[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 3/9] vnc: fix use-after-free in vnc_update_client_syn
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 3/9] vnc: fix use-after-free in vnc_update_client_sync |
Date: |
Mon, 10 Mar 2014 13:49:07 +0100 |
Spotted by Coverity:
876 static int vnc_update_client_sync(VncState *vs, int has_dirty)
877 {
(1) Event freed_arg: "vnc_update_client(VncState *, int)" frees "vs".
[details]
Also see events: [deref_arg]
878 int ret = vnc_update_client(vs, has_dirty);
(2) Event deref_arg: Calling "vnc_jobs_join(VncState *)" dereferences freed
pointer "vs". [details]
Also see events: [freed_arg]
879 vnc_jobs_join(vs);
880 return ret;
881 }
Remove vnc_update_client_sync wrapper, replace it with an additional
argument to vnc_update_client, so we can so the sync properly in
vnc_update_client (i.e. skip it in case of a client disconnect).
Signed-off-by: Gerd Hoffmann <address@hidden>
Reviewed-by: Markus Armbruster <address@hidden>
---
ui/vnc.c | 21 ++++++++-------------
1 file changed, 8 insertions(+), 13 deletions(-)
diff --git a/ui/vnc.c b/ui/vnc.c
index 7dfc94a..b053d0e 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -417,8 +417,7 @@ out_error:
3) resolutions > 1024
*/
-static int vnc_update_client(VncState *vs, int has_dirty);
-static int vnc_update_client_sync(VncState *vs, int has_dirty);
+static int vnc_update_client(VncState *vs, int has_dirty, bool sync);
static void vnc_disconnect_start(VncState *vs);
static void vnc_colordepth(VncState *vs);
@@ -751,7 +750,7 @@ static void vnc_dpy_copy(DisplayChangeListener *dcl,
QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
vs->force_update = 1;
- vnc_update_client_sync(vs, 1);
+ vnc_update_client(vs, 1, true);
/* vs might be free()ed here */
}
}
@@ -874,14 +873,7 @@ static int find_and_clear_dirty_height(struct VncState *vs,
return h;
}
-static int vnc_update_client_sync(VncState *vs, int has_dirty)
-{
- int ret = vnc_update_client(vs, has_dirty);
- vnc_jobs_join(vs);
- return ret;
-}
-
-static int vnc_update_client(VncState *vs, int has_dirty)
+static int vnc_update_client(VncState *vs, int has_dirty, bool sync)
{
if (vs->need_update && vs->csock != -1) {
VncDisplay *vd = vs->vd;
@@ -940,8 +932,11 @@ static int vnc_update_client(VncState *vs, int has_dirty)
return n;
}
- if (vs->csock == -1)
+ if (vs->csock == -1) {
vnc_disconnect_finish(vs);
+ } else if (sync) {
+ vnc_jobs_join(vs);
+ }
return 0;
}
@@ -2734,7 +2729,7 @@ static void vnc_refresh(DisplayChangeListener *dcl)
vnc_unlock_display(vd);
QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
- rects += vnc_update_client(vs, has_dirty);
+ rects += vnc_update_client(vs, has_dirty, false);
/* vs might be free()ed here */
}
--
1.8.3.1
- [Qemu-devel] [PULL 0/9] vnc patches, Gerd Hoffmann, 2014/03/10
- [Qemu-devel] [PULL 3/9] vnc: fix use-after-free in vnc_update_client_sync,
Gerd Hoffmann <=
- [Qemu-devel] [PULL 2/9] vnc: Fix qemu crashed when vnc client disconnect suddenly, Gerd Hoffmann, 2014/03/10
- [Qemu-devel] [PULL 1/9] vnc: Fix tight_detect_smooth_image() for lossless case, Gerd Hoffmann, 2014/03/10
- [Qemu-devel] [PULL 4/9] ui/vnc: introduce VNC_DIRTY_PIXELS_PER_BIT macro, Gerd Hoffmann, 2014/03/10
- [Qemu-devel] [PULL 6/9] ui/vnc: optimize dirty bitmap tracking, Gerd Hoffmann, 2014/03/10
- [Qemu-devel] [PULL 9/9] ui/vnc: disable adaptive update calculations if not needed, Gerd Hoffmann, 2014/03/10
- [Qemu-devel] [PULL 7/9] ui/vnc: optimize clearing in find_and_clear_dirty_height(), Gerd Hoffmann, 2014/03/10
- [Qemu-devel] [PULL 8/9] ui/vnc: optimize setting in vnc_dpy_update(), Gerd Hoffmann, 2014/03/10
- [Qemu-devel] [PULL 5/9] ui/vnc: derive cmp_bytes from VNC_DIRTY_PIXELS_PER_BIT, Gerd Hoffmann, 2014/03/10
- Re: [Qemu-devel] [PULL 0/9] vnc patches, Peter Maydell, 2014/03/11