diff options
author | Gerd Hoffmann <kraxel@redhat.com> | 2018-04-20 10:48:19 +0200 |
---|---|---|
committer | Gerd Hoffmann <kraxel@redhat.com> | 2018-04-27 09:51:23 +0200 |
commit | 1bc3117abad28d6465ecdb2c944b22943df0e4f3 (patch) | |
tree | f30e8609b320d34eca3f90ce20a16b1fe39ec913 /ui/vnc.c | |
parent | b8846a4d6352b2a1d2012f8b3b9115640524aeda (diff) | |
download | qemu-1bc3117abad28d6465ecdb2c944b22943df0e4f3.zip qemu-1bc3117abad28d6465ecdb2c944b22943df0e4f3.tar.gz qemu-1bc3117abad28d6465ecdb2c944b22943df0e4f3.tar.bz2 |
vnc: fix use-after-free
When vnc_client_read() return value is -1
vs is not valid any more.
Fixes: d49b87f0d1e0520443a990fc610d0f02bc63c556
Reported-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180420084820.3873-1-kraxel@redhat.com
Diffstat (limited to 'ui/vnc.c')
-rw-r--r-- | ui/vnc.c | 5 |
1 files changed, 3 insertions, 2 deletions
@@ -1539,13 +1539,14 @@ gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED, VncState *vs = opaque; if (condition & G_IO_IN) { if (vnc_client_read(vs) < 0) { - goto end; + /* vs is free()ed here */ + return TRUE; } } if (condition & G_IO_OUT) { vnc_client_write(vs); } -end: + if (vs->disconnecting) { if (vs->ioc_tag != 0) { g_source_remove(vs->ioc_tag); |