From unknown Sat Apr 04 08:35:19 2026
X-Loop: owner@bugs.x2go.org
Subject: Bug#900: Gedit, gnome-terminal and others crash in rootless mode
Reply-To: Camilo Alejandro Arboleda <camilo@ieee.org>, 900@bugs.x2go.org
Resent-From: Camilo Alejandro Arboleda <camilo@ieee.org>
Resent-To: x2go-dev@lists.x2go.org
Resent-CC: X2Go Developers <x2go-dev@lists.x2go.org>
X-Loop: owner@bugs.x2go.org
Resent-Date: Thu, 02 Jul 2015 06:25:02 +0000
Resent-Message-ID: <handler.900.B.143581808619377@bugs.x2go.org>
Resent-Sender: owner@bugs.x2go.org
X-X2Go-PR-Message: report 900
X-X2Go-PR-Package: libnx-x11
X-X2Go-PR-Keywords: 
Received: via spool by submit@bugs.x2go.org id=B.143581808619377
          (code B); Thu, 02 Jul 2015 06:25:02 +0000
Received: (at submit) by bugs.x2go.org; 2 Jul 2015 06:21:26 +0000
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=1.0 required=5.0 tests=BAYES_20,HTML_FONT_FACE_BAD,
	HTML_MESSAGE autolearn=no version=3.3.2
Received: from mail-wg0-f52.google.com (mail-wg0-f52.google.com [74.125.82.52])
	by ymir.das-netzwerkteam.de (Postfix) with ESMTPS id 3C03B5DA86
	for <submit@bugs.x2go.org>; Thu,  2 Jul 2015 08:21:25 +0200 (CEST)
Received: by wgqq4 with SMTP id q4so53940904wgq.1
        for <submit@bugs.x2go.org>; Wed, 01 Jul 2015 23:21:25 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to
         :subject:content-type;
        bh=XYKETiVk9VA55/yM2iEM9mvXwhZpR1skDeTjSQ6a8+4=;
        b=efFOPt26fQy14xt1fy5x3JNoFffjEQdbwNNYB3VJ/hvSvZIICDs0TKKdX0ZE9l+dYa
         GxYxCBp1zkG29vmBWDPH7Z6i9Cbr9NCn5IMYM9lQNtjrRlIprr8P1cvzA5207cIZCuiF
         pkAXnD6qCKVJ0FN6rDePbXq/GDk+Iu6HR7tbw0ifVbjxoYIKflDjumEGyO5hkDFsFvRH
         o6zAMM7q+npYBFDCu7LaHFXb8UB9X7L1WREAYsVquTJF3oCKWd3NQAQqmBoM7mbyCrRI
         e066e8JG0KgHYfgGrzmK1nIfwHfHUFJ+ZB8O2M4dE7TNhb+QjxRWjDYGHiSr5LFcn+QA
         S8Qw==
X-Gm-Message-State: ALoCoQlie1yzZY0VvLOKgNSGHp58hIc10c40zBO1TuBMvqOrKKyzV2DFTnpbjyxMEVeRlmBHApAP
X-Received: by 10.180.91.100 with SMTP id cd4mr50381152wib.1.1435818084955;
        Wed, 01 Jul 2015 23:21:24 -0700 (PDT)
Received: from [192.168.2.2] (h-136-31.a336.priv.bahnhof.se. [176.10.136.31])
        by mx.google.com with ESMTPSA id gw7sm25396419wib.15.2015.07.01.23.21.23
        (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Wed, 01 Jul 2015 23:21:24 -0700 (PDT)
Message-ID: <5594D862.70701@ieee.org>
Date: Thu, 02 Jul 2015 08:21:22 +0200
From: Camilo Alejandro Arboleda <camilo@ieee.org>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0
MIME-Version: 1.0
To: submit@bugs.x2go.org
Content-Type: multipart/mixed;
 boundary="------------050906010407070406090707"

This is a multi-part message in MIME format.
--------------050906010407070406090707
Content-Type: multipart/alternative;
 boundary="------------030304030007030908050006"


--------------030304030007030908050006
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Package: libnx-X11

Version: 2.3.5

Setup:

 1. x2goserver in a debian testing machine.
 2. x2goclient in a windows machine.
 3. Create a session with a virtual desktop.
 4. Run gedit in the session created in 3.
 5. Create a session in windows launching only xterm.
 6. Run gedit from the console created in 5.
 7. Create a session in windows launching only gedit.

Results:

 1. Steps from Setup 3, 4 and 5 work fine.
 2. Steps from Setup 6 and 7 crash (close the session).


A quick look in dmesg shows that *libNX_X11.so.6.2* caused a SEGFAULT.

Running x2goagent with a debugger gives the following backtrace:

*(gdb) backtrace*
#0  _XData32 (dpy=3Ddpy@entry=3D0xf591b0, data=3Ddata@entry=3D0x163c2c4,
len=3Dlen@entry=3D18652) at XlibInt.c:3775
#1  0x00007f759e34dce1 in XChangeProperty (dpy=3D0xf591b0, w=3D<optimized=

out>, property=3D<optimized out>, type=3D6, format=3D<optimized out>,
mode=3D<optimized out>,
    data=3D0x163c2c4
"\377\377\377\377\354\356\356\377\377\377\377\377\354\356\356\377\377\377=
\377\377\354\356\356\377\377\377\377\377\357\360\360\377\377\377\377\377\=
364\365\365\377\377\377\377\377\307\312\311\375\377\377\377\377\t\t\t\035=
",
nelements=3D4663) at ChProp.c:85
#2  0x00000000004b1e37 in nxagentExportProperty (pWin=3D0x20,
property=3D*4663*, type=3D23315140, format=3D4669, mode=3D32, nUnits=3D*4=
663*,
value=3D0x15fc2e0) at Rootless.c:763
#3  0x000000000042222a in ProcChangeProperty (client=3D0xf591b0) at
X/NXproperty.c:331
#4  0x000000000042eea2 in Dispatch () at X/NXdispatch.c:748

Looking at the highlighted values, it seems that gedit is sending a
malformed ChangeProperty request, and rootless is failing to process it.

Specifically the segment between lines 735-780, tries to set a property
that is bigger than the maximum size required, but because it's a
malformed request it ends up writing in memory outside the boundaries of
the output buffer.

Alternatives:

 1. Ensure that nxagentExportProperty never writes beyond the boundaries
    of the output buffer.
 2. Resize the output buffer to match the required size
    (ProcChangeProperty seems to do something similar).
 3. Ignore big requests (see attached patch).


--=20


--------------030304030007030908050006
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit

<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=utf-8">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    Package: libnx-X11<br>
    <br>
    Version: 2.3.5<br>
    <br>
    Setup:<br>
    <ol>
      <li>x2goserver in a debian testing machine.</li>
      <li>x2goclient in a windows machine.</li>
      <li>Create a session with a virtual desktop.</li>
      <li>Run gedit in the session created in 3.<br>
      </li>
      <li>Create a session in windows launching only xterm.</li>
      <li>Run gedit from the console created in 5.<br>
      </li>
      <li>Create a session in windows launching only gedit.</li>
    </ol>
    <p>Results:<br>
    </p>
    <ol>
      <li>Steps from Setup 3, 4 and 5 work fine.</li>
      <li>Steps from Setup 6 and 7 crash (close the session).</li>
    </ol>
    <p><br>
      A quick look in dmesg shows that <b>libNX_X11.so.6.2</b> caused a
      SEGFAULT.<br>
    </p>
    <p>Running x2goagent with a debugger gives the following backtrace:<br>
    </p>
    <font face="monospace"><font face="Courier 10 Pitch"><b>(gdb)
          backtrace</b><br>
        #0  _XData32 (dpy=dpy@entry=0xf591b0, data=data@entry=0x163c2c4,
        len=len@entry=18652) at XlibInt.c:3775<br>
        #1  0x00007f759e34dce1 in XChangeProperty (dpy=0xf591b0,
        w=&lt;optimized out&gt;, property=&lt;optimized out&gt;, type=6,
        format=&lt;optimized out&gt;, mode=&lt;optimized out&gt;,<br>
            data=0x163c2c4
        "\377\377\377\377\354\356\356\377\377\377\377\377\354\356\356\377\377\377\377\377\354\356\356\377\377\377\377\377\357\360\360\377\377\377\377\377\364\365\365\377\377\377\377\377\307\312\311\375\377\377\377\377\t\t\t\035",
        nelements=4663) at ChProp.c:85<br>
        #2  0x00000000004b1e37 in nxagentExportProperty (pWin=0x20,
        property=<b>4663</b>, type=23315140, format=4669, mode=32,
        nUnits=<b>4663</b>, value=0x15fc2e0) at Rootless.c:763<br>
        #3  0x000000000042222a in ProcChangeProperty (client=0xf591b0)
        at X/NXproperty.c:331<br>
        #4  0x000000000042eea2 in Dispatch () at X/NXdispatch.c:748</font><br>
    </font><br>
    Looking at the highlighted values, it seems that gedit is sending a
    malformed ChangeProperty request, and rootless is failing to process
    it.<br>
    <br>
    Specifically the segment between lines 735-780, tries to set a
    property that is bigger than the maximum size required, but because
    it's a malformed request it ends up writing in memory outside the
    boundaries of the output buffer.<br>
    <br>
    Alternatives:<br>
    <ol>
      <li>Ensure that nxagentExportProperty never writes beyond the
        boundaries of the output buffer.</li>
      <li>Resize the output buffer to match the required size
        (ProcChangeProperty seems to do something similar).</li>
      <li>Ignore big requests (see attached patch).</li>
    </ol>
    <br>
    <div class="moz-signature">-- <br>
      <style type="text/css"> body {font: 12pt Helvetica, Arial;} </style>
      <small><tt>
        </tt></small><br>
    </div>
  </body>
</html>

--------------030304030007030908050006--

--------------050906010407070406090707
Content-Type: text/x-patch;
 name="fail_on_big_requests.patch"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
 filename="fail_on_big_requests.patch"

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Rootless.c b/nx-X11/progr=
ams/Xserver/hw/nxagent/Rootless.c
index 74d2d1f..7bdb190 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Rootless.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Rootless.c
@@ -738,36 +738,6 @@ int nxagentExportProperty(pWin, property, type, form=
at, mode, nUnits, value)
         XChangeProperty(nxagentDisplay, nxagentWindow(pWin), propertyX, =
typeX,
                             format, mode, (void*)output, nUnits);
       }
-      else if (mode =3D=3D PropModeReplace)
-      {
-        int n;
-        char *data;
-
-        XDeleteProperty(nxagentDisplay, nxagentWindow(pWin), propertyX);=

-
-        data =3D (char *) output;
-
-        while (nUnits > 0)
-        {
-          if ((format >> 3) * nUnits + sizeof(xChangePropertyReq) <
-                  (MAX_REQUEST_SIZE << 2))
-          {
-            n =3D nUnits;
-          }
-          else
-          {
-            n =3D ((MAX_REQUEST_SIZE << 2) - sizeof(xChangePropertyReq))=
 /
-                    (format >> 3);
-          }
-
-          XChangeProperty(nxagentDisplay, nxagentWindow(pWin), propertyX=
,
-                              typeX, format, PropModeAppend, (void*) dat=
a, n);
-
-          nUnits -=3D n;
-
-          data =3D (char *) data + n * (format >> 3);
-        }
-      }
       else
       {
         #ifdef WARNING

--------------050906010407070406090707--