summary refs log tree commit diff stats
path: root/ui/vnc.c
diff options
context:
space:
mode:
authorPeter Maydell <peter.maydell@linaro.org>2018-04-27 11:39:31 +0100
committerPeter Maydell <peter.maydell@linaro.org>2018-04-27 11:39:31 +0100
commit10f4718b51d77ff06878afd326c3d3dd140770ee (patch)
tree2ae5bb09217ce4801b1e413e02fc8a842d2db0b6 /ui/vnc.c
parentdcbd26f881557b83b99869b138b337feaf2d705d (diff)
parent8983e3e35033ecb9234725c2bba65f020824969b (diff)
downloadfocaccia-qemu-10f4718b51d77ff06878afd326c3d3dd140770ee.tar.gz
focaccia-qemu-10f4718b51d77ff06878afd326c3d3dd140770ee.zip
Merge remote-tracking branch 'remotes/kraxel/tags/ui-20180427-pull-request' into staging
vnc: fix use-after-free.
sdl2: gles support.
vfio-display: add reset support.

# gpg: Signature made Fri 27 Apr 2018 10:54:17 BST
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/ui-20180427-pull-request:
  ui: introduce vfio_display_reset
  console: introduce dpy_gfx_update_full
  sdl: Allow OpenGL ES context creation
  sdl: Move DisplayOptions global to sdl2_console
  qapi: Parameter gl of DisplayType now accept an enum
  vnc: fix use-after-free

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'ui/vnc.c')
-rw-r--r--ui/vnc.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/ui/vnc.c b/ui/vnc.c
index e164eb798c..5526e54f48 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -1539,13 +1539,14 @@ gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
     VncState *vs = opaque;
     if (condition & G_IO_IN) {
         if (vnc_client_read(vs) < 0) {
-            goto end;
+            /* vs is free()ed here */
+            return TRUE;
         }
     }
     if (condition & G_IO_OUT) {
         vnc_client_write(vs);
     }
-end:
+
     if (vs->disconnecting) {
         if (vs->ioc_tag != 0) {
             g_source_remove(vs->ioc_tag);