diff options
author | Yonit Halperin <yhalperi@redhat.com> | 2013-07-24 14:54:23 -0400 |
---|---|---|
committer | Yonit Halperin <yhalperi@redhat.com> | 2013-07-29 11:35:16 -0400 |
commit | 47e722b85ccd0b6876ca189a3d6f6f05289fe3c3 (patch) | |
tree | f01620860c6c74a6dd0640a3334e729fa7d5ddaf /server/red_channel.h | |
parent | 3ef04806589f51270c96b5cfe4df57e614f1d0be (diff) | |
download | spice-47e722b85ccd0b6876ca189a3d6f6f05289fe3c3.tar.gz spice-47e722b85ccd0b6876ca189a3d6f6f05289fe3c3.tar.xz spice-47e722b85ccd0b6876ca189a3d6f6f05289fe3c3.zip |
red_channel: prevent adding and pushing pipe items after a channel_client has diconnected
Fixes: leaks of pipe items & "red_client_destroy: assertion `rcc->send_data.size == 0'"
red_channel_disconnect clears the pipe. It is called only once. After,
it was called, not items should be added to the pipe.
An example of when this assert can occur:
on_new_cursor_channel (red_worker.c), pushes 2 pipe items.
When it pushes the first pipe item, if the client has disconnected,
it can hit a socket error, and then, red_channel_client_disconnect is called.
The second call to adding a pipe item, will add the item to
the pipe. red_channel_client_pipe_add_type also calls
red_channel_client_push, which will update the send_data.size.
Then, the push will also hit a socket error, but red_channel_client_disconnect
won't clear the pending pipe item again, since it was already called.
When red_client_destory is called, we hit assertion `rcc->send_data.size
== 0'.
Note that if a pipe item is added to the pipe after
red_channel_client_disconnect was called, but without pushing it,
we should hit "spice_assert(rcc->pipe_size == 0)".
Diffstat (limited to 'server/red_channel.h')
0 files changed, 0 insertions, 0 deletions