<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Package: libnx-X11<br>
<br>
Version: 2.3.5<br>
<br>
Setup:<br>
<ol>
<li>x2goserver in a debian testing machine.</li>
<li>x2goclient in a windows machine.</li>
<li>Create a session with a virtual desktop.</li>
<li>Run gedit in the session created in 3.<br>
</li>
<li>Create a session in windows launching only xterm.</li>
<li>Run gedit from the console created in 5.<br>
</li>
<li>Create a session in windows launching only gedit.</li>
</ol>
<p>Results:<br>
</p>
<ol>
<li>Steps from Setup 3, 4 and 5 work fine.</li>
<li>Steps from Setup 6 and 7 crash (close the session).</li>
</ol>
<p><br>
A quick look in dmesg shows that <b>libNX_X11.so.6.2</b> caused a
SEGFAULT.<br>
</p>
<p>Running x2goagent with a debugger gives the following backtrace:<br>
</p>
<font face="monospace"><font face="Courier 10 Pitch"><b>(gdb)
backtrace</b><br>
#0 _XData32 (dpy=dpy@entry=0xf591b0, data=data@entry=0x163c2c4,
len=len@entry=18652) at XlibInt.c:3775<br>
#1 0x00007f759e34dce1 in XChangeProperty (dpy=0xf591b0,
w=<optimized out>, property=<optimized out>, type=6,
format=<optimized out>, mode=<optimized out>,<br>
data=0x163c2c4
"\377\377\377\377\354\356\356\377\377\377\377\377\354\356\356\377\377\377\377\377\354\356\356\377\377\377\377\377\357\360\360\377\377\377\377\377\364\365\365\377\377\377\377\377\307\312\311\375\377\377\377\377\t\t\t\035",
nelements=4663) at ChProp.c:85<br>
#2 0x00000000004b1e37 in nxagentExportProperty (pWin=0x20,
property=<b>4663</b>, type=23315140, format=4669, mode=32,
nUnits=<b>4663</b>, value=0x15fc2e0) at Rootless.c:763<br>
#3 0x000000000042222a in ProcChangeProperty (client=0xf591b0)
at X/NXproperty.c:331<br>
#4 0x000000000042eea2 in Dispatch () at X/NXdispatch.c:748</font><br>
</font><br>
Looking at the highlighted values, it seems that gedit is sending a
malformed ChangeProperty request, and rootless is failing to process
it.<br>
<br>
Specifically the segment between lines 735-780, tries to set a
property that is bigger than the maximum size required, but because
it's a malformed request it ends up writing in memory outside the
boundaries of the output buffer.<br>
<br>
Alternatives:<br>
<ol>
<li>Ensure that nxagentExportProperty never writes beyond the
boundaries of the output buffer.</li>
<li>Resize the output buffer to match the required size
(ProcChangeProperty seems to do something similar).</li>
<li>Ignore big requests (see attached patch).</li>
</ol>
<br>
<div class="moz-signature">-- <br>
<style type="text/css"> body {font: 12pt Helvetica, Arial;} </style>
<small><tt>
</tt></small><br>
</div>
</body>
</html>