Hi Nick, We have confirmed with Chainguard that their guacamole-server image build applies no patches and is identical to your official tag. Is this something that could be fixed in an upcoming release? Do you have a target release timeline where this might land, so we can plan around it?
Thank you, Keiko Hashizume Get Outlook for Mac<https://aka.ms/GetOutlookForMac> From: Nick Couchman <[email protected]> Date: Friday, September 4, 2026 at 2:00 PM To: [email protected] <[email protected]> Subject: Re: Guacamole Bug: gdi_init_ex() crashes on NULL rdpCache for a normal connecting client (guacamole-server) [You don't often get email from [email protected]. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] ⚠ External email If the sender is unfamiliar, check home.relx.com → Trusted partners to verify them. On Fri, Sep 4, 2026 at 1:41 PM Hashizume, Keiko (RIS-HBE) <[email protected]> wrote: > > gdi_init_ex() crashes with a failed WINPR_ASSERT(cache) inside > brush_cache_register_callbacks() when called by Chainguard's guacamole-server > image's RDP plugin (the stock apache/guacamole-server 1.6.0 codebase, > packaged by Chainguard) — a normal, fully-connecting RDP client (completes > capability negotiation, authentication, and framebuffer format agreement) — > starting with FreeRDP 3.31.0. > > guacd[N]: INFO: Loading keymap "en-us-qwerty" > guacd[N]: DEBUG: Local framebuffer format PIXEL_FORMAT_BGRX32 > guacd[N]: DEBUG: Remote framebuffer format PIXEL_FORMAT_BGRA32 > guacd[N]: DEBUG: ((cache)) > [./libfreerdp/cache/brush.c:brush_cache_register_callbacks:230] > guacd[N]: DEBUG: 0: ... libwinpr3.so.3 ... > guacd[N]: DEBUG: 1: ... dli_sname=winpr_log_backtrace_ex ... > guacd[N]: DEBUG: 2: ... dli_sname=winpr_int_assert ... > guacd[N]: DEBUG: 3: ... dli_fname=/usr/lib/libfreerdp3.so.3, > dli_sname=gdi_init_ex ... > guacd[N]: DEBUG: 4: ... dli_fname=/usr/lib/libguac-client-rdp.so ... > guacd[N]: DEBUG: 5: ... dli_sname=freerdp_connect ... > guacd[N]: DEBUG: 6: ... dli_sname=guac_rdp_client_thread ... > guacd[1]: INFO: Connection removed. > > Environment > Distribution: Chainguard's guacamole-server container image (packages the > stock apache/guacamole-server 1.6.0 codebase, bundled with their own > independently-versioned FreeRDP build) — not Apache's own official Docker Hub > image, and not a from-source build with any local patches to the RDP plugin > FreeRDP: 3.31.0-r1 and 3.31.1 (Chainguard guacamole-server tags > 1.6.0-r10/1.6.0-r11) > Confirmed absent in FreeRDP 3.27.1 (Chainguard guacamole-server:1.6.0-r9) and > 3.30.0 > Platform: linux/amd64 (also reproduced via qemu emulation from linux/arm64 > host) > guacamole-server application version: 1.6.0 (unchanged across all tags above > — only the bundled FreeRDP version differs) > I'd be curious to know if this could be reproduced outside of Chainguard's container image and in the official images? Based on what you've said I suspect it would, but it would be good to confirm that there aren't other modifications taking place. > > > I have reached out to FreeRDP, but they mentioned that it is a guacamole bug > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fapache%2Fguacamole-server%2Fblob%2Fd3b7828977c63a5b197158d6cbbdaf1846b579fb%2Fsrc%2Fprotocols%2Frdp%2Frdp.c%23L197&data=05%7C02%7CKeiko.Hashizume%40lexisnexisrisk.com%7C0fc2543e67c6402b88c808df0aae5372%7C9274ee3f94254109a27f9fb15c10675d%7C0%7C0%7C639241416022038102%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=BULOxYCjM62peyoCEiCxPcI9AcH2LVEhpoVXfv5IOZQ%3D&reserved=0<https://github.com/apache/guacamole-server/blob/d3b7828977c63a5b197158d6cbbdaf1846b579fb/src/protocols/rdp/rdp.c#L197> > is in PreConnect callback - something that was never supported (or done in > any of the reference clients) Thanks, that could be useful in tracking it down. -Nick --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] ________________________________ The information contained in this e-mail message is intended only for the personal and confidential use of the recipient(s) named above. This message may be an attorney-client communication and/or work product and as such is privileged and confidential. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail, and delete the original message.
