Skip to content

GUACAMOLE-2262: Heap-allocate clipboard buffers to prevent stack overflow.#659

Open
escra wants to merge 1 commit intoapache:staging/1.6.1from
ESCRA-GmbH:fix/clipboard-stack-overflow
Open

GUACAMOLE-2262: Heap-allocate clipboard buffers to prevent stack overflow.#659
escra wants to merge 1 commit intoapache:staging/1.6.1from
ESCRA-GmbH:fix/clipboard-stack-overflow

Conversation

@escra
Copy link
Copy Markdown

@escra escra commented Apr 14, 2026

Summary

The clipboard receive and send buffers in cliprdr.c were allocated on the
stack using GUAC_COMMON_CLIPBOARD_MAX_LENGTH. Since configurable clipboard
limits (GUACAMOLE-2002)
raised this to 50 MiB while the default thread stack is only 8 MiB, large
clipboard operations cause a stack overflow (SIGSEGV) that silently kills the
connection.

Root cause

guac_rdp_cliprdr_format_data_response() declares:
c char received_data[GUAC_COMMON_CLIPBOARD_MAX_LENGTH];
With GUAC_COMMON_CLIPBOARD_MAX_LENGTH at 50 MiB (52428800 bytes) and the
default pthread stack size at 8 MiB, this overflows the stack immediately.

Similarly, guac_rdp_cliprdr_format_data_request() heap-allocates the output
buffer using guac_mem_alloc(GUAC_COMMON_CLIPBOARD_MAX_LENGTH) but could use
the actual configured clipboard size instead.

Fix

  • Heap-allocate both buffers using guac_mem_alloc() with the actual configured
    clipboard size (clipboard->clipboard->available) instead of the compile-time
    maximum
  • Free the buffers on all exit paths (including the early return for unsupported
    formats)

Affected versions

JIRA

GUACAMOLE-2002 - this is
a regression from the configurable clipboard limits feature.

Test plan

  • Configure a connection with clipboard limit > 8 MiB
  • Copy large text to clipboard on RDP server, paste in browser
  • Copy large text in browser, paste on RDP server
  • Verify no SIGSEGV / silent disconnection
  • Verify normal clipboard operations still work with default settings

…flow.

The clipboard receive and send buffers in cliprdr.c were allocated on the
stack using GUAC_COMMON_CLIPBOARD_MAX_LENGTH. Since configurable clipboard
limits (GUACAMOLE-2002) raised this to 50 MiB while the default thread
stack is only 8 MiB, large clipboard operations cause a stack overflow
(SIGSEGV) that silently kills the connection.

This change heap-allocates both buffers using guac_mem_alloc() and frees
them on all exit paths.
@escra escra changed the title GUACAMOLE-2002: Heap-allocate clipboard buffers to prevent stack overflow. GUACAMOLE-2262: Heap-allocate clipboard buffers to prevent stack overflow. Apr 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant