Hi
On Fri, Apr 20, 2018 at 10:48 AM, Gerd Hoffmann <kra...@redhat.com> wrote:
> When vnc_client_read() return value is -1
> vs is not valid any more.
>
> Fixes: d49b87f0d1e0520443a990fc610d0f02bc63c556
> Reported-by: Philippe Mathieu-Daudé <f4...@amsat.org>
> Signed-off-by: Gerd Hoffmann <kra...@redhat.com>
Tested-by: Marc-André Lureau <marcandre.lur...@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lur...@redhat.com>
> ---
> ui/vnc.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/ui/vnc.c b/ui/vnc.c
> index e164eb798c..5526e54f48 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -1539,13 +1539,14 @@ gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
> VncState *vs = opaque;
> if (condition & G_IO_IN) {
> if (vnc_client_read(vs) < 0) {
> - goto end;
> + /* vs is free()ed here */
> + return TRUE;
> }
> }
> if (condition & G_IO_OUT) {
> vnc_client_write(vs);
> }
> -end:
> +
> if (vs->disconnecting) {
> if (vs->ioc_tag != 0) {
> g_source_remove(vs->ioc_tag);
> --
> 2.9.3
>
>
--
Marc-André Lureau
