FreeRDP/FreeRDP — Issue #281: Segfault with bpp = 32, and fastpath disabled
Author: johneke
Created: 2011-12-16 15:13:16+00:00
State: open

Steps to reproduce:

./xfreerdp -a 32 --no-fastpath

Desktop connects, displays for a brief second, then crashes

Found in latest git pull as of 15th Dec, 2011

GDB and Valgrind backtraces (provided by Alexis Moinet)

(gdb) run -a 32 --no-fastpath -u username servername
Starting program: ./tmp/freerdp/builds/linux-x64-debug/client/X11/xfreerdp -a 32 --no-fastpath -u username servername
[Thread debugging using libthread_db enabled]
[New Thread 0x7ffff45d2700 (LWP 28504)]
connected to SERVERIP1
Password:
pduType bad
connected to SERVERIP2

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff45d2700 (LWP 28504)]
0x0000000000410731 in xf_Pointer_Set (context=0x6c9bb0, pointer=0x0) at ./tmp/freerdp/client/X11/xf_graphics.c:197
197 XDefineCursor(xfi->display, xfi->window->handle, ((xfPointer*) pointer)->cursor);
(gdb) bt
#0 0x0000000000410731 in xf_Pointer_Set (context=0x6c9bb0, pointer=0x0) at ./tmp/freerdp/client/X11/xf_graphics.c:197
#1 0x00007ffff739210d in Pointer_Set (context=0x6c9bb0, pointer=0x0) at ./tmp/freerdp/libfreerdp-core/graphics.c:117
#2 0x00007ffff61dc695 in update_pointer_cached (context=0x6c9bb0, pointer_cached=0x6b5ff0) at ./tmp/freerdp/libfreerdp-cache/pointer.c:71
#3 0x00007ffff73a2003 in update_recv_pointer (update=0x6b49c0, s=0x7854a0) at ./tmp/freerdp/libfreerdp-core/update.c:238
#4 0x00007ffff739bec5 in rdp_recv_data_pdu (rdp=0x6a65f0, s=0x7854a0) at ./tmp/freerdp/libfreerdp-core/rdp.c:462
#5 0x00007ffff739c2f8 in rdp_recv_tpkt_pdu (rdp=0x6a65f0, s=0x7854a0) at ./tmp/freerdp/libfreerdp-core/rdp.c:663
#6 0x00007ffff739c461 in rdp_recv_pdu (rdp=0x6a65f0, s=0x7854a0) at ./tmp/freerdp/libfreerdp-core/rdp.c:709
#7 0x00007ffff739c5e5 in rdp_recv_callback (transport=0x6a8390, s=0x7854a0, extra=0x6a65f0) at ./tmp/freerdp/libfreerdp-core/rdp.c:764
#8 0x00007ffff73a0f7e in transport_check_fds (transport=0x6a8390) at ./tmp/freerdp/libfreerdp-core/transport.c:350
#9 0x00007ffff739c6c8 in rdp_check_fds (rdp=0x6a65f0) at ./tmp/freerdp/libfreerdp-core/rdp.c:795
#10 0x00007ffff7391b8a in freerdp_check_fds (instance=0x6a6460) at ./tmp/freerdp/libfreerdp-core/freerdp.c:122
#11 0x000000000041578e in xfreerdp_run (instance=0x6a6460) at ./tmp/freerdp/client/X11/xfreerdp.c:972
#12 0x00000000004158af in thread_func (param=0x6ca880) at ./tmp/freerdp/client/X11/xfreerdp.c:1009
#13 0x00007ffff53929ca in start_thread (arg=) at pthread_create.c:300
#14 0x00007ffff50ef70d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#15 0x0000000000000000 in ?? ()

valgrind report doesn't say more :

==31474== Invalid read of size 8
==31474== at 0x410731: xf_Pointer_Set (xf_graphics.c:197)
==31474== by 0x568410C: Pointer_Set (graphics.c:117)
==31474== by 0x682B694: update_pointer_cached (pointer.c:71)
==31474== by 0x5694002: update_recv_pointer (update.c:238)
==31474== by 0x568DEC4: rdp_recv_data_pdu (rdp.c:462)
==31474== by 0x568E2F7: rdp_recv_tpkt_pdu (rdp.c:663)
==31474== by 0x568E460: rdp_recv_pdu (rdp.c:709)
==31474== by 0x568E5E4: rdp_recv_callback (rdp.c:764)
==31474== by 0x5692F7D: transport_check_fds (transport.c:350)
==31474== by 0x568E6C7: rdp_check_fds (rdp.c:795)
==31474== by 0x5683B89: freerdp_check_fds (freerdp.c:122)
==31474== by 0x41578D: xfreerdp_run (xfreerdp.c:972)
==31474== Address 0xa0 is not stack'd, malloc'd or (recently) free'd