87 lines
2.7 KiB
Diff
87 lines
2.7 KiB
Diff
From ac1960bcc8e2678c0431d11eb7603ad674937f6d Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
|
Date: Fri, 24 Aug 2018 17:18:04 +0100
|
|
Subject: [PATCH] fix crash when connection fails early
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
When reading the initial greeting a timer is set in the background. If
|
|
the connection fails early, we can jump to cleanup code before the timer
|
|
is disable. The timer will later fire, read a coroutine context from
|
|
freed memory, and likely jump to somewhere awful with predictably crashy
|
|
results.
|
|
|
|
https://bugzilla.redhat.com/show_bug.cgi?id=1620203
|
|
|
|
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
(cherry picked from commit 06a27a4fb52653b4cbf67b75b8116cf6692b435d)
|
|
---
|
|
src/vncconnection.c | 15 ++++++++++++++-
|
|
1 file changed, 14 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/vncconnection.c b/src/vncconnection.c
|
|
index b6e13d5..afc1418 100644
|
|
--- a/src/vncconnection.c
|
|
+++ b/src/vncconnection.c
|
|
@@ -319,7 +319,9 @@ static gboolean vnc_connection_timeout(gpointer data)
|
|
{
|
|
struct wait_queue *wait = data;
|
|
|
|
+ VNC_DEBUG("Connection timeout wakeup start %p", data);
|
|
g_io_wakeup(wait);
|
|
+ VNC_DEBUG("Connection timeout wakeup done %p", data);
|
|
|
|
return FALSE;
|
|
}
|
|
@@ -5318,6 +5320,7 @@ static gboolean vnc_connection_initialize(VncConnection *conn)
|
|
|
|
priv->absPointer = TRUE;
|
|
|
|
+ VNC_DEBUG("Schedule greeting timeout %p", &priv->wait);
|
|
timeout = g_timeout_add_seconds(2, vnc_connection_timeout, &priv->wait);
|
|
want = 12;
|
|
while (want > 0) {
|
|
@@ -5369,7 +5372,9 @@ static gboolean vnc_connection_initialize(VncConnection *conn)
|
|
}
|
|
|
|
if (timeout != 0) {
|
|
+ VNC_DEBUG("Remove timeout %p", &priv->wait);
|
|
g_source_remove(timeout);
|
|
+ timeout = 0;
|
|
}
|
|
|
|
version[12] = 0;
|
|
@@ -5449,6 +5454,11 @@ static gboolean vnc_connection_initialize(VncConnection *conn)
|
|
return !vnc_connection_has_error(conn);
|
|
|
|
fail:
|
|
+ if (timeout != 0) {
|
|
+ VNC_DEBUG("Remove timeout %p", &priv->wait);
|
|
+ g_source_remove(timeout);
|
|
+ timeout = 0;
|
|
+ }
|
|
return !vnc_connection_has_error(conn);
|
|
}
|
|
|
|
@@ -5481,6 +5491,7 @@ static GSocket *vnc_connection_connect_socket(struct wait_queue *wait,
|
|
if (!sock)
|
|
return NULL;
|
|
|
|
+ VNC_DEBUG("Schedule socket timeout %p", wait);
|
|
guint timeout = g_timeout_add_seconds(10, vnc_connection_timeout, wait);
|
|
|
|
g_socket_set_blocking(sock, FALSE);
|
|
@@ -5513,8 +5524,10 @@ timeout:
|
|
sock = NULL;
|
|
|
|
end:
|
|
- if (timeout != 0)
|
|
+ if (timeout != 0) {
|
|
+ VNC_DEBUG("Remove timeout %p", wait);
|
|
g_source_remove(timeout);
|
|
+ }
|
|
|
|
return sock;
|
|
}
|