[Qemu-devel] [PATCH 3/3] vnc: fix possible uninitialized removals

[Tim Hardeck <thardeck@suse.de>]

Some VncState values are not initialized before the Websocket handshake.
If it fails QEMU segfaults during the cleanup. To prevent this behavior
intialization checks are added.

Signed-off-by: Tim Hardeck <thardeck@suse.de>
---
 ui/vnc.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/ui/vnc.c b/ui/vnc.c
index a5c16e0..3af1840 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -1053,20 +1053,26 @@ void vnc_disconnect_finish(VncState *vs)
     audio_del(vs);
     vnc_release_modifiers(vs);
 
-    QTAILQ_REMOVE(&vs->vd->clients, vs, next);
+    if (!QTAILQ_EMPTY(&vs->vd->clients)) {
+        QTAILQ_REMOVE(&vs->vd->clients, vs, next);
+    }
 
     if (QTAILQ_EMPTY(&vs->vd->clients)) {
         dcl->idle = 1;
     }
 
-    qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
+    if (vs->mouse_mode_notifier.notify != NULL) {
+        qemu_remove_mouse_mode_change_notifier(&vs->mouse_mode_notifier);
+    }
     vnc_remove_timer(vs->vd);
     if (vs->vd->lock_key_sync)
         qemu_remove_led_event_handler(vs->led);
     vnc_unlock_output(vs);
 
     qemu_mutex_destroy(&vs->output_mutex);
-    qemu_bh_delete(vs->bh);
+    if (vs->bh != NULL) {
+        qemu_bh_delete(vs->bh);
+    }
     buffer_free(&vs->jobs_buffer);
 
     for (i = 0; i < VNC_STAT_ROWS; ++i) {
-- 
1.7.10.4