48 lines
1.6 KiB
Diff
48 lines
1.6 KiB
Diff
|
From 62a58c5c2ab8ae7575a9d91d903e97ef250cc537 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Gerd Hoffmann <kraxel@redhat.com>
|
||
|
|
Date: Fri, 20 Apr 2018 10:48:19 +0200
|
||
|
|
Subject: [PATCH] vnc: fix use-after-free
|
||
|
|
MIME-Version: 1.0
|
||
|
|
Content-Type: text/plain; charset=UTF-8
|
||
|
|
Content-Transfer-Encoding: 8bit
|
||
|
|
|
||
|
|
When vnc_client_read() return value is -1
|
||
|
|
vs is not valid any more.
|
||
|
|
|
||
|
|
Fixes: d49b87f0d1e0520443a990fc610d0f02bc63c556
|
||
|
|
Reported-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
|
||
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||
|
|
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
||
|
|
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
||
|
|
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
|
||
|
|
Tested-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
||
|
|
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
|
||
|
|
Message-id: 20180420084820.3873-1-kraxel@redhat.com
|
||
|
|
(cherry picked from commit 1bc3117abad28d6465ecdb2c944b22943df0e4f3)
|
||
|
|
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
||
|
|
---
|
||
|
|
ui/vnc.c | 5 +++--
|
||
|
|
1 file changed, 3 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/ui/vnc.c b/ui/vnc.c
|
||
|
|
index 5ebae6f664..a4b2cc7666 100644
|
||
|
|
--- a/ui/vnc.c
|
||
|
|
+++ b/ui/vnc.c
|
||
|
|
@@ -1539,13 +1539,14 @@ gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
|
||
|
|
VncState *vs = opaque;
|
||
|
|
if (condition & G_IO_IN) {
|
||
|
|
if (vnc_client_read(vs) < 0) {
|
||
|
|
- goto end;
|
||
|
|
+ /* vs is free()ed here */
|
||
|
|
+ return TRUE;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if (condition & G_IO_OUT) {
|
||
|
|
vnc_client_write(vs);
|
||
|
|
}
|
||
|
|
-end:
|
||
|
|
+
|
||
|
|
if (vs->disconnecting) {
|
||
|
|
if (vs->ioc_tag != 0) {
|
||
|
|
g_source_remove(vs->ioc_tag);
|