diff options
| author | Alon Levy <alevy@redhat.com> | 2012-02-15 15:04:04 +0200 |
|---|---|---|
| committer | Alon Levy <alevy@redhat.com> | 2012-02-15 15:04:04 +0200 |
| commit | 5ec8515508828ecf5055de220cb0cc0f3c997a27 (patch) | |
| tree | 465540d21306875d200f91401691676d26987d5c /server/main_dispatcher.c | |
| parent | bdd3bf8777d09c704ff691827c391feb76b05598 (diff) | |
| download | spice-5ec8515508828ecf5055de220cb0cc0f3c997a27.tar.gz spice-5ec8515508828ecf5055de220cb0cc0f3c997a27.tar.xz spice-5ec8515508828ecf5055de220cb0cc0f3c997a27.zip | |
server, separate SpiceChannelEventInfo from RedStream
fixes rhbz 790749 use after free of SpiceChannelEventInfo.
The lifetime of the SpiceChannelEventInfo was that of RedsStream, but it
is used by main_dispatcher_handle_channel_event after the RedsStream is
freed for the cursor and display channels. Making SCEI allocation be at
RedsStream allocation, and deallocation after the DESTROY event is
processed by core->channel_event, fixes use after free.
Diffstat (limited to 'server/main_dispatcher.c')
| -rw-r--r-- | server/main_dispatcher.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/server/main_dispatcher.c b/server/main_dispatcher.c index cf44b408..f5b8b4c4 100644 --- a/server/main_dispatcher.c +++ b/server/main_dispatcher.c @@ -52,6 +52,9 @@ static void main_dispatcher_self_handle_channel_event( SpiceChannelEventInfo *info) { main_dispatcher.core->channel_event(event, info); + if (event == SPICE_CHANNEL_EVENT_DISCONNECTED) { + free(info); + } } static void main_dispatcher_handle_channel_event(void *opaque, |