[GUACAMOLE-194] Double free() in guac_common_ssh_destroy_user()

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.9.10-incubating
• Fix Version/s: 0.9.13-incubating
• Component/s: RDP, VNC
• Environment: guacd docker container on ubuntu and debian
• Assignee: Mike Jumper
• Reporter: Robin
• Created: 31/Jan/17 12:48
• Updated: 28/Feb/17 18:52
• Resolved: 28/Feb/17 18:52

Description

We are heavy users of the RDP feature with SSH/SFTP for file downloads and uploads. We are seeing frequent guacd crashes, even the first session log off can cause a crash.

After a few sessions (Sometimes hundreds, often thousands) the container becomes unstable, causes very high system load and no new connections via guacamole are possible. We typically also see the virtual docker Ethernet adapter enter the disabled state.

https://github.com/apache/incubator-guacamole-server/blob/d831a4b9dfee685d2c00f83dabff59d0be917496/src/common-ssh/guac_ssh_user.c

void guac_common_ssh_destroy_user(guac_common_ssh_user* user) {

    /* Free private key, if present */
    if (user->private_key != NULL)
        guac_common_ssh_key_free(user->private_key);

    /* Free all other data */
    free(user->password);
    free(user->username);
    free(user);

}