aboutsummaryrefslogtreecommitdiff
path: root/ui
diff options
context:
space:
mode:
authorGerd Hoffmann <kraxel@redhat.com>2018-04-20 10:48:19 +0200
committerGerd Hoffmann <kraxel@redhat.com>2018-04-27 09:51:23 +0200
commit1bc3117abad28d6465ecdb2c944b22943df0e4f3 (patch)
treef30e8609b320d34eca3f90ce20a16b1fe39ec913 /ui
parentb8846a4d6352b2a1d2012f8b3b9115640524aeda (diff)
vnc: fix use-after-free
When vnc_client_read() return value is -1 vs is not valid any more. Fixes: d49b87f0d1e0520443a990fc610d0f02bc63c556 Reported-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180420084820.3873-1-kraxel@redhat.com
Diffstat (limited to 'ui')
-rw-r--r--ui/vnc.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/ui/vnc.c b/ui/vnc.c
index e164eb798c..5526e54f48 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -1539,13 +1539,14 @@ gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
VncState *vs = opaque;
if (condition & G_IO_IN) {
if (vnc_client_read(vs) < 0) {
- goto end;
+ /* vs is free()ed here */
+ return TRUE;
}
}
if (condition & G_IO_OUT) {
vnc_client_write(vs);
}
-end:
+
if (vs->disconnecting) {
if (vs->ioc_tag != 0) {
g_source_remove(vs->ioc_tag);