Invalid Fast-Path Cached Pointer Updates received from Redemption 1.1.76

[yet-another-aligator]

Hi Wallix team,

As suggested by a FreeRDP maintainer, here is the feedback of a bug encountered when trying to reach targets (Windows 2016 and xrdp 0.9.9 on Ubuntu 16.04) through Redemption 1.1.76 (installed as a component of Wallix AdminBastion), with FreeRDP 2.x client releases.

Once connected to the target, I try to type something on any kind of text input field (file explorer, PuTTY, etc.), and FreeRDP crash with a Fastpath update Cached Pointer [a] failed, status 0 error message.

My FreeRDP debug log (FreeRDP 2.2.0 with some additional debug lines, built and run on a Debian GNU/Linux 10.5) :

[22:17:10:885] [19280:19281] [INFO][com.freerdp.core] - freerdp_connect:freerdp_set_last_error_ex resetting error state
[22:17:10:885] [19280:19281] [INFO][com.freerdp.client.common.cmdline] - loading channelEx rdpdr
[22:17:10:885] [19280:19281] [INFO][com.freerdp.client.common.cmdline] - loading channelEx rdpsnd
[22:17:10:885] [19280:19281] [INFO][com.freerdp.client.common.cmdline] - loading channelEx cliprdr
[22:17:10:316] [19280:19281] [INFO][com.freerdp.primitives] - primitives autodetect, using optimized
[22:17:10:318] [19280:19281] [INFO][com.freerdp.core] - freerdp_tcp_is_hostname_resolvable:freerdp_set_last_error_ex resetting error state
[22:17:10:318] [19280:19281] [INFO][com.freerdp.core] - freerdp_tcp_connect:freerdp_set_last_error_ex resetting error state
[22:17:11:449] [19280:19281] [WARN][com.freerdp.core.rdp] - pduType PDU_TYPE_DATA not properly parsed, 164 bytes remaining unhandled. Skipping.
[22:17:11:449] [19280:19281] [INFO][com.freerdp.gdi] - Local framebuffer format  PIXEL_FORMAT_BGRA32
[22:17:11:449] [19280:19281] [INFO][com.freerdp.gdi] - Remote framebuffer format PIXEL_FORMAT_RGB16
[22:17:11:477] [19280:19281] [INFO][com.winpr.clipboard] - initialized POSIX local file subsystem
[22:17:11:478] [19280:19281] [INFO][com.freerdp.channels.rdpsnd.client] - [static] Loaded fake backend for rdpsnd
[22:17:12:855] [19280:19281] [WARN][com.freerdp.core.update] - [0x01] Cache Color Table - SERVER BUG: The support for this feature was not announced!
[22:17:14:825] [19280:19281] [INFO][com.freerdp.cache.pointer] - ------> Pointer PUT index : 0 <------
[22:17:15:807] [19280:19281] [INFO][com.freerdp.cache.pointer] - ------> Pointer PUT index : 1 <------
[22:17:15:807] [19280:19281] [INFO][com.freerdp.cache.pointer] - ------> Pointer PUT index : 2 <------
[22:17:15:821] [19280:19281] [INFO][com.freerdp.cache.pointer] - ------> Pointer GET index : 1 <------
[22:17:15:843] [19280:19281] [INFO][com.freerdp.cache.pointer] - ------> Pointer GET index : 2 <------
[22:17:15:853] [19280:19281] [INFO][com.freerdp.cache.pointer] - ------> Pointer PUT index : 3 <------
[22:17:15:866] [19280:19281] [INFO][com.freerdp.cache.pointer] - ------> Pointer GET index : 2 <------
[22:17:15:898] [19280:19281] [INFO][com.freerdp.cache.pointer] - ------> Pointer GET index : 1 <------
[22:17:15:033] [19280:19281] [INFO][com.freerdp.cache.pointer] - ------> Pointer GET index : 4 <------
[22:17:15:033] [19280:19281] [ERROR][com.freerdp.core.fastpath] - Fastpath update Cached Pointer [a] failed, status 0
[22:17:15:033] [19280:19281] [ERROR][com.freerdp.core.fastpath] - fastpath_recv_update() - -1
[22:17:15:033] [19280:19281] [ERROR][com.freerdp.core.fastpath] - fastpath_recv_update_data() fail
[22:17:15:033] [19280:19281] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -3
[22:17:15:033] [19280:19281] [ERROR][com.freerdp.core] - freerdp_check_fds() failed - 0
[22:17:15:033] [19280:19281] [INFO][com.freerdp.client.common] - Network disconnect!
[22:17:15:033] [19280:19281] [ERROR][com.freerdp.client.x11] - Failed to check FreeRDP file descriptor

At 22:17:15:033, Redemption sends a Fast-Path Cached Pointer Update for cached index 4. But xfreerdp did not received any previous Fast-Path Color/New Pointer Update for this index, which leads to a xfreerdp failure.

The issue has been reported in a FreeRDP pull request : https://github.com/FreeRDP/FreeRDP/pull/6477 but maybe a patch on Redemption's side could fix it.

Thank you in advance for your help.

[mengtan]

Hi, thanks for your reporting. This is a quite old version and the issue might have been fixed now. Have you tried another tag ?

[yet-another-aligator]

Hi @mengtan , thank you for your feedback.

I haven't tried another tag yet.

Actually, the targeted Redemption instance is deployed on a remote customer infrastructure, as a component of Wallix's commercial bundle AdminBastion, version 6.0 hotfix 13 (build 17; 2018-10-29). Unfortunately I don't have any control on this instance and I don't know if a newer patch is available for WAB 6.0.

If this bug has not been encountered by anyone, I can try to reproduce it with a standalone Redemption 1.1.76 deployment and again with the latest stable release.

[yet-another-aligator]

Hi @mengtan ,

It seems this issue has been fixed in a newer Redemption's release, as the one integrated in AdminBastion 8.x suite.

Anyway thank you for your answer.