[ rdesktop-Bugs-3547906 ] Segmentation faults when logging in using smartcard

Bugs item #3547906, was opened at 2012-07-24 06:59
Message generated for change (Comment added) made by rtekronnie
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=381347&aid=3547906&group_id=24366

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Internals
Group: Future
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Rob te Kronnie (rtekronnie)
Assigned to: Henrik Andersson (hean01)
Summary: Segmentation faults when logging in using smartcard

Initial Comment:
I can succesfully connect to a Windows TS using rdesktpp 1.7.1.
But when smartcard must be used to login, rdesktop crashes after having entered the PIN code, reporting a segmentation fault.

This can be fixed easily in the next version of rdesktop by adding a condition test in the body of the SC_xfreeallmemory function in the scard.c file.
the xfree call must be conditional, test that the datasize of the handle is not zero. This will do, rdesktop remains stable after that.

setup is tested with rdesktop package 1.7.1 downloaded from rdesktop.org, pcsc-litepackage 1.5.2-7, smartcard driver ccid package 1.3.9, and glibc package 1.12-1.80, on a laptop running 64 bits RHEL 6


----------------------------------------------------------------------

Comment By: Rob te Kronnie (rtekronnie)
Date: 2012-07-29 06:20

Message:
Hi Henrik,

As requested, a smartcard debug trace file is attached. A ascreenshot of
the smatrcard login dialog is also present. Hopefully this will do for you?

After entering the PIN the segmentation fault occors and the RDP session is
terminated.

Of course a proper memory management is important, but at the moment I
would not worry about memory not being freed properly,  the rdesktop
program is being used on a Lenovo Thinkpad T420 with 8Gb memory installed. 

Fyi, the segmentation fault also occurs when using rdesktop 1.6.0.


----------------------------------------------------------------------

Comment By: Henrik Andersson (hean01)
Date: 2012-07-28 07:24

Message:
Hi Rob,

I just reviewed your fix and it looks wrong, memory will never be freed
due to the condition will always evaluated as false because of the
previous
memset() which zeroes out the memory area.

I can't reproduce the fail so it would be nice if you can revert and
provide a
backtrace for your crash.



----------------------------------------------------------------------

Comment By: Rob te Kronnie (rtekronnie)
Date: 2012-07-26 03:10

Message:
Upoloaded the file containing the bugfix (line 424).
rdesktop session remained stable the whole working day.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=381347&aid=3547906&group_id=24366

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/