david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vnc: fix use-after-free

Browse Source 
When vnc_client_read() return value is -1
vs is not valid any more.

Fixes: d49b87f0d1e0520443a990fc610d0f02bc63c556
Reported-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180420084820.3873-1-kraxel@redhat.com
This commit is contained in:
Gerd Hoffmann 2018-04-20 10:48:19 +02:00
parent b8846a4d63
commit 1bc3117aba
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ui/vnc.c
View File

@ -1539,13 +1539,14 @@ gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
VncState *vs = opaque; VncState *vs = opaque;
if (condition & G_IO_IN) { if (condition & G_IO_IN) {
if (vnc_client_read(vs) < 0) { if (vnc_client_read(vs) < 0) {
goto end; /* vs is free()ed here */
return TRUE;
} }
} }
if (condition & G_IO_OUT) { if (condition & G_IO_OUT) {
vnc_client_write(vs); vnc_client_write(vs);
} }
end:
if (vs->disconnecting) { if (vs->disconnecting) {
if (vs->ioc_tag != 0) { if (vs->ioc_tag != 0) {
g_source_remove(vs->ioc_tag); g_source_remove(vs->ioc_tag);