From 6185c5783c50ab5bb4bcdc317772848278cb9bc1 Mon Sep 17 00:00:00 2001 From: Stefano Stabellini Date: Mon, 25 Jan 2010 12:54:57 +0000 Subject: vnc_refresh: calling vnc_update_client might free vs Hi all, this patch fixes another bug in vnc_refresh: calling vnc_update_client might cause vs to be free()ed, in this case we cannot access vs->next right after to examine the next item on the list. Signed-off-by: Stefano Stabellini Signed-off-by: Anthony Liguori --- vnc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/vnc.c b/vnc.c index cc2a26e..92facde 100644 --- a/vnc.c +++ b/vnc.c @@ -2345,7 +2345,7 @@ static int vnc_refresh_server_surface(VncDisplay *vd) static void vnc_refresh(void *opaque) { VncDisplay *vd = opaque; - VncState *vs = NULL; + VncState *vs = NULL, *vn = NULL; int has_dirty = 0, rects = 0; vga_hw_update(); @@ -2354,8 +2354,10 @@ static void vnc_refresh(void *opaque) vs = vd->clients; while (vs != NULL) { + vn = vs->next; rects += vnc_update_client(vs, has_dirty); - vs = vs->next; + /* vs might be free()ed here */ + vs = vn; } /* vd->timer could be NULL now if the last client disconnected, * in this case don't update the timer */ -- cgit v1.1