Go to file
Marc-André Lureau 28f3007145 Revert "server/red_channel: red_channel_event: push on blocked"
This reverts commit 5062433d8a.

red_channel_receive() can call red_channel_destroy() which frees
channel.

The condition bellow is then checked, which can access a freed
channel:

if (event & SPICE_WATCH_EVENT_WRITE || channel->send_data.blocked)

Reverting this commit solves the issue without any apparent
bugs/drawbacks, which kind of clears out the weird TODO.

handle_dev_input: cursor connect
==11826== Invalid read of size 4
==11826==    at 0x4C6F83C: red_channel_event (red_channel.c:535)
==11826==    by 0x41CB8C: main_loop_wait (vl.c:1365)
==11826==    by 0x437CDE: kvm_main_loop (qemu-kvm.c:1589)
==11826==    by 0x41FE9A: main (vl.c:1411)
==11826==  Address 0x31fb00f0 is 96 bytes inside a block of size 28,648 free'd
==11826==    at 0x4A05372: free (vg_replace_malloc.c:366)
==11826==    by 0x4C6F536: red_channel_destroy (red_channel.c:453)
==11826==    by 0x4C52B5D: inputs_channel_on_incoming_error (inputs_channel.c:449)
==11826==    by 0x4C6ED0E: red_channel_peer_on_incoming_error (red_channel.c:215)
==11826==    by 0x4C6E731: red_peer_handle_incoming (red_channel.c:87)
==11826==    by 0x4C6EA55: red_channel_receive (red_channel.c:154)
==11826==    by 0x4C6F82D: red_channel_event (red_channel.c:530)
==11826==    by 0x41CB8C: main_loop_wait (vl.c:1365)
==11826==    by 0x437CDE: kvm_main_loop (qemu-kvm.c:1589)
==11826==    by 0x41FE9A: main (vl.c:1411)
==11826==

https://bugs.freedesktop.org/show_bug.cgi?id=34971
2011-03-03 14:59:31 +01:00
client x11: Use _exit rather then exit on X errors (rhbz#680763) 2011-03-01 18:08:20 +02:00
common ring: add RING_FOREACH{,_SAFE,_REVERSED} 2011-03-02 17:27:52 +02:00
python_modules demarshaller/marshaller fix gcc 4.6.0 2011-01-25 17:29:31 +02:00
server Revert "server/red_channel: red_channel_event: push on blocked" 2011-03-03 14:59:31 +01:00
tests tests/migrate.py: refactor to allow importing for later use 2011-02-11 19:13:03 +02:00
tools Relicense everything from GPL to LGPL 2.1+ 2010-04-13 22:22:15 +02:00
uncrustify_cfg fresh start 2009-10-14 15:06:41 +02:00
.gitignore gitignore: add generated_*, vim temps, pyc 2010-11-08 16:06:55 +02:00
AUTHORS fresh start 2009-10-14 15:06:41 +02:00
autogen.sh autogen: exit upon errors (subdir config) 2010-03-24 14:03:51 +01:00
ChangeLog fresh start 2009-10-14 15:06:41 +02:00
configure.ac build: add --with-sasl 2011-02-28 16:36:35 +01:00
COPYING Relicense everything from GPL to LGPL 2.1+ 2010-04-13 22:22:15 +02:00
GITVERSION Add --enable-werror and make it the default only for git builds 2010-07-09 12:14:32 +02:00
Makefile.am Make distcheck work 2010-07-08 20:20:35 +02:00
NEWS Release 0.6.3 2010-10-18 14:52:43 +02:00
README Relicense everything from GPL to LGPL 2.1+ 2010-04-13 22:22:15 +02:00
spice1.proto spice-client migration: fix minor for old migration support. 2011-01-27 18:26:09 +02:00
spice_codegen.py Make pointers 32bit in new protocol format 2010-06-23 16:33:07 +02:00
spice-server.pc.in Rename .so spice-server.so 2010-03-24 17:13:42 +01:00
spice.proto smartcard: add to spice.proto 2010-12-07 13:31:30 +02:00

Copyright 2009 Red Hat, Inc. and/or its affiliates.

This program and libraries is free software; you can redistribute it
and/or modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.

This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public
License along with this library; if not, see <http://www.gnu.org/licenses/>.