Root cause analysis:

FreeRDP 3.30 changed the internal RDPDR device layout: freerdp_device_clone()
now casts RDPDR_DEVICE* to the private `struct RDPDR_DEVICE_EX` and reads its
`args` member, which only exists for devices allocated via freerdp_device_new():
https://github.com/FreeRDP/FreeRDP/blob/3.30.0/libfreerdp/common/settings.c#L460

Remmina 1.4.43 still allocates the smartcard device with a plain
calloc(1, sizeof(RDPDR_SMARTCARD)) and passes it to
freerdp_device_collection_add():
https://gitlab.com/Remmina/Remmina/-/blob/v1.4.43/plugins/rdp/rdp_plugin.c#L2421

When freerdp_settings_clone() clones the device list during freerdp_connect(),
freerdp_device_clone() reads src->args past the end of the calloc'ed block and
dereferences adjacent heap data — in my case a fragment of the server address
string, which matches the ASCII faulting address (0x3234322e3037 = "70.242").

The same legacy calloc pattern is used for printer, serial and parallel
devices in 1.4.43, so "Share printers" etc. most likely crash the same way.

Upstream Remmina already fixed this after the 1.4.43 release:
commit ba0392c2 "rdp: fix RDPDR_DEVICE creation" (2026-06-24) switches all
device creation to freerdp_device_new():
https://gitlab.com/Remmina/Remmina/-/commit/ba0392c2

Backporting that commit to the Ubuntu 1.4.43 package should fix this
regression (same approach as the lp2161512 backport in
1.4.43+dfsg-0ubuntu0.26.04.2).

Workaround: disable "Share smartcard", or hold freerdp3/remmina at the
pre-USN-8561 versions (3.24.2 / 1.4.40).

** Also affects: freerdp3 (Ubuntu)
   Importance: Undecided
       Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162700

Title:
  remmina crashed with SIGSEGV in freerdp_device_clone()

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/freerdp3/+bug/2162700/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to