Bug 1628115

Description of problem:
xrdp-chansrv crashes

Version-Release number of selected component (if applicable):

Name        : xrdp
Epoch       : 1
Version     : 0.9.7
Release     : 1.el7
Architecture: x86_64
Install Date: Tue 31 Jul 2018 11:21:59 AM IDT
Group       : Applications/Internet
Size        : 2159576
License     : ASL 2.0
Signature   : RSA/SHA256, Wed 04 Jul 2018 10:08:37 AM IDT, Key ID 6a2faea2352c64e5
Source RPM  : xrdp-0.9.7-1.el7.src.rpm
Build Date  : Wed 04 Jul 2018 09:57:30 AM IDT
Build Host  : buildvm-11.phx2.fedoraproject.org

How reproducible:
Nothing special, happens after several days of work.

Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:
I managed to catch the crash using gdb. Here's the output:
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f30003ea700 (LWP 10957)]
0x000055691a872c26 in xfuse_create_file_in_xrdp_fs ()

(gdb) info threads 
  Id   Target Id         Frame 
* 2    Thread 0x7f30003ea700 (LWP 10957) "xrdp-chansrv" 0x000055691a872c26 in xfuse_create_file_in_xrdp_fs ()
  1    Thread 0x7f300a3dd840 (LWP 10938) "xrdp-chansrv" 0x00007f3008888c03 in select () from /lib64/libc.so.6

(gdb) bt
#0  0x000055691a872c26 in xfuse_create_file_in_xrdp_fs ()
#1  0x000055691a8735ff in xfuse_add_clip_dir_item ()
#2  0x000055691a878253 in clipboard_c2s_in_files ()
#3  0x000055691a87640a in clipboard_data_in ()
#4  0x000055691a86fa63 in my_trans_data_in ()
#5  0x00007f3009fed5f1 in trans_check_wait_objs () from /usr/lib64/xrdp/libcommon.so.0
#6  0x000055691a86ef22 in channel_thread_loop ()
#7  0x00007f3009dcadd5 in start_thread () from /lib64/libpthread.so.0
#8  0x00007f3008891b3d in clone () from /lib64/libc.so.6
(gdb) 


---Type <return> to continue, or q <return> to quit---
   0x000055691a872bf1 <+177>:   callq  0x55691a86d850 <__strcpy_chk@plt>
   0x000055691a872bf6 <+182>:   cmp    $0x4000,%r14d
   0x000055691a872bfd <+189>:   je     0x55691a872c50 <xfuse_create_file_in_xrdp_fs+272>
   0x000055691a872bff <+191>:   or     $0x1a4,%r14d
   0x000055691a872c06 <+198>:   movq   $0x0,0x20(%rbx)
   0x000055691a872c0e <+206>:   mov    %r14d,0x8(%rbx)
   0x000055691a872c12 <+210>:   mov    0x4(%rbx),%edx
   0x000055691a872c15 <+213>:   mov    0x21d094(%rip),%rax        # 0x55691aa8fcb0
   0x000055691a872c1c <+220>:   mov    %rbx,%r12
   0x000055691a872c1f <+223>:   addl   $0x1,0x21d096(%rip)        # 0x55691aa8fcbc
=> 0x000055691a872c26 <+230>:   mov    %rbx,(%rax,%rdx,8)
   0x000055691a872c2a <+234>:   mov    (%rax,%r13,8),%rax
   0x000055691a872c2e <+238>:   addl   $0x1,0x10(%rax)
   0x000055691a872c32 <+242>:   callq  0x55691a872aa0 <xfuse_update_xrdpfs_size>
   0x000055691a872c37 <+247>:   add    $0x8,%rsp
   0x000055691a872c3b <+251>:   mov    %r12,%rax
   0x000055691a872c3e <+254>:   pop    %rbx
   0x000055691a872c3f <+255>:   pop    %rbp
   0x000055691a872c40 <+256>:   pop    %r12
   0x000055691a872c42 <+258>:   pop    %r13
   0x000055691a872c44 <+260>:   pop    %r14
   0x000055691a872c46 <+262>:   pop    %r15
   0x000055691a872c48 <+264>:   retq   

(gdb) info registers 
rax            0x0      0
rbx            0x7f2ff8015340   139844001026880
rcx            0x0      0
rdx            0x0      0
rsi            0x7f2ff802fbf0   139844001135600
rdi            0x7f2ff80153b6   139844001026998
rbp            0x7f2ff802fbb8   0x7f2ff802fbb8
rsp            0x7f30003e9810   0x7f30003e9810
r8             0xfefefefefefefeff       -72340172838076673
r9             0xfeff65636f2d93d6       -72227591273212970
r10            0x7f2ff8015380   139844001026944
r11            0x202    514
r12            0x7f2ff8015340   139844001026880
r13            0x2      2
r14            0x81a4   33188
r15            0x0      0
rip            0x55691a872c26   0x55691a872c26 <xfuse_create_file_in_xrdp_fs+230>
eflags         0x10202  [ IF RF ]
cs             0x33     51
ss             0x2b     43
ds             0x0      0
es             0x0      0
fs             0x0      0
gs             0x0      0
(gdb)