pxcloud/spice
5
0
Fork 0
mirror of https://gitlab.uni-freiburg.de/opensourcevdi/spice synced 2025-12-31 20:04:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

dcc: Fix NULL pointer dereference attempting to connect duplicate channels

Browse Source 
You could easily trigger this issue using multiple monitors and
a modified spice-gtk client with this patch:

--- a/src/channel-main.c
+++ b/src/channel-main.c
@@ -1699,6 +1699,7 @@ static gboolean _channel_new(channel_new_t *c)
 {
     g_return_val_if_fail(c != NULL, FALSE);

+    if (c->type == SPICE_CHANNEL_DISPLAY) c->id = 0;
     spice_channel_new(c->session, c->type, c->id);

     g_object_unref(c->session);

This as g_initable_new in this case returns NULL (dcc.c).

Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
This commit is contained in:
Frediano Ziglio 2017-08-30 09:17:05 +01:00
parent abe3e2f422
commit bfb6601348
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
server/dcc.c
View File

@ -518,7 +518,9 @@ DisplayChannelClient *dcc_new(DisplayChannel *display,
NULL);
spice_debug("New display (client %p) dcc %p stream %p", client, dcc, stream);
common_graphics_channel_set_during_target_migrate(COMMON_GRAPHICS_CHANNEL(display), mig_target);
dcc->priv->id = common_graphics_channel_get_qxl(COMMON_GRAPHICS_CHANNEL(display))->id;
if (dcc) {
dcc->priv->id = common_graphics_channel_get_qxl(COMMON_GRAPHICS_CHANNEL(display))->id;
}
return dcc;
}