From 0c5eca97f16ec6a1364d4796e2c0ca2a92e4e27c Mon Sep 17 00:00:00 2001 From: Frediano Ziglio Date: Tue, 31 May 2016 13:05:54 +0100 Subject: [PATCH] Handle flow control without crashing for agent RedCharDevice used for the agent has flow control enabled. This make possible for red_char_device_write_buffer_get to return NULL. Handle such situation without crashing avoiding NULL dereference. This fixes https://bugs.freedesktop.org/show_bug.cgi?id=95416. Signed-off-by: Frediano Ziglio Acked-by: Uri Lublin --- server/reds.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/server/reds.c b/server/reds.c index 74deb588..827ba2aa 100644 --- a/server/reds.c +++ b/server/reds.c @@ -1120,6 +1120,11 @@ uint8_t *reds_get_agent_data_buffer(RedsState *reds, MainChannelClient *mcc, siz dev->priv->recv_from_client_buf = red_char_device_write_buffer_get(RED_CHAR_DEVICE(dev), client, size + sizeof(VDIChunkHeader)); + /* check if buffer was allocated, as flow control is enabled for + * this device this is a normal condition */ + if (!dev->priv->recv_from_client_buf) { + return NULL; + } dev->priv->recv_from_client_buf_pushed = FALSE; return dev->priv->recv_from_client_buf->buf + sizeof(VDIChunkHeader); }