From 667be092d7518a21edd216080bc10e06a81453e4 Mon Sep 17 00:00:00 2001
From: Alon Levy <alevy@redhat.com>
Date: Sun, 13 May 2012 14:42:48 +0300
Subject: [PATCH] 0.10.1-4 double free fix RHBZ 808936

---
 ...r-don-t-release-self_bitmap-unless-r.patch | 35 +++++++++++++++++++
 spice.spec                                    |  8 ++++-
 2 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 0005-server-red_worker-don-t-release-self_bitmap-unless-r.patch

diff --git a/0005-server-red_worker-don-t-release-self_bitmap-unless-r.patch b/0005-server-red_worker-don-t-release-self_bitmap-unless-r.patch
new file mode 100644
index 0000000..e57c890
--- /dev/null
+++ b/0005-server-red_worker-don-t-release-self_bitmap-unless-r.patch
@@ -0,0 +1,35 @@
+From ba3e9b3d792145283ff125b111b013ba392cdcbe Mon Sep 17 00:00:00 2001
+From: Yonit Halperin <yhalperi@redhat.com>
+Date: Sun, 13 May 2012 14:21:28 +0300
+Subject: [PATCH] server/red_worker: don't release self_bitmap unless refcount
+ is 0
+
+RHBZ: 808936
+---
+ server/red_worker.c |    7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/server/red_worker.c b/server/red_worker.c
+index 473d0d6..60f30d3 100644
+--- a/server/red_worker.c
++++ b/server/red_worker.c
+@@ -1695,13 +1695,12 @@ static inline void put_red_drawable(RedWorker *worker, RedDrawable *drawable, ui
+ {
+     QXLReleaseInfoExt release_info_ext;
+ 
+-    if (self_bitmap) {
+-        red_put_image(self_bitmap);
+-    }
+     if (--drawable->refs) {
+         return;
+     }
+-
++    if (self_bitmap) {
++        red_put_image(self_bitmap);
++    }
+     worker->red_drawable_count--;
+     release_info_ext.group_id = group_id;
+     release_info_ext.info = drawable->release_info;
+-- 
+1.7.10.1
+
diff --git a/spice.spec b/spice.spec
index 7bf466e..075852b 100644
--- a/spice.spec
+++ b/spice.spec
@@ -1,6 +1,6 @@
 Name:           spice
 Version:        0.10.1
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        Implements the SPICE protocol
 Group:          User Interface/Desktops
 License:        LGPLv2+
@@ -11,6 +11,7 @@ Patch0:         0001-server-red_memslots-drop-two-unused-functions.patch
 Patch1:         0002-server-red_memslots-use-QXLPHYSICAL-for-addresses.patch
 Patch2:         0003-server-red_worker-fix-for-case-where-ASSERT-is-compi.patch
 Patch3:         0004-server-red_memslots-don-t-assume-64-bit-environment.patch
+Patch4:         0005-server-red_worker-don-t-release-self_bitmap-unless-r.patch
 
 # https://bugzilla.redhat.com/show_bug.cgi?id=613529
 ExclusiveArch:  i686 x86_64
@@ -75,6 +76,7 @@ using spice-server, you will need to install spice-server-devel.
 %patch1 -p1
 %patch2 -p1
 %patch3 -p1
+%patch4 -p1
 
 %build
 %configure --enable-gui --enable-smartcard
@@ -117,6 +119,10 @@ fi
 %{_libdir}/libspice-server.so
 %{_libdir}/pkgconfig/spice-server.pc
 
+%changelog
+* Tue May 13 2012 Alon Levy <alevy@redhat.com>
+- Add double free fix. (#808936)
+
 %changelog
 * Tue Apr 24 2012 Alon Levy <alevy@redhat.com>
 - Add 32 bit fixes from git master. (#815717)