|
 |
955736b |
From 06a27a4fb52653b4cbf67b75b8116cf6692b435d Mon Sep 17 00:00:00 2001
|
|
|
955736b |
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
|
|
955736b |
Date: Fri, 24 Aug 2018 17:18:04 +0100
|
|
|
955736b |
Subject: [PATCH] fix crash when connection fails early
|
|
|
955736b |
MIME-Version: 1.0
|
|
|
955736b |
Content-Type: text/plain; charset=UTF-8
|
|
|
955736b |
Content-Transfer-Encoding: 8bit
|
|
|
955736b |
|
|
|
955736b |
When reading the initial greeting a timer is set in the background. If
|
|
|
955736b |
the connection fails early, we can jump to cleanup code before the timer
|
|
|
955736b |
is disable. The timer will later fire, read a coroutine context from
|
|
|
955736b |
freed memory, and likely jump to somewhere awful with predictably crashy
|
|
|
955736b |
results.
|
|
|
955736b |
|
|
|
955736b |
https://bugzilla.redhat.com/show_bug.cgi?id=1620203
|
|
|
955736b |
|
|
|
955736b |
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
|
955736b |
---
|
|
|
955736b |
src/vncconnection.c | 15 ++++++++++++++-
|
|
|
955736b |
1 file changed, 14 insertions(+), 1 deletion(-)
|
|
|
955736b |
|
|
|
955736b |
diff --git a/src/vncconnection.c b/src/vncconnection.c
|
|
|
955736b |
index b6e13d5..afc1418 100644
|
|
|
955736b |
--- a/src/vncconnection.c
|
|
|
955736b |
+++ b/src/vncconnection.c
|
|
|
955736b |
@@ -319,7 +319,9 @@ static gboolean vnc_connection_timeout(gpointer data)
|
|
|
955736b |
{
|
|
|
955736b |
struct wait_queue *wait = data;
|
|
|
955736b |
|
|
|
955736b |
+ VNC_DEBUG("Connection timeout wakeup start %p", data);
|
|
|
955736b |
g_io_wakeup(wait);
|
|
|
955736b |
+ VNC_DEBUG("Connection timeout wakeup done %p", data);
|
|
|
955736b |
|
|
|
955736b |
return FALSE;
|
|
|
955736b |
}
|
|
|
955736b |
@@ -5318,6 +5320,7 @@ static gboolean vnc_connection_initialize(VncConnection *conn)
|
|
|
955736b |
|
|
|
955736b |
priv->absPointer = TRUE;
|
|
|
955736b |
|
|
|
955736b |
+ VNC_DEBUG("Schedule greeting timeout %p", &priv->wait);
|
|
|
955736b |
timeout = g_timeout_add_seconds(2, vnc_connection_timeout, &priv->wait);
|
|
|
955736b |
want = 12;
|
|
|
955736b |
while (want > 0) {
|
|
|
955736b |
@@ -5369,7 +5372,9 @@ static gboolean vnc_connection_initialize(VncConnection *conn)
|
|
|
955736b |
}
|
|
|
955736b |
|
|
|
955736b |
if (timeout != 0) {
|
|
|
955736b |
+ VNC_DEBUG("Remove timeout %p", &priv->wait);
|
|
|
955736b |
g_source_remove(timeout);
|
|
|
955736b |
+ timeout = 0;
|
|
|
955736b |
}
|
|
|
955736b |
|
|
|
955736b |
version[12] = 0;
|
|
|
955736b |
@@ -5449,6 +5454,11 @@ static gboolean vnc_connection_initialize(VncConnection *conn)
|
|
|
955736b |
return !vnc_connection_has_error(conn);
|
|
|
955736b |
|
|
|
955736b |
fail:
|
|
|
955736b |
+ if (timeout != 0) {
|
|
|
955736b |
+ VNC_DEBUG("Remove timeout %p", &priv->wait);
|
|
|
955736b |
+ g_source_remove(timeout);
|
|
|
955736b |
+ timeout = 0;
|
|
|
955736b |
+ }
|
|
|
955736b |
return !vnc_connection_has_error(conn);
|
|
|
955736b |
}
|
|
|
955736b |
|
|
|
955736b |
@@ -5481,6 +5491,7 @@ static GSocket *vnc_connection_connect_socket(struct wait_queue *wait,
|
|
|
955736b |
if (!sock)
|
|
|
955736b |
return NULL;
|
|
|
955736b |
|
|
|
955736b |
+ VNC_DEBUG("Schedule socket timeout %p", wait);
|
|
|
955736b |
guint timeout = g_timeout_add_seconds(10, vnc_connection_timeout, wait);
|
|
|
955736b |
|
|
|
955736b |
g_socket_set_blocking(sock, FALSE);
|
|
|
955736b |
@@ -5513,8 +5524,10 @@ timeout:
|
|
|
955736b |
sock = NULL;
|
|
|
955736b |
|
|
|
955736b |
end:
|
|
|
955736b |
- if (timeout != 0)
|
|
|
955736b |
+ if (timeout != 0) {
|
|
|
955736b |
+ VNC_DEBUG("Remove timeout %p", wait);
|
|
|
955736b |
g_source_remove(timeout);
|
|
|
955736b |
+ }
|
|
|
955736b |
|
|
|
955736b |
return sock;
|
|
|
955736b |
}
|
|
|
955736b |
--
|
|
|
955736b |
2.17.1
|
|
|
955736b |
|