summaryrefslogtreecommitdiffstats
path: root/server/red_channel.h
diff options
context:
space:
mode:
authorYonit Halperin <yhalperi@redhat.com>2013-07-24 14:54:23 -0400
committerYonit Halperin <yhalperi@redhat.com>2013-07-29 11:35:16 -0400
commit47e722b85ccd0b6876ca189a3d6f6f05289fe3c3 (patch)
treef01620860c6c74a6dd0640a3334e729fa7d5ddaf /server/red_channel.h
parent3ef04806589f51270c96b5cfe4df57e614f1d0be (diff)
downloadspice-47e722b85ccd0b6876ca189a3d6f6f05289fe3c3.tar.gz
spice-47e722b85ccd0b6876ca189a3d6f6f05289fe3c3.tar.xz
spice-47e722b85ccd0b6876ca189a3d6f6f05289fe3c3.zip
red_channel: prevent adding and pushing pipe items after a channel_client has diconnected
Fixes: leaks of pipe items & "red_client_destroy: assertion `rcc->send_data.size == 0'" red_channel_disconnect clears the pipe. It is called only once. After, it was called, not items should be added to the pipe. An example of when this assert can occur: on_new_cursor_channel (red_worker.c), pushes 2 pipe items. When it pushes the first pipe item, if the client has disconnected, it can hit a socket error, and then, red_channel_client_disconnect is called. The second call to adding a pipe item, will add the item to the pipe. red_channel_client_pipe_add_type also calls red_channel_client_push, which will update the send_data.size. Then, the push will also hit a socket error, but red_channel_client_disconnect won't clear the pending pipe item again, since it was already called. When red_client_destory is called, we hit assertion `rcc->send_data.size == 0'. Note that if a pipe item is added to the pipe after red_channel_client_disconnect was called, but without pushing it, we should hit "spice_assert(rcc->pipe_size == 0)".
Diffstat (limited to 'server/red_channel.h')
0 files changed, 0 insertions, 0 deletions