X2Go Bug report logs - #900
Gedit, gnome-terminal and others crash in rootless mode

Full log

Message #5 received at submit@bugs.x2go.org (full text, mbox, reply):

Received: (at submit) by bugs.x2go.org; 2 Jul 2015 06:21:26 +0000
From camilo@ieee.org  Thu Jul  2 08:21:25 2015
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=1.0 required=5.0 tests=BAYES_20,HTML_FONT_FACE_BAD,
	HTML_MESSAGE autolearn=no version=3.3.2
Received: from mail-wg0-f52.google.com (mail-wg0-f52.google.com [74.125.82.52])
	by ymir.das-netzwerkteam.de (Postfix) with ESMTPS id 3C03B5DA86
	for <submit@bugs.x2go.org>; Thu,  2 Jul 2015 08:21:25 +0200 (CEST)
Received: by wgqq4 with SMTP id q4so53940904wgq.1
        for <submit@bugs.x2go.org>; Wed, 01 Jul 2015 23:21:25 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to
         :subject:content-type;
        bh=XYKETiVk9VA55/yM2iEM9mvXwhZpR1skDeTjSQ6a8+4=;
        b=efFOPt26fQy14xt1fy5x3JNoFffjEQdbwNNYB3VJ/hvSvZIICDs0TKKdX0ZE9l+dYa
         GxYxCBp1zkG29vmBWDPH7Z6i9Cbr9NCn5IMYM9lQNtjrRlIprr8P1cvzA5207cIZCuiF
         pkAXnD6qCKVJ0FN6rDePbXq/GDk+Iu6HR7tbw0ifVbjxoYIKflDjumEGyO5hkDFsFvRH
         o6zAMM7q+npYBFDCu7LaHFXb8UB9X7L1WREAYsVquTJF3oCKWd3NQAQqmBoM7mbyCrRI
         e066e8JG0KgHYfgGrzmK1nIfwHfHUFJ+ZB8O2M4dE7TNhb+QjxRWjDYGHiSr5LFcn+QA
         S8Qw==
X-Gm-Message-State: ALoCoQlie1yzZY0VvLOKgNSGHp58hIc10c40zBO1TuBMvqOrKKyzV2DFTnpbjyxMEVeRlmBHApAP
X-Received: by 10.180.91.100 with SMTP id cd4mr50381152wib.1.1435818084955;
        Wed, 01 Jul 2015 23:21:24 -0700 (PDT)
Received: from [192.168.2.2] (h-136-31.a336.priv.bahnhof.se. [176.10.136.31])
        by mx.google.com with ESMTPSA id gw7sm25396419wib.15.2015.07.01.23.21.23
        (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Wed, 01 Jul 2015 23:21:24 -0700 (PDT)
Message-ID: <5594D862.70701@ieee.org>
Date: Thu, 02 Jul 2015 08:21:22 +0200
From: Camilo Alejandro Arboleda <camilo@ieee.org>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0
MIME-Version: 1.0
To: submit@bugs.x2go.org
Subject: Gedit, gnome-terminal and others crash in rootless mode
Content-Type: multipart/mixed;
 boundary="------------050906010407070406090707"

[Message part 1 (text/plain, inline)]

Package: libnx-X11

Version: 2.3.5

Setup:

 1. x2goserver in a debian testing machine.
 2. x2goclient in a windows machine.
 3. Create a session with a virtual desktop.
 4. Run gedit in the session created in 3.
 5. Create a session in windows launching only xterm.
 6. Run gedit from the console created in 5.
 7. Create a session in windows launching only gedit.

Results:

 1. Steps from Setup 3, 4 and 5 work fine.
 2. Steps from Setup 6 and 7 crash (close the session).


A quick look in dmesg shows that *libNX_X11.so.6.2* caused a SEGFAULT.

Running x2goagent with a debugger gives the following backtrace:

*(gdb) backtrace*
#0  _XData32 (dpy=dpy@entry=0xf591b0, data=data@entry=0x163c2c4,
len=len@entry=18652) at XlibInt.c:3775
#1  0x00007f759e34dce1 in XChangeProperty (dpy=0xf591b0, w=<optimized
out>, property=<optimized out>, type=6, format=<optimized out>,
mode=<optimized out>,
    data=0x163c2c4
"\377\377\377\377\354\356\356\377\377\377\377\377\354\356\356\377\377\377\377\377\354\356\356\377\377\377\377\377\357\360\360\377\377\377\377\377\364\365\365\377\377\377\377\377\307\312\311\375\377\377\377\377\t\t\t\035",
nelements=4663) at ChProp.c:85
#2  0x00000000004b1e37 in nxagentExportProperty (pWin=0x20,
property=*4663*, type=23315140, format=4669, mode=32, nUnits=*4663*,
value=0x15fc2e0) at Rootless.c:763
#3  0x000000000042222a in ProcChangeProperty (client=0xf591b0) at
X/NXproperty.c:331
#4  0x000000000042eea2 in Dispatch () at X/NXdispatch.c:748

Looking at the highlighted values, it seems that gedit is sending a
malformed ChangeProperty request, and rootless is failing to process it.

Specifically the segment between lines 735-780, tries to set a property
that is bigger than the maximum size required, but because it's a
malformed request it ends up writing in memory outside the boundaries of
the output buffer.

Alternatives:

 1. Ensure that nxagentExportProperty never writes beyond the boundaries
    of the output buffer.
 2. Resize the output buffer to match the required size
    (ProcChangeProperty seems to do something similar).
 3. Ignore big requests (see attached patch).


-- 

[Message part 2 (text/html, inline)]

[fail_on_big_requests.patch (text/x-patch, attachment)]

Send a report that this bug log contains spam.