Hello.

There was a problem in the latest Xvnc CoRRE implementation: the code
refused to check return values after writing data to clients; this
caused Xvnc crashes after next write operation on closed descriptor.

The fix is included below.

-- 
With Best Wishes,
Constantin

diff -urN vnc_unixsrc.orig/Xvnc/programs/Xserver/hw/vnc/corre.c 
vnc_unixsrc/Xvnc/programs/Xserver/hw/vnc/corre.c
--- vnc_unixsrc.orig/Xvnc/programs/Xserver/hw/vnc/corre.c       Sun Jun 11 20:00:52 
2000
+++ vnc_unixsrc/Xvnc/programs/Xserver/hw/vnc/corre.c    Wed Jan 17 05:23:14 2001
@@ -60,20 +60,18 @@
     int x, y, w, h;
 {
     if (h > cl->correMaxHeight) {
-       rfbSendRectEncodingCoRRE(cl, x, y, w, cl->correMaxHeight  );
-       rfbSendRectEncodingCoRRE(cl, x, y + cl->correMaxHeight, w,
-                                h - cl->correMaxHeight);
-       return;
+       return (rfbSendRectEncodingCoRRE(cl, x, y, w, cl->correMaxHeight) &&
+               rfbSendRectEncodingCoRRE(cl, x, y + cl->correMaxHeight,
+                                        w, h - cl->correMaxHeight));
     }
 
     if (w > cl->correMaxWidth) {
-       rfbSendRectEncodingCoRRE(cl, x, y, cl->correMaxWidth, h);
-       rfbSendRectEncodingCoRRE(cl, x + cl->correMaxWidth, y,
-                                w - cl->correMaxWidth, h);
-       return;
+       return (rfbSendRectEncodingCoRRE(cl, x, y, cl->correMaxWidth, h) &&
+               rfbSendRectEncodingCoRRE(cl, x + cl->correMaxWidth, y,
+                                        w - cl->correMaxWidth, h));
     }
 
-    rfbSendSmallRectEncodingCoRRE(cl, x, y, w, h);
+    return rfbSendSmallRectEncodingCoRRE(cl, x, y, w, h);
 }
---------------------------------------------------------------------
To unsubscribe, send a message with the line: unsubscribe vnc-list
to [EMAIL PROTECTED]
See also: http://www.uk.research.att.com/vnc/intouch.html
---------------------------------------------------------------------

Reply via email to