diff mbox

[for-2.5] vnc: fix segfault

Message ID 1448435398-14049-1-git-send-email-kraxel@redhat.com
State New
Headers show

Commit Message

Gerd Hoffmann Nov. 25, 2015, 7:09 a.m. UTC
Commit "c7628bf vnc: only alloc server surface with clients connected"
missed one rarely used codepath (cirrus with guest drivers using 2d
accel) where we have to check for the server surface being present,
to avoid qemu crashing with a NULL pointer dereference.  Add the check.

Reported-by: Anthony PERARD <anthony.perard@citrix.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 ui/vnc.c | 5 +++++
 1 file changed, 5 insertions(+)

Comments

Anthony PERARD Nov. 25, 2015, 3:10 p.m. UTC | #1
On Wed, Nov 25, 2015 at 08:09:58AM +0100, Gerd Hoffmann wrote:
> Commit "c7628bf vnc: only alloc server surface with clients connected"
> missed one rarely used codepath (cirrus with guest drivers using 2d
> accel) where we have to check for the server surface being present,
> to avoid qemu crashing with a NULL pointer dereference.  Add the check.
> 
> Reported-by: Anthony PERARD <anthony.perard@citrix.com>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

This works for me.

Thanks.

> ---
>  ui/vnc.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/ui/vnc.c b/ui/vnc.c
> index c9f2fed..7538405 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -931,6 +931,11 @@ static void vnc_dpy_copy(DisplayChangeListener *dcl,
>      int i, x, y, pitch, inc, w_lim, s;
>      int cmp_bytes;
>  
> +    if (!vd->server) {
> +        /* no client connected */
> +        return;
> +    }
> +
>      vnc_refresh_server_surface(vd);
>      QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
>          if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
> -- 
> 1.8.3.1
>
diff mbox

Patch

diff --git a/ui/vnc.c b/ui/vnc.c
index c9f2fed..7538405 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -931,6 +931,11 @@  static void vnc_dpy_copy(DisplayChangeListener *dcl,
     int i, x, y, pitch, inc, w_lim, s;
     int cmp_bytes;
 
+    if (!vd->server) {
+        /* no client connected */
+        return;
+    }
+
     vnc_refresh_server_surface(vd);
     QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
         if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {