FS#68169 - [libvncserver] crashes in rfbSendRectEncodingZlib

Attached to Project: Arch Linux
Opened by M. Greyson Christoforo (greyltc) - Friday, 09 October 2020, 18:26 GMT
Last edited by Balló György (City-busz) - Thursday, 08 June 2023, 22:24 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Felix Yan (felixonmars)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

There seems to be a bug in the stable release of libvncserver. I run into this bug when I'm trying to use gnome-remote-desktop today.


Here's a journal snippet with coredump when I get the crash:
```
Oct 09 18:04:59 measurebox systemd[901]: gnome-remote-desktop.service: Main process exited, code=dumped, status=11/SEGV
Oct 09 18:04:59 measurebox systemd[901]: gnome-remote-desktop.service: Failed with result 'core-dump'.
Oct 09 18:04:59 measurebox systemd-coredump[2305]: [🡕] Process 2290 (gnome-remote-de) of user 1001 dumped core.

Stack trace of thread 2290:
#0 0x00007f43417875d5 realloc (libc.so.6 + 0x8c5d5)
#1 0x00007f4341a7cafd rfbSendRectEncodingZlib (libvncserver.so.1 + 0x27afd)
#2 0x00007f4341a67d3a rfbSendFramebufferUpdate (libvncserver.so.1 + 0x12d3a)
#3 0x00007f4341a62257 rfbUpdateClient (libvncserver.so.1 + 0xd257)
#4 0x00007f4341a622d1 rfbProcessEvents (libvncserver.so.1 + 0xd2d1)
#5 0x000055890b8f9c04 n/a (gnome-remote-desktop-daemon + 0x13c04)
#6 0x00007f4341c4146a n/a (libgio-2.0.so.0 + 0x8d46a)
#7 0x00007f4341dc2924 g_main_context_dispatch (libglib-2.0.so.0 + 0x52924)
#8 0x00007f4341e16621 n/a (libglib-2.0.so.0 + 0xa6621)
#9 0x00007f4341dc1131 g_main_context_iteration (libglib-2.0.so.0 + 0x51131)
#10 0x00007f4341c80d1e g_application_run (libgio-2.0.so.0 + 0xccd1e)
#11 0x000055890b8ec243 n/a (gnome-remote-desktop-daemon + 0x6243)
#12 0x00007f4341723152 __libc_start_main (libc.so.6 + 0x28152)
#13 0x000055890b8ec30e n/a (gnome-remote-desktop-daemon + 0x630e)

Stack trace of thread 2296:
#0 0x00007f43417f046f __poll (libc.so.6 + 0xf546f)
#1 0x00007f4341e165af n/a (libglib-2.0.so.0 + 0xa65af)
#2 0x00007f4341dc1e73 g_main_loop_run (libglib-2.0.so.0 + 0x51e73)
#3 0x00007f4341cb5fe8 n/a (libgio-2.0.so.0 + 0x101fe8)
#4 0x00007f4341defd21 n/a (libglib-2.0.so.0 + 0x7fd21)
#5 0x00007f43416e23e9 start_thread (libpthread.so.0 + 0x93e9)
#6 0x00007f43417fb293 __clone (libc.so.6 + 0x100293)

Stack trace of thread 2294:
#0 0x00007f43417f046f __poll (libc.so.6 + 0xf546f)
#1 0x00007f4341e165af n/a (libglib-2.0.so.0 + 0xa65af)
#2 0x00007f4341dc1131 g_main_context_iteration (libglib-2.0.so.0 + 0x51131)
#3 0x00007f4341dc1182 n/a (libglib-2.0.so.0 + 0x51182)
#4 0x00007f4341defd21 n/a (libglib-2.0.so.0 + 0x7fd21)
#5 0x00007f43416e23e9 start_thread (libpthread.so.0 + 0x93e9)
#6 0x00007f43417fb293 __clone (libc.so.6 + 0x100293)

Stack trace of thread 2295:
#0 0x00007f43417f046f __poll (libc.so.6 + 0xf546f)
#1 0x00007f4341e165af n/a (libglib-2.0.so.0 + 0xa65af)
#2 0x00007f4341dc1131 g_main_context_iteration (libglib-2.0.so.0 + 0x51131)
#3 0x00007f434215ec0e n/a (libdconfsettings.so + 0x5c0e)
#4 0x00007f4341defd21 n/a (libglib-2.0.so.0 + 0x7fd21)
#5 0x00007f43416e23e9 start_thread (libpthread.so.0 + 0x93e9)
#6 0x00007f43417fb293 __clone (libc.so.6 + 0x100293)

Stack trace of thread 2298:
#0 0x00007f43417f5d5d syscall (libc.so.6 + 0xfad5d)
#1 0x00007f4341e10b2b g_cond_wait_until (libglib-2.0.so.0 + 0xa0b2b)
#2 0x00007f4341d92813 n/a (libglib-2.0.so.0 + 0x22813)
#3 0x00007f4341d929a4 g_async_queue_timeout_pop (libglib-2.0.so.0 + 0x229a4)
#4 0x00007f4341df2c7a n/a (libglib-2.0.so.0 + 0x82c7a)
#5 0x00007f4341defd21 n/a (libglib-2.0.so.0 + 0x7fd21)
#6 0x00007f43416e23e9 start_thread (libpthread.so.0 + 0x93e9)
#7 0x00007f43417fb293 __clone (libc.so.6 + 0x100293)

Stack trace of thread 2303:
#0 0x00007f43417fb5de epoll_wait (libc.so.6 + 0x1005de)
#1 0x00007f43394d2fc1 n/a (libspa-support.so + 0xffc1)
#2 0x00007f43394ca2f4 n/a (libspa-support.so + 0x72f4)
#3 0x00007f4341ae2fb0 n/a (libpipewire-0.3.so.0 + 0x26fb0)
#4 0x00007f43416e23e9 start_thread (libpthread.so.0 + 0x93e9)
#5 0x00007f43417fb293 __clone (libc.so.6 + 0x100293)
Oct 09 18:04:59 measurebox systemd[1]: systemd-coredump@4-2304-0.service: Succeeded.

```

I wonder if you could patch libvncserver with this:
https://github.com/LibVNC/libvncserver/pull/444

until upstream makes a new release.

Thanks!
This task depends upon

Closed by  Balló György (City-busz)
Thursday, 08 June 2023, 22:24 GMT
Reason for closing:  Fixed
Additional comments about closing:  libvncserver 0.9.14-1
Comment by Balló György (City-busz) - Thursday, 08 June 2023, 22:23 GMT
The mentioned patch was applied in libvncserver 0.9.14, so I assume that the issue was solved.

Loading...