[
https://issues.apache.org/jira/browse/GUACAMOLE-2262?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Mike Jumper updated GUACAMOLE-2262:
-----------------------------------
Affects Version/s: 1.7.0 [main]
(was: 1.6.0)
> CLIPRDR: Stack overflow when clipboard buffer exceeds thread stack size
> -----------------------------------------------------------------------
>
> Key: GUACAMOLE-2262
> URL: https://issues.apache.org/jira/browse/GUACAMOLE-2262
> Project: Guacamole
> Issue Type: Bug
> Components: guacamole-server
> Affects Versions: 1.7.0 [main]
> Reporter: escra
> Priority: Major
> Fix For: 1.7.0 [main]
>
>
> The clipboard receive and send buffers in cliprdr.c are allocated on the
> stack using GUAC_COMMON_CLIPBOARD_MAX_LENGTH. Since configurable clipboard
> limits (GUACAMOLE-2002, PR #564) raised this constant to 50 MiB (52428800
> bytes) while the default pthread stack size is only 8 MiB, any clipboard
> operation that touches these buffers causes a stack overflow (SIGSEGV) that
> silently kills the guacd child process handling the connection.
> Affected functions:
> - guac_rdp_cliprdr_format_data_response(): declares {{char
> received_data[GUAC_COMMON_CLIPBOARD_MAX_LENGTH]}} on the stack
> - guac_rdp_cliprdr_format_data_request(): heap-allocates with the
> compile-time maximum instead of the actual configured size
> The fix is to heap-allocate both buffers using guac_mem_alloc() with the
> actual configured clipboard size (clipboard->clipboard->available) and free
> them on all exit paths.
> *Affected versions:* staging/1.6.1 and main (any build with GUACAMOLE-2002
> configurable clipboard limits)
> *Not affected:* 1.5.5 and earlier (256 KiB fixed limit fits on stack)
> PR: https://github.com/apache/guacamole-server/pull/659
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
