diff options
| author | Gerd Hoffmann <kraxel@redhat.com> | 2014-03-06 13:54:28 +0100 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2014-03-10 12:35:04 +0100 |
| commit | 38ee14f4f33f8836fc0e209ca59c6ae8c6edf380 (patch) | |
| tree | 837dd4710f2cfd7d42319883d43fa8d080e1bf1b /linux-user/signal.c | |
| parent | e3c1adf16e38714ebd761dd02517dd07760ba6d2 (diff) | |
| download | focaccia-qemu-38ee14f4f33f8836fc0e209ca59c6ae8c6edf380.tar.gz focaccia-qemu-38ee14f4f33f8836fc0e209ca59c6ae8c6edf380.zip | |
vnc: fix use-after-free in vnc_update_client_sync
Spotted by Coverity:
876 static int vnc_update_client_sync(VncState *vs, int has_dirty)
877 {
(1) Event freed_arg: "vnc_update_client(VncState *, int)" frees "vs". [details]
Also see events: [deref_arg]
878 int ret = vnc_update_client(vs, has_dirty);
(2) Event deref_arg: Calling "vnc_jobs_join(VncState *)" dereferences freed pointer "vs". [details]
Also see events: [freed_arg]
879 vnc_jobs_join(vs);
880 return ret;
881 }
Remove vnc_update_client_sync wrapper, replace it with an additional
argument to vnc_update_client, so we can so the sync properly in
vnc_update_client (i.e. skip it in case of a client disconnect).
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Diffstat (limited to 'linux-user/signal.c')
0 files changed, 0 insertions, 0 deletions