[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 1/6] vnc: fix use-after-free
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 1/6] vnc: fix use-after-free |
Date: |
Fri, 27 Apr 2018 11:54:29 +0200 |
When vnc_client_read() return value is -1
vs is not valid any more.
Fixes: d49b87f0d1e0520443a990fc610d0f02bc63c556
Reported-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
Reviewed-by: Marc-André Lureau <address@hidden>
Reviewed-by: Daniel P. Berrangé <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Tested-by: Marc-André Lureau <address@hidden>
Tested-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden
---
ui/vnc.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/ui/vnc.c b/ui/vnc.c
index e164eb798c..5526e54f48 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -1539,13 +1539,14 @@ gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
VncState *vs = opaque;
if (condition & G_IO_IN) {
if (vnc_client_read(vs) < 0) {
- goto end;
+ /* vs is free()ed here */
+ return TRUE;
}
}
if (condition & G_IO_OUT) {
vnc_client_write(vs);
}
-end:
+
if (vs->disconnecting) {
if (vs->ioc_tag != 0) {
g_source_remove(vs->ioc_tag);
--
2.9.3
- [Qemu-devel] [PULL 0/6] Ui 20180427 patches, Gerd Hoffmann, 2018/04/27
- [Qemu-devel] [PULL 4/6] sdl: Allow OpenGL ES context creation, Gerd Hoffmann, 2018/04/27
- [Qemu-devel] [PULL 6/6] ui: introduce vfio_display_reset, Gerd Hoffmann, 2018/04/27
- [Qemu-devel] [PULL 5/6] console: introduce dpy_gfx_update_full, Gerd Hoffmann, 2018/04/27
- [Qemu-devel] [PULL 2/6] qapi: Parameter gl of DisplayType now accept an enum, Gerd Hoffmann, 2018/04/27
- [Qemu-devel] [PULL 3/6] sdl: Move DisplayOptions global to sdl2_console, Gerd Hoffmann, 2018/04/27
- [Qemu-devel] [PULL 1/6] vnc: fix use-after-free,
Gerd Hoffmann <=
- Re: [Qemu-devel] [PULL 0/6] Ui 20180427 patches, Peter Maydell, 2018/04/27