[Bug] xfreerdp3 crashes with SIGABRT in cliprdr_file_context_uninit on connection failure

[madamemarionmonteil-cmd]

What version of WinBoat are you running?

0.9.0

Your Environment

Winboat version: 0.9.0
OS: Ubuntu Resolute
FreeRDP version: 3.24.2+dfsg-1ubuntu1

Description

xfreerdp3 crashes with SIGABRT every time a connection attempt fails (e.g. when
Windows is still booting). The crash occurs in cliprdr_file_context_uninit even
when +clipboard is not passed as an argument, meaning the FUSE clipboard thread
is initialized unconditionally.

This also causes FUSE mount points to accumulate in /tmp/com.freerdp.client.cliprdr.*
and never get cleaned up after the crash.

Stack trace

Thread 1:
#7 winpr_int_assert
#8 cliprdr_file_context_uninit (libfreerdp-client3.so.3)
#9 /usr/bin/xfreerdp
#10 PubSub_OnEvent
#11 freerdp_channels_disconnect
#12 freerdp_disconnect
#13 freerdp_connect ← connection never succeeded

Thread 3 (still running at crash time):
#6 cliprdr_file_fuse_thread ← FUSE thread still active during cleanup

Workaround

Manually unmounting orphaned FUSE mounts before retrying:
fusermount3 -u /tmp/com.freerdp.client.cliprdr.*

Notes

This appears to be a known bug fixed in FreeRDP 3.25.0
(commit: fix residual race in xf_clipboard_formats_free #12648)
but freerdp 3.25.0 is not yet available in Ubuntu Resolute repositories.

Steps to Reproduce / Context

Steps to reproduce

1. Launch Winboat while Windows container is still booting
2. xfreerdp3 attempts to connect to RDP but the server is not ready yet
3. Connection fails immediately inside freerdp_connect
4. During cleanup, cliprdr_file_context_uninit triggers an assertion failure
5. xfreerdp3 crashes with SIGABRT
6. A FUSE mount point is left orphaned in /tmp/com.freerdp.client.cliprdr.*
7. Each subsequent failed attempt adds another orphaned mount point

Context

• Winboat launches xfreerdp3 as a systemd transient user service
• The crash is 100% reproducible when Windows is not fully booted
• Removing +clipboard from the arguments does NOT prevent the crash,
  because cliprdr_file_fuse_thread is started unconditionally by freerdp

Logs

       PID: 133456 (xfreerdp3)
       UID: 1000 (marion)
       GID: 1000 (marion)
    Signal: 6 (ABRT)
 Timestamp: Tue 2026-04-28 20:59:49 CEST (4s ago)

Command Line: xfreerdp3 /u:marion $'/p:********' /v:127.0.0.1 /port:47301 /cert:ignore /sound:sys:pulse /microphone:sys:pulse /floatbar /compression -wallpaper /scale-desktop:100 $'/wm-class:winboat-Windows Notepad' $'/app:program:explorer.exe,name:Windows Notepad,cmd:"shell:AppsFolder\Microsoft.WindowsNotepad_8wekyb3d8bbwe!App"'
Executable: /usr/bin/xfreerdp
Control Group: /user.slice/user-1000.slice/user@1000.service/app.slice/app-winboat@9601b9ded71f428eadf3ccbcd0a8c756.service
Unit: user@1000.service
User Unit: app-winboat@9601b9ded71f428eadf3ccbcd0a8c756.service
Slice: user-1000.slice
Owner UID: 1000 (marion)
Boot ID: 9ec52906b24c47c18c35618395114e8b
Machine ID: 9135d68f01db46949630b5702a16da18
Hostname: grosnichons
Storage: /var/lib/systemd/coredump/core.xfreerdp3.1000.9ec52906b24c47c18c35618395114e8b.133456.1777402789000000.zst (present)
Size on Disk: 621.8K
Package: freerdp3/3.24.2+dfsg-1ubuntu1
build-id: bcb3ced46dc21ef7d75b22264e5e341dd1d61e5c
Message: Process 133456 (xfreerdp3) of user 1000 dumped core.

            Module /usr/bin/xfreerdp from deb freerdp3-3.24.2+dfsg-1ubuntu1.amd64
            Module linux-vdso.so.1 from deb linux-7.0.0-14.14.amd64
            Module legacy.so from deb openssl-3.5.5-1ubuntu3.amd64
            Module libXdmcp.so.6 from deb libxdmcp-1:1.1.5-2.amd64
            Module libXau.so.6 from deb libxau-1:1.0.11-1build2.amd64
            Module libstdc++.so.6 from deb gcc-16-16-20260322-1ubuntu1.amd64
            Module libicudata.so.78 from deb icu-78.2-2ubuntu1.amd64
            Module libzstd.so.1 from deb libzstd-1.5.7+dfsg-3.amd64
            Module libudev.so.1 from deb systemd-259.5-0ubuntu3.amd64
            Module libxcb.so.1 from deb libxcb-1.17.0-2ubuntu1.amd64
            Module libgcc_s.so.1 from deb gcc-16-16-20260322-1ubuntu1.amd64
            Module libicuuc.so.78 from deb icu-78.2-2ubuntu1.amd64
            Module libcjson.so.1 from deb cjson-1.7.19-2.amd64
            Module liburiparser.so.1 from deb uriparser-0.9.8+dfsg-2build1.amd64
            Module libxkbfile.so.1 from deb libxkbfile-1:1.1.0-1build5.amd64
            Module libcrypto.so.3 from deb openssl-3.5.5-1ubuntu3.amd64
            Module libssl.so.3 from deb openssl-3.5.5-1ubuntu3.amd64
            Module libz.so.1 from deb zlib-1:1.3.dfsg+really1.3.1-1ubuntu3.amd64
            Module libopus.so.0 from deb opus-1.6.1-1.amd64
            Module libasound.so.2 from deb alsa-lib-1.2.15.3-1ubuntu1.amd64
            Module libusb-1.0.so.0 from deb libusb-1.0-2:1.0.29-2build1.amd64
            Module libfuse3.so.4 from deb fuse3-3.18.2-1.amd64
            Module libXfixes.so.3 from deb libxfixes-1:6.0.0-2build2.amd64
            Module libXrandr.so.2 from deb libxrandr-2:1.5.4-1build1.amd64
            Module libXrender.so.1 from deb libxrender-1:0.9.12-1build1.amd64
            Module libXi.so.6 from deb libxi-2:1.8.2-2.amd64
            Module libXcursor.so.1 from deb libxcursor-1:1.2.3-1build1.amd64
            Module libXinerama.so.1 from deb libxinerama-2:1.1.4-3build2.amd64
            Module libXext.so.6 from deb libxext-2:1.3.4-1build3.amd64
            Module libX11.so.6 from deb libx11-2:1.8.13-1.amd64
            Stack trace of thread 133458:
            #0  0x00007a11938a648c __pthread_kill_implementation (libc.so.6 + 0xa648c)
            #1  0x00007a1193845b7e __GI_raise (libc.so.6 + 0x45b7e)
            #2  0x00007a1193e6ab0d fatal_handler (libfreerdp3.so.3 + 0x6ab0d)
            #3  0x00007a1193845cb0 __restore_rt (libc.so.6 + 0x45cb0)
            #4  0x00007a11938a648c __pthread_kill_implementation (libc.so.6 + 0xa648c)
            #5  0x00007a1193845b7e __GI_raise (libc.so.6 + 0x45b7e)
            #6  0x00007a11938288ec __GI_abort (libc.so.6 + 0x288ec)
            #7  0x00007a1193d6b9a8 winpr_int_assert (libwinpr3.so.3 + 0xb69a8)
            #8  0x00007a1194226b36 cliprdr_file_context_uninit (libfreerdp-client3.so.3 + 0x32b36)
            #9  0x0000652367e755f1 n/a (/usr/bin/xfreerdp + 0x2a5f1)
            #10 0x00007a1193d36c3a PubSub_OnEvent (libwinpr3.so.3 + 0x81c3a)
            #11 0x00007a1193efbc1a freerdp_channels_disconnect (libfreerdp3.so.3 + 0xfbc1a)
            #12 0x00007a1193efd9a8 freerdp_disconnect (libfreerdp3.so.3 + 0xfd9a8)
            #13 0x00007a1193ef2d0f freerdp_connect (libfreerdp3.so.3 + 0xf2d0f)
            #14 0x0000652367e67efd n/a (/usr/bin/xfreerdp + 0x1cefd)
            #15 0x00007a1193d574f0 thread_launcher (libwinpr3.so.3 + 0xa24f0)
            #16 0x00007a11938a40da start_thread (libc.so.6 + 0xa40da)
            #17 0x00007a11939377ac __clone3 (libc.so.6 + 0x1377ac)
            
            Stack trace of thread 133456:
            #0  0x00007a11938acae2 __syscall_cancel_arch (libc.so.6 + 0xacae2)
            #1  0x00007a11938a067c __internal_syscall_cancel (libc.so.6 + 0xa067c)
            #2  0x00007a1193927e4e __GI___poll (libc.so.6 + 0x127e4e)
            #3  0x00007a1193d0d15b pollset_poll (libwinpr3.so.3 + 0x5815b)
            #4  0x00007a1193d0e16c WaitForSingleObjectEx (libwinpr3.so.3 + 0x5916c)
            #5  0x0000652367e5a172 n/a (/usr/bin/xfreerdp + 0xf172)
            #6  0x00007a119382a601 __libc_start_call_main (libc.so.6 + 0x2a601)
            #7  0x00007a119382a718 __libc_start_main_impl (libc.so.6 + 0x2a718)
            #8  0x0000652367e5a445 n/a (/usr/bin/xfreerdp + 0xf445)
            
            Stack trace of thread 133460:
            #0  0x00007a11938acae2 __syscall_cancel_arch (libc.so.6 + 0xacae2)
            #1  0x00007a11938a067c __internal_syscall_cancel (libc.so.6 + 0xa067c)
            #2  0x00007a11939393e1 __recvmsg_syscall (libc.so.6 + 0x1393e1)
            #3  0x00007a1192e22ae1 n/a (libfuse3.so.4 + 0x22ae1)
            #4  0x00007a1192e23848 n/a (libfuse3.so.4 + 0x23848)
            #5  0x00007a1192e2399c fuse_session_mount (libfuse3.so.4 + 0x2399c)
            #6  0x00007a11942240a0 cliprdr_file_fuse_thread (libfreerdp-client3.so.3 + 0x300a0)
            #7  0x00007a1193d574f0 thread_launcher (libwinpr3.so.3 + 0xa24f0)
            #8  0x00007a11938a40da start_thread (libc.so.6 + 0xa40da)
            #9  0x00007a11939377ac __clone3 (libc.so.6 + 0x1377ac)
            ELF object binary architecture: AMD x86-64

Expected Behavior

Expected Behavior

xfreerdp3 should handle a failed connection gracefully and clean up all
allocated resources (including the FUSE clipboard context) without crashing,
regardless of whether the connection succeeded or not.

Current Behavior

Current Behavior

xfreerdp3 crashes with SIGABRT when a connection attempt fails.
The FUSE clipboard thread (cliprdr_file_fuse_thread) is still running
when cliprdr_file_context_uninit is called, triggering an assertion failure
in winpr_int_assert. Each crash leaves an orphaned FUSE mount point in
/tmp/com.freerdp.client.cliprdr.* that must be manually cleaned up.

Possible Solution

Possible Solution

Update the bundled FreeRDP version to 3.25.0, which includes a fix for a
residual race condition in xf_clipboard_formats_free (#12648) that appears
to address this exact issue.

Alternatively, ensure that the FUSE clipboard thread is properly terminated
before cliprdr_file_context_uninit is called during connection cleanup,
regardless of whether the connection succeeded or not.

Quality Notice

• I have checked the issue tracker and verified that this bug is a unique case.