Re: [Qemu-devel] [PATCH] vnc: fix use-after-free

[Marc-André Lureau]

Hi

On Fri, Apr 20, 2018 at 10:48 AM, Gerd Hoffmann <address@hidden> wrote:
> When vnc_client_read() return value is -1
> vs is not valid any more.
>
> Fixes: d49b87f0d1e0520443a990fc610d0f02bc63c556
> Reported-by: Philippe Mathieu-Daudé <address@hidden>
> Signed-off-by: Gerd Hoffmann <address@hidden>

Tested-by: Marc-André Lureau <address@hidden>
Reviewed-by: Marc-André Lureau <address@hidden>


> ---
>  ui/vnc.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/ui/vnc.c b/ui/vnc.c
> index e164eb798c..5526e54f48 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -1539,13 +1539,14 @@ gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
>      VncState *vs = opaque;
>      if (condition & G_IO_IN) {
>          if (vnc_client_read(vs) < 0) {
> -            goto end;
> +            /* vs is free()ed here */
> +            return TRUE;
>          }
>      }
>      if (condition & G_IO_OUT) {
>          vnc_client_write(vs);
>      }
> -end:
> +
>      if (vs->disconnecting) {
>          if (vs->ioc_tag != 0) {
>              g_source_remove(vs->ioc_tag);
> --
> 2.9.3
>
>



-- 
Marc-André Lureau