - nla_recv_pdu() fail
> May 11 11:41:29 jtriplet-mobl2 vinagre.desktop[9277]: [11:41:29:080]
> [9277:9277] [ERROR][com.freerdp.core.transport] - transport_check_fds:
> transport->ReceiveCallback() - -1
> May 11 11:41:29 jtriplet-mobl2 kernel: vinagre[9277]: segfault at 9 ip
> 00007fbc84bf6ab0 sp 00007ffc05377a40 error 4 in
> libfreerdp2.so.2.0.0[7fbc84b1c000+137000]
>

I contacted one of the upstream authors on this.

Can you provide a gdb backtrace ("bt full") to get some more insight what
happens to vinagre?

Sure. I can easily reproduce this, just by entering an incorrect
username and password.

Thread 1 "vinagre" received signal SIGSEGV, Segmentation fault.
clear_context_free (clear=0x1) at ./libfreerdp/codec/clear.c:1216
1216    ./libfreerdp/codec/clear.c: No such file or directory.
(gdb) bt full

        clear = 0x1

        rc = 1
        rdp = <optimized out>

        rdp_tab = 0x555555cfe920
        priv = 0x555555cfe730

        position = 0
        notebook = 0x555555b06230
        previous_active_tab = 0x555555cfe920
        __func__ = "vinagre_notebook_close_tab"

#9  0x00007ffff59034c0 in  () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0

        app = 0x5555557e91a0
        res = <optimized out>

#0 0x00007ffff528bab0 in clear_context_free (clear=0x1) at ./libfreerdp/codec/clear.c:1216 #1 0x00007ffff522a9cd in codecs_free (codecs=0x555555dd62b0) at ./libfreerdp/core/codecs.c:213 #2 0x00007ffff5224c77 in freerdp_disconnect (instance=0x555555d14d00) at ./libfreerdp/core/freerdp.c:508 #3 0x0000555555584769 in vinagre_rdp_tab_dispose (object=0x555555cfe920) at plugins/rdp/vinagre-rdp-tab.c:182 #4 0x00007ffff5be1e03 in g_object_unref () at /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0 #5 0x00007ffff6b5da39 in gtk_container_remove () at /usr/lib/x86_64-linux-gnu/libgtk-3.so.0 #6 0x0000555555570748 in vinagre_notebook_close_tab (nb=0x555555b06230, tab=0x555555cfe920) at vinagre/vinagre-notebook.c:697 #7 0x0000555555583074 in idle_close (tab=0x555555cfe920) at plugins/rdp/vinagre-rdp-tab.c:272 #8 0x00007ffff59030f5 in g_main_context_dispatch () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0 #10 0x00007ffff590354c in g_main_context_iteration () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0 #11 0x00007ffff5ec3cdd in g_application_run () at /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0 #12 0x00005555555655cf in main (argc=1, argv=0x7fffffffdf68) at vinagre/vinagre-main.c:196

Thanks,
Mike

[1] https://github.com/FreeRDP/FreeRDP/pull/4648/files
--

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
mobile: +49 (1520) 1976 148
landline: +49 (4354) 8390 139

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: mike.gabr...@das-netzwerkteam.de, http://das-netzwerkteam.de

Is it possible for you to patch freerdp2 with this [1] patch and check if the issue is gone then?

pgpuZlY4rZzr5.pgp
Description: Digitale PGP-Signatur