Re: [Qemu-stable] [PATCH] vnc: fix use-after-free

[Philippe Mathieu-Daudé]

Cc'ing qemu-stable

On 04/20/2018 05:48 AM, Gerd Hoffmann wrote:
> When vnc_client_read() return value is -1
> vs is not valid any more.
> 
> Fixes: d49b87f0d1e0520443a990fc610d0f02bc63c556
> Reported-by: Philippe Mathieu-Daudé <address@hidden>
> Signed-off-by: Gerd Hoffmann <address@hidden>

Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Tested-by: Philippe Mathieu-Daudé <address@hidden>

> ---
>  ui/vnc.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/ui/vnc.c b/ui/vnc.c
> index e164eb798c..5526e54f48 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -1539,13 +1539,14 @@ gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
>      VncState *vs = opaque;
>      if (condition & G_IO_IN) {
>          if (vnc_client_read(vs) < 0) {
> -            goto end;
> +            /* vs is free()ed here */
> +            return TRUE;
>          }
>      }
>      if (condition & G_IO_OUT) {
>          vnc_client_write(vs);
>      }
> -end:
> +
>      if (vs->disconnecting) {
>          if (vs->ioc_tag != 0) {
>              g_source_remove(vs->ioc_tag);
>

signature.asc
Description: OpenPGP digital signature