diff --git a/tigervnc.changes b/tigervnc.changes
index 8df3e84..c0e6c65 100644
--- a/tigervnc.changes
+++ b/tigervnc.changes
@@ -1,4 +1,11 @@
 -------------------------------------------------------------------
+Tue Sep 26 11:53:23 UTC 2017 - msrb@suse.com
+
+- u_Unset-pixel-buffer-when-x0vncserver-client-disconnect.patch
+  * Fixes crash in x0vncserver after client disconnects.
+    (bnc#1058587)
+
+------------------------------------------------------------------
 Mon Sep 25 08:36:07 UTC 2017 - msrb@suse.com
 
 - Add tigervnc-x11vnc wrapper for x0vncserver that replaces x11vnc.
diff --git a/tigervnc.spec b/tigervnc.spec
index 1fad7d5..311b239 100644
--- a/tigervnc.spec
+++ b/tigervnc.spec
@@ -129,6 +129,7 @@ Patch8:         u_tigervnc-show-unencrypted-warning.patch
 Patch9:         U_allow_multiple_certs_with_same_dn_in_saved_certs_file.patch
 Patch10:        U_handle_certificate_verification_for_saved_certs_correctly.patch
 Patch11:        u_tigervnc-add-autoaccept-parameter.patch
+Patch12:        u_Unset-pixel-buffer-when-x0vncserver-client-disconnect.patch
 
 %description
 TigerVNC is a high-performance, platform-neutral implementation of VNC (Virtual Network Computing), 
@@ -229,6 +230,7 @@ cp -r /usr/src/xserver/* unix/xserver/
 %patch9 -p1
 %patch10 -p1
 %patch11 -p1
+%patch12 -p1
 
 pushd unix/xserver
 patch -p1 < ../xserver119.patch
diff --git a/u_Unset-pixel-buffer-when-x0vncserver-client-disconnect.patch b/u_Unset-pixel-buffer-when-x0vncserver-client-disconnect.patch
new file mode 100644
index 0000000..0ea3cfb
--- /dev/null
+++ b/u_Unset-pixel-buffer-when-x0vncserver-client-disconnect.patch
@@ -0,0 +1,74 @@
+From b1d7c2caf496e7236fe43c69fd380fedb830a979 Mon Sep 17 00:00:00 2001
+From: Michal Srb <msrb@suse.com>
+Date: Tue, 26 Sep 2017 13:45:36 +0200
+Subject: [PATCH] Unset pixel buffer when x0vncserver client disconnects.
+
+In XDesktop::start() we allocate pixel buffer and set it as the backend to the given VNCServer.
+In XDesktop::stop() we deallocate the buffer, so we must unset it from the VNCServer as well.
+Otherwise the VNCServer could try to access it and crash, for example in deferred update.
+---
+ common/rfb/VNCServerST.cxx       | 14 ++++----------
+ unix/x0vncserver/x0vncserver.cxx |  6 +++++-
+ 2 files changed, 9 insertions(+), 11 deletions(-)
+
+diff --git a/common/rfb/VNCServerST.cxx b/common/rfb/VNCServerST.cxx
+index 46c4be9b..99480133 100644
+--- a/common/rfb/VNCServerST.cxx
++++ b/common/rfb/VNCServerST.cxx
+@@ -313,6 +313,8 @@ void VNCServerST::setPixelBuffer(PixelBuffer* pb_, const ScreenSet& layout)
+   screenLayout = layout;
+ 
+   if (!pb) {
++    stopFrameClock();
++
+     if (desktopStarted)
+       throw Exception("setPixelBuffer: null PixelBuffer when desktopStarted?");
+     return;
+@@ -337,18 +339,10 @@ void VNCServerST::setPixelBuffer(PixelBuffer* pb_, const ScreenSet& layout)
+ 
+ void VNCServerST::setPixelBuffer(PixelBuffer* pb_)
+ {
+-  ScreenSet layout;
+-
+-  if (!pb_) {
+-    if (desktopStarted)
+-      throw Exception("setPixelBuffer: null PixelBuffer when desktopStarted?");
+-    return;
+-  }
+-
+-  layout = screenLayout;
++  ScreenSet layout = screenLayout;
+ 
+   // Check that the screen layout is still valid
+-  if (!layout.validate(pb_->width(), pb_->height())) {
++  if (pb_ && !layout.validate(pb_->width(), pb_->height())) {
+     Rect fbRect;
+     ScreenSet::iterator iter, iter_next;
+ 
+diff --git a/unix/x0vncserver/x0vncserver.cxx b/unix/x0vncserver/x0vncserver.cxx
+index 6fd6bc3b..ed5b1a10 100644
+--- a/unix/x0vncserver/x0vncserver.cxx
++++ b/unix/x0vncserver/x0vncserver.cxx
+@@ -270,7 +270,8 @@ public:
+     TXWindow::setGlobalEventHandler(this);
+   }
+   virtual ~XDesktop() {
+-    stop();
++    if (running)
++      stop();
+   }
+ 
+   inline void poll() {
+@@ -327,6 +328,9 @@ public:
+       XDamageDestroy(dpy, damage);
+ #endif
+ 
++    server->setPixelBuffer(0);
++    server = 0;
++
+     delete pb;
+     pb = 0;
+   }
+-- 
+2.12.3
+