Subject: Bug#900 closed by Stefan Baur <[email-masked]> (Closing)

From: [email-masked] (X2Go Bug Tracking System)
Date: Fri, 19 Jan 2024 20:05:02 +0000

This is an automatic notification regarding your Bug report
which was filed against the libnx-x11 package:

#900: Gedit, gnome-terminal and others crash in rootless mode

It has been closed by Stefan Baur <[email-masked]>.

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact Stefan Baur <[email-masked]> by
replying to this email.

-- 
878: https://bugs.x2go.org/cgi-bin/bugreport.cgi?bug=878
X2Go Bug Tracking System
Contact [email-masked] with problems

Subject: Closing
From: Stefan Baur <[email-masked]>
To: [email-masked]
Date: Fri, 19 Jan 2024 21:04:26 +0100

Control: close -1
Control: archive -1

-- 
BAUR-ITCS UG (haftungsbeschränkt)
Geschäftsführer: Stefan Baur
Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364
Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243

Subject: Gedit, gnome-terminal and others crash in rootless mode
From: Camilo Alejandro Arboleda <[email-masked]>
To: [email-masked]
Date: Thu, 02 Jul 2015 08:21:22 +0200

Package: libnx-X11

Version: 2.3.5

Setup:

 1. x2goserver in a debian testing machine.
 2. x2goclient in a windows machine.
 3. Create a session with a virtual desktop.
 4. Run gedit in the session created in 3.
 5. Create a session in windows launching only xterm.
 6. Run gedit from the console created in 5.
 7. Create a session in windows launching only gedit.

Results:

 1. Steps from Setup 3, 4 and 5 work fine.
 2. Steps from Setup 6 and 7 crash (close the session).

A quick look in dmesg shows that *libNX_X11.so.6.2* caused a SEGFAULT.

Running x2goagent with a debugger gives the following backtrace:

*(gdb) backtrace*
#0  _XData32 (dpy=dpy@entry=0xf591b0, data=data@entry=0x163c2c4,
len=len@entry=18652) at XlibInt.c:3775
#1  0x00007f759e34dce1 in XChangeProperty (dpy=0xf591b0, w=<optimized
out>, property=<optimized out>, type=6, format=<optimized out>,
mode=<optimized out>,
    data=0x163c2c4
"\377\377\377\377\354\356\356\377\377\377\377\377\354\356\356\377\377\377\377\377\354\356\356\377\377\377\377\377\357\360\360\377\377\377\377\377\364\365\365\377\377\377\377\377\307\312\311\375\377\377\377\377\t\t\t\035",
nelements=4663) at ChProp.c:85
#2  0x00000000004b1e37 in nxagentExportProperty (pWin=0x20,
property=*4663*, type=23315140, format=4669, mode=32, nUnits=*4663*,
value=0x15fc2e0) at Rootless.c:763
#3  0x000000000042222a in ProcChangeProperty (client=0xf591b0) at
X/NXproperty.c:331
#4  0x000000000042eea2 in Dispatch () at X/NXdispatch.c:748

Looking at the highlighted values, it seems that gedit is sending a
malformed ChangeProperty request, and rootless is failing to process it.

Specifically the segment between lines 735-780, tries to set a property
that is bigger than the maximum size required, but because it's a
malformed request it ends up writing in memory outside the boundaries of
the output buffer.

Alternatives:

 1. Ensure that nxagentExportProperty never writes beyond the boundaries
    of the output buffer.
 2. Resize the output buffer to match the required size
    (ProcChangeProperty seems to do something similar).
 3. Ignore big requests (see attached patch).

-- 

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Rootless.c b/nx-X11/programs/Xserver/hw/nxagent/Rootless.c
index 74d2d1f..7bdb190 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Rootless.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Rootless.c
@@ -738,36 +738,6 @@ int nxagentExportProperty(pWin, property, type, format, mode, nUnits, value)
         XChangeProperty(nxagentDisplay, nxagentWindow(pWin), propertyX, typeX,
                             format, mode, (void*)output, nUnits);
       }
-      else if (mode == PropModeReplace)
-      {
-        int n;
-        char *data;
-
-        XDeleteProperty(nxagentDisplay, nxagentWindow(pWin), propertyX);
-
-        data = (char *) output;
-
-        while (nUnits > 0)
-        {
-          if ((format >> 3) * nUnits + sizeof(xChangePropertyReq) <
-                  (MAX_REQUEST_SIZE << 2))
-          {
-            n = nUnits;
-          }
-          else
-          {
-            n = ((MAX_REQUEST_SIZE << 2) - sizeof(xChangePropertyReq)) /
-                    (format >> 3);
-          }
-
-          XChangeProperty(nxagentDisplay, nxagentWindow(pWin), propertyX,
-                              typeX, format, PropModeAppend, (void*) data, n);
-
-          nUnits -= n;
-
-          data = (char *) data + n * (format >> 3);
-        }
-      }
       else
       {
         #ifdef WARNING