Debian Bug report logs - #418098
rdesktop segfault with libx11-6 1.0.3-7

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Eric Covener" <covener@gmail.com>

To: submit@bugs.debian.org

Subject: rdesktop segfault with libx11-6 1.0.3-7

Date: Fri, 6 Apr 2007 15:30:00 -0400

Package: rdesktop
Version: 1.5.0-1

rdesktop crashes right after successful windows login with libx11-6 1.0.3-7 ,
no crashes when downgrading libx11 to libx11-6 1.0.3-6

I am running unstable on an ia32 system

-- 
Eric Covener
covener@gmail.com

Message #10 received at 418098@bugs.debian.org (full text, mbox, reply):

From: Julien Cristau <jcristau@debian.org>

To: Eric Covener <covener@gmail.com>, 418098@bugs.debian.org

Cc: debian-x@lists.debian.org

Subject: Re: Bug#418098: rdesktop segfault with libx11-6 1.0.3-7

Date: Sat, 7 Apr 2007 15:49:26 +0200

[Message part 1 (text/plain, inline)]

On Fri, Apr  6, 2007 at 15:30:00 -0400, Eric Covener wrote:

> Package: rdesktop
> Version: 1.5.0-1
> 
> rdesktop crashes right after successful windows login with libx11-6 1.0.3-7 
> ,
> no crashes when downgrading libx11 to libx11-6 1.0.3-6
> 
> I am running unstable on an ia32 system
> 
I guess this happens because rdesktop calls XCreateImage() with an
invalid value for the bytes_per_line parameter, and doesn't check the
return value.  Since the latest update, libx11 does sanity checks on
this parameter, and XCreateImage() returns NULL.  Since rdesktop never
checks the value returned by this function, it segfaults.

rdesktop probably assumes that bytes_per_line is related to depth*width,
instead of bpp*width, so it should either fix that or use a value of
bytes_per_line of 0, which lets Xlib calculate the correct value.

See http://bugs.freedesktop.org/show_bug.cgi?id=10536 ,
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=418016 and
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=418021 .

Cheers,
Julien

[signature.asc (application/pgp-signature, inline)]

Message #19 received at 418098@bugs.debian.org (full text, mbox, reply):

From: Mark Heily <mark@heily.com>

To: rdesktop-devel@lists.sourceforge.net, 418098@bugs.debian.org, jcristau@debian.org

Subject: [PATCH] rdesktop segfault with libx11-6 1.0.3-7

Date: Wed, 11 Apr 2007 11:26:30 -0400

Here is a patch that prevents rdesktop from crashing due to increased Xlib sanity checking 
of arguments passed to XCreateImage(3). Thanks to Julien Cristau for his helpful explanation
of the problem on the Debian bug tracking system.

Thanks,

Mark Heily
<mark@heily.com>


References:

[1] http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg326793.html
[2] https://bugs.launchpad.net/ubuntu/+source/rdesktop/+bug/104332


Patch:

--- ../rdesktop/xwin.c  2007-01-17 02:39:31.000000000 -0500
+++ xwin.c      2007-04-11 11:13:51.000000000 -0400
@@ -3218,7 +3218,7 @@
                return;
 
        image = XCreateImage(g_display, g_visual, g_depth, ZPixmap, 0,
-                            (char *) data, cx, cy, BitmapPad(g_display), cx * g_bpp / 8);
+                            (char *) data, cx, cy, BitmapPad(g_display), 0);
 
        if (g_ownbackstore)
        {

Message #24 received at 418098@bugs.debian.org (full text, mbox, reply):

From: Mark Heily <mark@heily.com>

To: rdesktop-devel@lists.sourceforge.net

Cc: 418098@bugs.debian.org, 102922@bugs.launchpad.net, jcristau@debian.org

Subject: Re: [PATCH] rdesktop segfault with libx11-6 1.0.3-7

Date: Wed, 11 Apr 2007 14:35:40 -0400

On Wed, 2007-04-11 at 11:26 -0400, Mark Heily wrote:
> Here is a patch that prevents rdesktop from crashing due to increased Xlib sanity checking 
> of arguments passed to XCreateImage(3). Thanks to Julien Cristau for his helpful explanation
> of the problem on the Debian bug tracking system.
> 

Regrettably, the patch I submitted needs additional work by the rdesktop
developers or someone with more knowledge about Xlib programming.  After
applying the patch, XCreateImage(3) returns a valid Image pointer and
does not crash the program, but the image it creates is slanted and
unreadable. The impacted functions are ui_desktop_save() and
ui_desktop_restore() in xwin.c.

You can reproduce this by connecting to a Windows 2000 server in 8bpp
mode, clicking on the Start button, and then clicking the start button
again. The part of the desktop that is repainted will be displayed
incorrectly.

Regards,

Mark

Message #29 received at 418098@bugs.debian.org (full text, mbox, reply):

From: Mark Heily <mark@heily.com>

To: rdesktop-devel@lists.sourceforge.net

Cc: 418098@bugs.debian.org, 104332@bugs.launchpad.net

Subject: Re: [PATCH] rdesktop segfault with libx11-6 1.0.3-7

Date: Thu, 12 Apr 2007 10:03:16 -0400

[Message part 1 (text/plain, inline)]

Here is a corrected patch that fixes the segfault and correctly redraws the desktop image. This has 
been tested with a Windows 2000 Server at 8bpp and a Windows 2003 server at 16bpp. 

Thanks to Mat G for his suggestion on how to fix my original patch.

-Mark


--- ../rdesktop/xwin.c	2007-01-17 02:39:31.000000000 -0500
+++ xwin.c	2007-04-12 09:51:46.000000000 -0400
@@ -3218,7 +3218,7 @@
 		return;
 
 	image = XCreateImage(g_display, g_visual, g_depth, ZPixmap, 0,
-			     (char *) data, cx, cy, BitmapPad(g_display), cx * g_bpp / 8);
+			     (char *) data, cx, cy, g_bpp, 0);
 
 	if (g_ownbackstore)
 	{

[rdesktop-xcreateimage2.patch (text/x-patch, attachment)]

Message #36 received at 418098@bugs.debian.org (full text, mbox, reply):

From: Michael Gernoth <mlists@zerfleddert.de>

To: Mark Heily <mark@heily.com>

Cc: rdesktop-devel@lists.sourceforge.net, 104332@bugs.launchpad.net, 418098@bugs.debian.org

Subject: Re: [rdesktop-devel] [PATCH] rdesktop segfault with libx11-6 1.0.3-7

Date: Thu, 12 Apr 2007 18:10:29 +0200

On Thu, Apr 12, 2007 at 10:03:16AM -0400, Mark Heily wrote:
> Here is a corrected patch that fixes the segfault and correctly
> redraws the desktop image. This has been tested with a Windows 2000
> Server at 8bpp and a Windows 2003 server at 16bpp. 

Thank you for your patch. I have just committed it to the rdesktop CVS
repository (xwin.c revision 1.223).

Regards,
  Michael

Message #41 received at 418098@bugs.debian.org (full text, mbox, reply):

From: Christoph Haas <haas@debian.org>

To: 418098@bugs.debian.org

Subject: Seconded - it works

Date: Mon, 16 Apr 2007 10:25:35 +0200

[Message part 1 (text/plain, inline)]

Just wanted to stop by and say that the patch fixed the trouble here,
too. However the problem appeared only on systems with NVidia graphic
cards when using the Xinerama extension. The problem did not appear on
single-monitor setups. I hope the fixed version will make it into Etch.

 Christoph

[signature.asc (application/pgp-signature, inline)]

Message #46 received at 418098@bugs.debian.org (full text, mbox, reply):

From: Matthew Chapman <matthewc@cse.unsw.edu.au>

To: Mark Heily <mark@heily.com>

Cc: rdesktop-devel@lists.sourceforge.net, 104332@bugs.launchpad.net, 418098@bugs.debian.org

Subject: Re: [rdesktop-devel] [PATCH] rdesktop segfault with libx11-6 1.0.3-7

Date: Mon, 16 Apr 2007 19:15:13 +1000

One small point:  I think it might be better to pass 8 for bitmap_pad
rather than g_bpp...  which should have the same effect of specifying no
padding, but is in line with X11 documentation which specifies that you
should pass 8, 16 or 32 for bitmap_pad.  I'm a little worried that some
future X server might not be happy with 24.

In principle I also tend to agree with Ilya, that it would be better to
supply bytes_per_line as a sanity check... if rdesktop and X disagree on
it then you'd get garbage on the screen, as you saw with your initial
test.  But then, for bitmap_pad=8, I can't imagine that the X server
would arrive at a different value to cx*g_bpp/8.

Matt


On Thu, Apr 12, 2007 at 10:03:16AM -0400, Mark Heily wrote:
> Here is a corrected patch that fixes the segfault and correctly redraws the desktop image. This has 
> been tested with a Windows 2000 Server at 8bpp and a Windows 2003 server at 16bpp. 
> 
> Thanks to Mat G for his suggestion on how to fix my original patch.
> 
> -Mark
> 
> 
> --- ../rdesktop/xwin.c	2007-01-17 02:39:31.000000000 -0500
> +++ xwin.c	2007-04-12 09:51:46.000000000 -0400
> @@ -3218,7 +3218,7 @@
>  		return;
>  
>  	image = XCreateImage(g_display, g_visual, g_depth, ZPixmap, 0,
> -			     (char *) data, cx, cy, BitmapPad(g_display), cx * g_bpp / 8);
> +			     (char *) data, cx, cy, g_bpp, 0);
>  
>  	if (g_ownbackstore)
>  	{

> --- ../rdesktop/xwin.c	2007-01-17 02:39:31.000000000 -0500
> +++ xwin.c	2007-04-12 09:51:46.000000000 -0400
> @@ -3218,7 +3218,7 @@
>  		return;
>  
>  	image = XCreateImage(g_display, g_visual, g_depth, ZPixmap, 0,
> -			     (char *) data, cx, cy, BitmapPad(g_display), cx * g_bpp / 8);
> +			     (char *) data, cx, cy, g_bpp, 0);
>  
>  	if (g_ownbackstore)
>  	{

> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys-and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> rdesktop-devel mailing list
> rdesktop-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/rdesktop-devel

Message #51 received at 418098@bugs.debian.org (full text, mbox, reply):

From: Laszlo Boszormenyi <gcs@lsc.hu>

To: 418098@bugs.debian.org

Subject: rdesktop fix test

Date: Thu, 19 Apr 2007 18:16:37 +0200

Hi all of you!

 Can you please report back if rdesktop 1.5.0-2 fixes the crash on
startup due to the libx11-6 security fix?

Thanks,
Laszlo/GCS

Message #58 received at 418098@bugs.debian.org (full text, mbox, reply):

From: Olaf Zaplinski <o.zaplinski@broadnet.de>

To: Laszlo Boszormenyi <gcs@lsc.hu>

Cc: 418098@bugs.debian.org

Subject: Re: rdesktop fix test

Date: Fri, 20 Apr 2007 10:18:53 +0200

Hi Laszlo,

>  Can you please report back if rdesktop 1.5.0-2 fixes the crash on
> startup due to the libx11-6 security fix?

Where can I find 1.5.0-2 for Etch? apt-get update still reports 1.5.0-1.

Regards,
Olaf

Message #63 received at 418098@bugs.debian.org (full text, mbox, reply):

From: "Eric Covener" <covener@gmail.com>

To: 418098@bugs.debian.org

Subject: Re: rdesktop fix test

Date: Fri, 20 Apr 2007 22:27:33 -0400

On 4/19/07, Laszlo Boszormenyi <gcs@lsc.hu> wrote:
> Hi all of you!
>
>  Can you please report back if rdesktop 1.5.0-2 fixes the crash on
> startup due to the libx11-6 security fix?


Working for me:

$ dpkg -l rdesktop libx11-6
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Installed/Config-files/Unpacked/Failed-config/Half-installed
|/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad)
||/ Name                    Version                 Description
+++-=======================-=======================-==============================================================
ii  libx11-6                1.0.3-7                 X11 client-side library
ii  rdesktop                1.5.0-2                 RDP client for
Windows NT/2000 Terminal Server


-- 
Eric Covener
covener@gmail.com

Message #68 received at 418098@bugs.debian.org (full text, mbox, reply):

From: Paul Coray <paul.coray@unibas.ch>

To: 418098@bugs.debian.org

Subject: Re: rdesktop fix test

Date: Thu, 10 May 2007 13:36:51 +0200

rdesktop 1.5.0-2 fixes the crash for me too - but, installing on etch, 
apt asks for libc6 from unstable, which I wouldn't install. Guess some 
nasty things would happen...

# dpkg -i rdesktop_1.5.0-2_i386.deb
(Reading database ... 110653 files and directories currently installed.)
Preparing to replace rdesktop 1.5.0-1 (using rdesktop_1.5.0-2_i386.deb) ...
Unpacking replacement rdesktop ...
dpkg: dependency problems prevent configuration of rdesktop:
 rdesktop depends on libc6 (>= 2.5); however:
  Version of libc6 on system is 2.3.6.ds1-13.
dpkg: error processing rdesktop (--install):
 dependency problems - leaving unconfigured
Errors were encountered while processing:
 rdesktop

So, any chances rdesktop 1.5.0-2 will go to stable soon? We need to 
upgrade 6 Sarge-Teminalserver to Etch soon, and this is a real showstopper.

Greets
Paul

Message #73 received at 418098@bugs.debian.org (full text, mbox, reply):

From: Laszlo Boszormenyi <gcs@lsc.hu>

To: Paul Coray <paul.coray@unibas.ch>, 418098@bugs.debian.org

Subject: Re: Bug#418098: rdesktop fix test

Date: Thu, 10 May 2007 20:01:56 +0200

Hi Paul,

On Thu, 2007-05-10 at 13:36 +0200, Paul Coray wrote:
> rdesktop 1.5.0-2 fixes the crash for me too - but, installing on etch, 
> apt asks for libc6 from unstable, which I wouldn't install. Guess some 
> nasty things would happen...
 Yes, glibc changed since then in Sid. Please don't mix packages in Etch
and Sid!

> So, any chances rdesktop 1.5.0-2 will go to stable soon? We need to 
> upgrade 6 Sarge-Teminalserver to Etch soon, and this is a real showstopper.
 I have fixed rdesktop for Etch long ago; was accepted but don't know
when it will be released. I bet it will be in Etch r1 and not sooner.
I can supply i386 binaries until then if you need it. So upgrade your
Sarge boxes to Etch and then upgrade to binaries I give to you.

Cheers,
Laszlo/GCS

Message #80 received at 418098@bugs.debian.org (full text, mbox, reply):

From: Martin Steigerwald <ms@teamix.de>

To: 418098@bugs.debian.org

Subject: Fwd: etch backport of rdesktop to fix segfaults on login

Date: Tue, 15 May 2007 11:02:05 +0200

[Message part 1 (text/plain, inline)]

Hello!

For the time till a fixed version makes it to etch I made a backport of the 
fixed unstable version and put it online at:

http://people.teamix.org/~ms/backports/etch-backports/

----------  Forwarded message  ----------

Subject: etch backport of rdesktop to fix segfaults on login
Date: Dienstag, 15. Mai 2007 10:34
From: Martin Steigerwald <ms@teamix.de>
To: backports-users@lists.backports.org

Hello,

I created an etch backport of rdesktop in order to fix those nasty segaults
described in bugs #418907, #418098, #418907.

Did not have time to use pbuilder or such, but I made sure all required dev
packages are at etch versions and it looks like it didn't pull in any
additional dependencies.

I confirmed together with a colleague that the backport indeed fixes the
segfault.

The packages passes lintian tests.

Its only my second or third backport.

You can find it at:
http://people.teamix.org/~ms/backports/etch-backports/

As long as that fixed rdesktop version has not made it to debian etch it IMHO
is a quite good idea to provide a fixed backport for it.

If the backport needs some changes prior to being included in backports.org,
please let me know and I see what I can do. Could take some time cause lots
of other things to do.

Regards,
[...]

-------------------------------------------------------

Regards,
-- 
Martin Steigerwald - team(ix) GmbH - http://www.teamix.de
gpg: 19E3 8D42 896F D004 08AC A0CA 1E10 C593 0399 AE90

[Message part 2 (application/pgp-signature, inline)]

Message #85 received at 418098-done@bugs.debian.org (full text, mbox, reply):

From: Andreas Barth <aba@not.so.argh.org>

To: 418098-done@bugs.debian.org

Subject: fixed also by this upload

Date: Sun, 10 Jun 2007 08:46:04 +0200

Version: 1.5.0-2
-- 
  http://home.arcor.de/andreas-barth/

Message #115 received at 418098@bugs.debian.org (full text, mbox, reply):

From: "Chris geegan" <red_dragon_224@hotmail.com>

To: 418098@bugs.debian.org

Subject: rdesktop proposed patch

Date: Wed, 20 Jun 2007 18:12:39 -0500

I was also having the segfault issue with rdesktop 1.5.0-1etch1 on etch. I 
applied the proposed patch and it fixed the problem. However, now if my 
screensaver comes on while a session is open, i enter my password to unlock 
the screensaver and can move my mouse but not click on anything. I have to 
reboot the system from another tty screen. Not sure if this is a bug. If 
this is not the place for this can you point me in the right direction?

_________________________________________________________________
Like puzzles? Play free games & earn great prizes. Play Clink now. 
http://club.live.com/clink.aspx?icid=clink_hotmailtextlink2

Send a report that this bug log contains spam.