**[Impact]**
* Remmina crashes with SIGSEGV in `freerdp_device_clone()` during
`freerdp_connect()` whenever an RDP device redirection option is enabled
("Share smartcard", "Share printers", serial or parallel redirection), on
any system running freerdp3 >= 3.30 (resolute after USN-8561, stonking GA).
* Root cause: Remmina 1.4.43 allocates RDPDR devices with a plain `calloc()`.
FreeRDP 3.30+ casts device entries to an internal `RDPDR_DEVICE_EX` struct
and reads its `args` member, which only exists for devices allocated via
`freerdp_device_new()` — reading past the end of the calloc'ed block and
dereferencing adjacent heap data (see comment #2 for the analysis).
* This is a regression of the freerdp3 3.30 update (USN-8561 on 26.04);
upstream fixed it in master with commit ba0392c2 "rdp: fix RDPDR_DEVICE
creation" (2026-06-24), but no 1.4.44 release exists yet, so 1.4.43-based
packages need the backport.
**[Test case]**
1. Attach a smartcard served by pcscd (e.g. Rutoken), create an RDP profile
in Remmina with "Share smartcard" enabled.
2. Without the fix remmina segfaults right after channel initialization
(faulting address contains ASCII of the server address).
3. With the package from -proposed the connection succeeds and smartcard
redirection works.
4. Sanity checks: "Share printers" (with CUPS printers configured) and a
plain RDP connection without redirection still work.
Locally verified on stonking (26.10) with a Rutoken smartcard: stock
1.4.43+dfsg-1ubuntu2 segfaults with "Share smartcard" enabled, a locally
built 1.4.43+dfsg-1ubuntu2.1 (same patch) connects fine.
**[Regression potential]**
* Low: single-file change (plugins/rdp/rdp_plugin.c), a clean backport of
upstream commit ba0392c2, already accepted upstream. Only the RDP device
redirection code paths are touched; the legacy freerdp2 paths are kept in
place (dead code on Ubuntu, which builds against freerdp3).
**Debdiffs**
* stonking: remmina 1.4.43+dfsg-1ubuntu2 -> 1.4.43+dfsg-1ubuntu2.1
* resolute: remmina 1.4.43+dfsg-0ubuntu0.26.04.2 -> 1.4.43+dfsg-0ubuntu0.26.04.3
** Attachment added: "debdiff-stonking"
https://bugs.launchpad.net/ubuntu/+source/remmina/+bug/2162700/+attachment/6013105/+files/debdiff-stonking
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162700
Title:
remmina crashed with SIGSEGV in freerdp_device_clone()
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/freerdp3/+bug/2162700/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
