Patchwork [1/2] vnc: fix segfault due to failed handshake

login
register
mail settings
Submitter Tim Hardeck
Date Oct. 14, 2012, 1:08 p.m.
Message ID <1350220128-10140-2-git-send-email-thardeck@suse.de>
Download mbox | patch
Permalink /patch/191349/
State New
Headers show

Comments

Tim Hardeck - Oct. 14, 2012, 1:08 p.m.
When the VNC server disconnects due to a failed handshake we don't have
vs->bh allocated yet.

Check for this case and don't delete it.

Signed-off-by: Tim Hardeck <thardeck@suse.de>
---
 ui/vnc.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
Andreas Färber - Oct. 17, 2012, 12:52 p.m.
Am 14.10.2012 15:08, schrieb Tim Hardeck:
> When the VNC server disconnects due to a failed handshake we don't have
> vs->bh allocated yet.
> 
> Check for this case and don't delete it.
> 
> Signed-off-by: Tim Hardeck <thardeck@suse.de>
> ---
>  ui/vnc.c |    4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/ui/vnc.c b/ui/vnc.c
> index 01b2daf..656895a 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -1055,7 +1055,9 @@ static void vnc_disconnect_finish(VncState *vs)
>      vnc_unlock_output(vs);
>  
>      qemu_mutex_destroy(&vs->output_mutex);
> -    qemu_bh_delete(vs->bh);
> +    if (vs->bh != NULL) {
> +        qemu_bh_delete(vs->bh);
> +    }
>      buffer_free(&vs->jobs_buffer);
>  
>      for (i = 0; i < VNC_STAT_ROWS; ++i) {

qemu_bh_delete() is not checking for a NULL argument, therefore this fix
looks good to me,

Acked-by: Andreas Färber <afaerber@suse.de>

Adding some CCs.

As a followup it might be a good idea to either assert or ignore a NULL
argument in qemu_bh_delete().

Regards,
Andreas

Patch

diff --git a/ui/vnc.c b/ui/vnc.c
index 01b2daf..656895a 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -1055,7 +1055,9 @@  static void vnc_disconnect_finish(VncState *vs)
     vnc_unlock_output(vs);
 
     qemu_mutex_destroy(&vs->output_mutex);
-    qemu_bh_delete(vs->bh);
+    if (vs->bh != NULL) {
+        qemu_bh_delete(vs->bh);
+    }
     buffer_free(&vs->jobs_buffer);
 
     for (i = 0; i < VNC_STAT_ROWS; ++i) {