pxcloud/spice
6
0
Fork 0
mirror of https://gitlab.uni-freiburg.de/opensourcevdi/spice synced 2026-08-10 10:44:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Prevent memory leak if red_get_data_chunks_ptr fails

Browse Source 
Free linked list if client tries to do nasty things

Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Acked-by: Christophe Fergeau <cfergeau@redhat.com>
This commit is contained in:
Frediano Ziglio 2015-09-08 12:14:55 +01:00
parent 3738478ed7
commit f3605979ce
1 changed files with 20 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
server/red_parse_qxl.c
View File

@ -107,34 +107,43 @@ static size_t red_get_data_chunks_ptr(RedMemSlotInfo *slots, int group_id,
red->data_size = qxl->data_size;
data_size += red->data_size;
red->data = qxl->data;
red->prev_chunk = red->next_chunk = NULL;
if (!validate_virt(slots, (intptr_t)red->data, memslot_id, red->data_size, group_id)) {
red->data = NULL;
return 0;
}
red->prev_chunk = NULL;
while ((next_chunk = qxl->next_chunk) != 0) {
red_prev = red;
red = spice_new(RedDataChunk, 1);
red = spice_new0(RedDataChunk, 1);
red->prev_chunk = red_prev;
red_prev->next_chunk = red;
memslot_id = get_memslot_id(slots, next_chunk);
qxl = (QXLDataChunk *)get_virt(slots, next_chunk, sizeof(*qxl), group_id,
&error);
if (error) {
return 0;
}
if (error)
goto error;
red->data_size = qxl->data_size;
data_size += red->data_size;
red->data = qxl->data;
if (!validate_virt(slots, (intptr_t)red->data, memslot_id, red->data_size, group_id)) {
red->data = NULL;
return 0;
}
red->prev_chunk = red_prev;
red_prev->next_chunk = red;
if (!validate_virt(slots, (intptr_t)red->data, memslot_id, red->data_size, group_id))
goto error;
}
red->next_chunk = NULL;
return data_size;
error:
while (red->prev_chunk) {
red_prev = red->prev_chunk;
free(red);
red = red_prev;
}
red->data_size = 0;
red->next_chunk = NULL;
red->data = NULL;
return 0;
}
static size_t red_get_data_chunks(RedMemSlotInfo *slots, int group_id,