Root cause analysis: FreeRDP 3.30 changed the internal RDPDR device layout: freerdp_device_clone() now casts RDPDR_DEVICE* to the private `struct RDPDR_DEVICE_EX` and reads its `args` member, which only exists for devices allocated via freerdp_device_new(): https://github.com/FreeRDP/FreeRDP/blob/3.30.0/libfreerdp/common/settings.c#L460
Remmina 1.4.43 still allocates the smartcard device with a plain calloc(1, sizeof(RDPDR_SMARTCARD)) and passes it to freerdp_device_collection_add(): https://gitlab.com/Remmina/Remmina/-/blob/v1.4.43/plugins/rdp/rdp_plugin.c#L2421 When freerdp_settings_clone() clones the device list during freerdp_connect(), freerdp_device_clone() reads src->args past the end of the calloc'ed block and dereferences adjacent heap data — in my case a fragment of the server address string, which matches the ASCII faulting address (0x3234322e3037 = "70.242"). The same legacy calloc pattern is used for printer, serial and parallel devices in 1.4.43, so "Share printers" etc. most likely crash the same way. Upstream Remmina already fixed this after the 1.4.43 release: commit ba0392c2 "rdp: fix RDPDR_DEVICE creation" (2026-06-24) switches all device creation to freerdp_device_new(): https://gitlab.com/Remmina/Remmina/-/commit/ba0392c2 Backporting that commit to the Ubuntu 1.4.43 package should fix this regression (same approach as the lp2161512 backport in 1.4.43+dfsg-0ubuntu0.26.04.2). Workaround: disable "Share smartcard", or hold freerdp3/remmina at the pre-USN-8561 versions (3.24.2 / 1.4.40). ** Also affects: freerdp3 (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2162700 Title: remmina crashed with SIGSEGV in freerdp_device_clone() To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/freerdp3/+bug/2162700/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
