[
https://issues.apache.org/jira/browse/GUACAMOLE-2263?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Mike Jumper updated GUACAMOLE-2263:
-----------------------------------
Fix Version/s: (was: 1.6.1 [staging])
> CLIPRDR: Harden against FreeRDP 3.x strict clipboard state machine
> ------------------------------------------------------------------
>
> Key: GUACAMOLE-2263
> URL: https://issues.apache.org/jira/browse/GUACAMOLE-2263
> Project: Guacamole
> Issue Type: Bug
> Components: guacamole-server
> Affects Versions: 1.6.0
> Reporter: escra
> Priority: Major
>
> FreeRDP 3.x has a significantly stricter CLIPRDR state machine than 2.x.
> Several patterns in guacd's clipboard handling that were harmless with
> FreeRDP 2.x now cause session teardowns:
> 1. *Overlapping Format Data Requests* -- FreeRDP 3.x tracks pending requests
> internally and disconnects with error 1359 if a second request arrives before
> the first is answered.
> 2. *CB_RESPONSE_FAIL not checked* -- If the server responds with a failure
> flag, the code attempts to process NULL/garbage data, causing a crash.
> 3. *No response for unsupported formats* -- When the server requests an
> unsupported clipboard format, the code silently drops the request. FreeRDP
> 3.x times out after 10 seconds and tears down the session.
> 4. *NULL/empty data not guarded* -- requestedFormatData can be NULL or
> dataLen can be zero in edge cases, leading to crashes.
> 5. *Stale pending requests* -- When a new Format List arrives, any pending
> request for old data becomes stale but is not cleared.
> 6. *Non-OK return codes treated as fatal* -- FreeRDP 3.x treats non-OK
> returns from CLIPRDR callbacks as fatal channel errors that disconnect the
> entire session.
> The fix adds a request_pending flag with a pthread_mutex to prevent
> overlapping requests, checks CB_RESPONSE_FAIL before processing, sends
> CB_RESPONSE_FAIL for unsupported formats, guards against NULL/empty data,
> clears stale requests on new Format Lists, and ensures all callbacks return
> CHANNEL_RC_OK.
> *Related:* [FreeRDP #11847|https://github.com/FreeRDP/FreeRDP/issues/11847],
> GUACAMOLE-2118
> *Affected versions:* staging/1.6.1 (FreeRDP 3.x in Docker image), main
> *Not affected:* Deployments using FreeRDP 2.x only
> PR: https://github.com/apache/guacamole-server/pull/661
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
