mirror of
https://gitlab.uni-freiburg.de/opensourcevdi/spice
synced 2025-12-26 22:48:19 +00:00
17096d1dc8
Current master is calling red_channel_destroy() on incoming error, but reds Channels still references it, which causes a double free() later on (see valgrind report below). Instead, on error condition, do like the rest of the channels and call reds_disconnect(), which remove the references and call shutdown(), which then call red_channel_destroy() and finally free the channel with red_channel_destroy(). Note: the previous code intention was certainly to be able to keep the rest of the channels connected when input channel has errors. This is not addressed by this patch. red_channel_shutdown: ==29792== Invalid read of size 8 ==29792== at 0x4C6F063: red_channel_shutdown (red_channel.c:460) ==29792== by 0x4C51EFA: inputs_shutdown (inputs_channel.c:463) ==29792== by 0x4C48445: reds_shatdown_channels (reds.c:539) ==29792== by 0x4C4868A: reds_disconnect (reds.c:603) ==29792== by 0x4C519E9: main_channel_on_error (main_channel.c:765) ==29792== by 0x4C6E80A: red_channel_peer_on_incoming_error (red_channel.c:215) ==29792== by 0x4C6E22D: red_peer_handle_incoming (red_channel.c:87) ==29792== by 0x4C6E551: red_channel_receive (red_channel.c:154) ==29792== by 0x4C6F329: red_channel_event (red_channel.c:531) ==29792== by 0x41CB8C: main_loop_wait (vl.c:1365) ==29792== by 0x437CDE: kvm_main_loop (qemu-kvm.c:1589) ==29792== by 0x41FE9A: main (vl.c:1411) ==29792== Address 0x30b0f6d0 is 0 bytes inside a block of size 28,648 free'd ==29792== at 0x4A05372: free (vg_replace_malloc.c:366) ==29792== by 0x4C6F032: red_channel_destroy (red_channel.c:454) ==29792== by 0x4C6E80A: red_channel_peer_on_incoming_error (red_channel.c:215) ==29792== by 0x4C6E22D: red_peer_handle_incoming (red_channel.c:87) ==29792== by 0x4C6E551: red_channel_receive (red_channel.c:154) ==29792== by 0x4C6F329: red_channel_event (red_channel.c:531) ==29792== by 0x41CB8C: main_loop_wait (vl.c:1365) ==29792== by 0x437CDE: kvm_main_loop (qemu-kvm.c:1589) ==29792== by 0x41FE9A: main (vl.c:1411) https://bugs.freedesktop.org/show_bug.cgi?id=34971 |
||
|---|---|---|
| .. | ||
| tests | ||
| .gitignore | ||
| char_device.h | ||
| demarshallers.h | ||
| glz_encode_match_tmpl.c | ||
| glz_encode_tmpl.c | ||
| glz_encoder_config.h | ||
| glz_encoder_dictionary_protected.h | ||
| glz_encoder_dictionary.c | ||
| glz_encoder_dictionary.h | ||
| glz_encoder.c | ||
| glz_encoder.h | ||
| inputs_channel.c | ||
| inputs_channel.h | ||
| jpeg_encoder.c | ||
| jpeg_encoder.h | ||
| main_channel.c | ||
| main_channel.h | ||
| Makefile.am | ||
| mjpeg_encoder.c | ||
| mjpeg_encoder.h | ||
| red_bitmap_utils.h | ||
| red_channel.c | ||
| red_channel.h | ||
| red_client_cache.h | ||
| red_client_shared_cache.h | ||
| red_common.h | ||
| red_dispatcher.c | ||
| red_dispatcher.h | ||
| red_memslots.c | ||
| red_memslots.h | ||
| red_parse_qxl.c | ||
| red_parse_qxl.h | ||
| red_tunnel_worker.c | ||
| red_tunnel_worker.h | ||
| red_worker.c | ||
| red_worker.h | ||
| reds.c | ||
| reds.h | ||
| smartcard.c | ||
| smartcard.h | ||
| snd_worker.c | ||
| snd_worker.h | ||
| spice-experimental.h | ||
| spice.h | ||
| stat.h | ||
| zlib_encoder.c | ||
| zlib_encoder.h | ||