Nightly 3/10 asan use after free

[jgilbert2017]

installed via freerdp-nightly_3.0.0+0~20220310024821.1096~1.gbp91ef44_amd64.deb

cmd line exec $xfreerdp /drive:home,/home/user/Documents /gdi:hw -wallpaper -themes $multi /size:100% /u:username /v:192.168.1.100 /rfx /gfx -clipboard +gfx-progressive /microphone:sys:alsa,format:1 /sound:sys:alsa

nightly 3/10 runs fine 99% of the time but just got a asan abort below during a graphical activity.

==1612==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f41bcaa1d98 at pc 0x7f41c95fcd71 bp 0x7f41a1ec6f50 sp 0x7f41a1ec6f40
READ of size 2 at 0x7f41bcaa1d98 thread T24
    #0 0x7f41c95fcd70  (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x384d70)
    #1 0x7f41c8f82f95  (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x170f95)
    #2 0x7f41c8f8768d  (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x17568d)
    #3 0x7f41c8bff608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477
    #4 0x7f41c8d3f162 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f162)

0x7f41bcaa1d98 is located 13720 bytes inside of 264040-byte region [0x7f41bca9e800,0x7f41bcadef68)
freed by thread T18 here:
    #0 0x7f41c9fcdc3e in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:163
    #1 0x7f41c95e9f37  (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x371f37)
    #2 0x7f41c95eb4cb  (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x3734cb)
    #3 0x7f41c95ff49c  (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x38749c)
    #4 0x7f41c95fff9f  (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x387f9f)
    #5 0x7f41c96044e3 in progressive_decompress (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x38c4e3)
    #6 0x7f41c940ea14  (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x196a14)
    #7 0x7f41c99b967f  (/opt/freerdp-nightly/bin/../lib/libfreerdp-client3.so.3+0x12267f)
    #8 0x7f41c99bf902  (/opt/freerdp-nightly/bin/../lib/libfreerdp-client3.so.3+0x128902)
    #9 0x7f41c99c446a  (/opt/freerdp-nightly/bin/../lib/libfreerdp-client3.so.3+0x12d46a)
    #10 0x7f41c99377ea  (/opt/freerdp-nightly/bin/../lib/libfreerdp-client3.so.3+0xa07ea)
    #11 0x7f41c9939a45  (/opt/freerdp-nightly/bin/../lib/libfreerdp-client3.so.3+0xa2a45)
    #12 0x7f41c8f8768d  (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x17568d)
    #13 0x7f41c8bff608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477

previously allocated by thread T18 here:
    #0 0x7f41c9fcdc3e in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:163
    #1 0x7f41c95e9f37  (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x371f37)
    #2 0x7f41c9600f62 in progressive_create_surface_context (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x388f62)
    #3 0x7f41c940e84b  (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x19684b)
    #4 0x7f41c99b967f  (/opt/freerdp-nightly/bin/../lib/libfreerdp-client3.so.3+0x12267f)
    #5 0x7f41c99bf902  (/opt/freerdp-nightly/bin/../lib/libfreerdp-client3.so.3+0x128902)
    #6 0x7f41c99c446a  (/opt/freerdp-nightly/bin/../lib/libfreerdp-client3.so.3+0x12d46a)
    #7 0x7f41c99377ea  (/opt/freerdp-nightly/bin/../lib/libfreerdp-client3.so.3+0xa07ea)
    #8 0x7f41c9939a45  (/opt/freerdp-nightly/bin/../lib/libfreerdp-client3.so.3+0xa2a45)
    #9 0x7f41c8f8768d  (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x17568d)
    #10 0x7f41c8bff608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477

Thread T24 created by T18 here:
    #0 0x7f41c9efa815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
    #1 0x7f41c8f8690d  (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x17490d)
    #2 0x7f41c8f87c90 in CreateThread (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x175c90)
    #3 0x7f41c8f8324c  (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x17124c)
    #4 0x7f41c8f8354c in winpr_CreateThreadpool (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x17154c)
    #5 0x7f41c961d152 in rfx_context_new_ex (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x3a5152)    #6 0x7f41c96084e7 in progressive_context_new (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x3904e7)
    #7 0x7f41c94e55de in freerdp_client_codecs_prepare (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x26d5de)
    #8 0x7f41c94132ef in gdi_graphics_pipeline_init_ex (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x19b2ef)
    #9 0x559d23c525e1  (/opt/freerdp-nightly/bin/xfreerdp+0x275e1)
    #10 0x7f41c8f2031a in PubSub_OnEvent (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x10e31a)
    #11 0x7f41c94d917f  (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x26117f)
    #12 0x7f41c993c2e4  (/opt/freerdp-nightly/bin/../lib/libfreerdp-client3.so.3+0xa52e4)
    #13 0x7f41c8f8768d  (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x17568d)
    #14 0x7f41c8bff608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477

Thread T18 created by T1 here:
    #0 0x7f41c9efa815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
    #1 0x7f41c8f8690d  (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x17490d)
    #2 0x7f41c8f87c90 in CreateThread (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x175c90)
    #3 0x7f41c9935a9d  (/opt/freerdp-nightly/bin/../lib/libfreerdp-client3.so.3+0x9ea9d)
    #4 0x7f41c94db750  (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x263750)
    #5 0x7f41c94d4b6a in freerdp_connect (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x25cb6a)
    #6 0x559d23c9ccd6  (/opt/freerdp-nightly/bin/xfreerdp+0x71cd6)
    #7 0x7f41c8f8768d  (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x17568d)
    #8 0x7f41c8bff608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477

Thread T1 created by T0 here:
    #0 0x7f41c9efa815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
    #1 0x7f41c8f8690d  (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x17490d)
    #2 0x7f41c8f87c90 in CreateThread (/opt/freerdp-nightly/bin/../lib/libwinpr3.so.3+0x175c90)
    #3 0x559d23c92086  (/opt/freerdp-nightly/bin/xfreerdp+0x67086)
    #4 0x559d23c4651c  (/opt/freerdp-nightly/bin/xfreerdp+0x1b51c)
    #5 0x7f41c8c440b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)

SUMMARY: AddressSanitizer: heap-use-after-free (/opt/freerdp-nightly/bin/../lib/libfreerdp3.so.3+0x384d70)
Shadow bytes around the buggy address:
  0x0fe8b794c360: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0fe8b794c370: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0fe8b794c380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0fe8b794c390: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0fe8b794c3a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0fe8b794c3b0: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd
  0x0fe8b794c3c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0fe8b794c3d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0fe8b794c3e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0fe8b794c3f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0fe8b794c400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==1612==ABORTING

[VVD]

What versions are affected?

[akallabeth]

@VVD master before the merge, no releases.