X2Go Bug report logs - #900
Gedit, gnome-terminal and others crash in rootless mode

Package: libnx-x11; Maintainer for libnx-x11 is X2Go Developers <x2go-dev@lists.x2go.org>; Source for libnx-x11 is src:nx-libs.

Reported by: Camilo Alejandro Arboleda <camilo@ieee.org>

Date: Thu, 2 Jul 2015 06:25:02 UTC

Severity: normal

Tags: patch

Merged with 878, 956

Forwarded to https://github.com/ArcticaProject/nx-libs/issues/82

Full log

Message #5 received at submit@bugs.x2go.org (full text, mbox, reply):

Received: (at submit) by bugs.x2go.org; 2 Jul 2015 06:21:26 +0000
From camilo@ieee.org  Thu Jul  2 08:21:25 2015
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
X-Spam-Status: No, score=1.0 required=5.0 tests=BAYES_20,HTML_FONT_FACE_BAD,
	HTML_MESSAGE autolearn=no version=3.3.2
Received: from mail-wg0-f52.google.com (mail-wg0-f52.google.com [])
	by ymir.das-netzwerkteam.de (Postfix) with ESMTPS id 3C03B5DA86
	for <submit@bugs.x2go.org>; Thu,  2 Jul 2015 08:21:25 +0200 (CEST)
Received: by wgqq4 with SMTP id q4so53940904wgq.1
        for <submit@bugs.x2go.org>; Wed, 01 Jul 2015 23:21:25 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
X-Gm-Message-State: ALoCoQlie1yzZY0VvLOKgNSGHp58hIc10c40zBO1TuBMvqOrKKyzV2DFTnpbjyxMEVeRlmBHApAP
X-Received: by with SMTP id cd4mr50381152wib.1.1435818084955;
        Wed, 01 Jul 2015 23:21:24 -0700 (PDT)
Received: from [] (h-136-31.a336.priv.bahnhof.se. [])
        by mx.google.com with ESMTPSA id gw7sm25396419wib.15.2015.
        (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Wed, 01 Jul 2015 23:21:24 -0700 (PDT)
Message-ID: <5594D862.70701@ieee.org>
Date: Thu, 02 Jul 2015 08:21:22 +0200
From: Camilo Alejandro Arboleda <camilo@ieee.org>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0
MIME-Version: 1.0
To: submit@bugs.x2go.org
Subject: Gedit, gnome-terminal and others crash in rootless mode
Content-Type: multipart/mixed;
[Message part 1 (text/plain, inline)]
Package: libnx-X11

Version: 2.3.5


 1. x2goserver in a debian testing machine.
 2. x2goclient in a windows machine.
 3. Create a session with a virtual desktop.
 4. Run gedit in the session created in 3.
 5. Create a session in windows launching only xterm.
 6. Run gedit from the console created in 5.
 7. Create a session in windows launching only gedit.


 1. Steps from Setup 3, 4 and 5 work fine.
 2. Steps from Setup 6 and 7 crash (close the session).

A quick look in dmesg shows that *libNX_X11.so.6.2* caused a SEGFAULT.

Running x2goagent with a debugger gives the following backtrace:

*(gdb) backtrace*
#0  _XData32 (dpy=dpy@entry=0xf591b0, data=data@entry=0x163c2c4,
len=len@entry=18652) at XlibInt.c:3775
#1  0x00007f759e34dce1 in XChangeProperty (dpy=0xf591b0, w=<optimized
out>, property=<optimized out>, type=6, format=<optimized out>,
mode=<optimized out>,
nelements=4663) at ChProp.c:85
#2  0x00000000004b1e37 in nxagentExportProperty (pWin=0x20,
property=*4663*, type=23315140, format=4669, mode=32, nUnits=*4663*,
value=0x15fc2e0) at Rootless.c:763
#3  0x000000000042222a in ProcChangeProperty (client=0xf591b0) at
#4  0x000000000042eea2 in Dispatch () at X/NXdispatch.c:748

Looking at the highlighted values, it seems that gedit is sending a
malformed ChangeProperty request, and rootless is failing to process it.

Specifically the segment between lines 735-780, tries to set a property
that is bigger than the maximum size required, but because it's a
malformed request it ends up writing in memory outside the boundaries of
the output buffer.


 1. Ensure that nxagentExportProperty never writes beyond the boundaries
    of the output buffer.
 2. Resize the output buffer to match the required size
    (ProcChangeProperty seems to do something similar).
 3. Ignore big requests (see attached patch).


[Message part 2 (text/html, inline)]
[fail_on_big_requests.patch (text/x-patch, attachment)]

Send a report that this bug log contains spam.

X2Go Developers <owner@bugs.x2go.org>. Last modified: Tue Dec 5 11:15:54 2023; Machine Name: ymir.das-netzwerkteam.de

X2Go Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.