[Qemu-devel] [PATCH] input: free InputEvent when it can't be inserted into a full kdb queue

[田殿臣 <dianchen.tdc@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1079 bytes --]

>From e8c03f405c2112428e79bb82064c7b7743d0cc86 Mon Sep 17 00:00:00 2001
From: Tian Dianchen <dianchen.tdc@gmail.com>
Date: Tue, 5 Dec 2017 14:03:53 +0800
Subject: [PATCH] input: free InputEvent when it can't be inserted into a
full
 kdb queue

When the kdb queue is full, the evt can't be placed in it, so it should
be released to free the memory.

Impact: Without this limit vnc clients can exhaust host memory by keep
sending keyboard events when kdb queue is full.

Reviewed-by: Zhang Chao <icymemo@gmail.com>
Reviewed-by: Quan Xu <quan.xu0@gmail.com>
Signed-off-by: Tian Dianchen <dianchen.tdc@gmail.com>
---
 ui/input.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ui/input.c b/ui/input.c
index 3e2d324..e5b78aa 100644
--- a/ui/input.c
+++ b/ui/input.c
@@ -421,6 +421,8 @@ void qemu_input_event_send_key(QemuConsole *src,
KeyValue *key, bool down)
     } else if (queue_count < queue_limit) {
         qemu_input_queue_event(&kbd_queue, src, evt);
         qemu_input_queue_sync(&kbd_queue);
+    } else {
+        qapi_free_InputEvent(evt);
     }
 }

-- 
1.8.3.1

[-- Attachment #2: 0001-input-free-InputEvent-when-it-can-t-be-inserted-into.patch --]
[-- Type: application/octet-stream, Size: 1080 bytes --]

From e8c03f405c2112428e79bb82064c7b7743d0cc86 Mon Sep 17 00:00:00 2001
From: Tian Dianchen <dianchen.tdc@gmail.com>
Date: Tue, 5 Dec 2017 14:03:53 +0800
Subject: [PATCH] input: free InputEvent when it can't be inserted into a full
 kdb queue

When the kdb queue is full, the evt can't be placed in it, so it should
be released to free the memory.

Impact: Without this limit vnc clients can exhaust host memory by keep
sending keyboard events when kdb queue is full.

Reviewed-by: Zhang Chao <icymemo@gmail.com>
Reviewed-by: Quan Xu <quan.xu0@gmail.com>
Signed-off-by: Tian Dianchen <dianchen.tdc@gmail.com>
---
 ui/input.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ui/input.c b/ui/input.c
index 3e2d324..e5b78aa 100644
--- a/ui/input.c
+++ b/ui/input.c
@@ -421,6 +421,8 @@ void qemu_input_event_send_key(QemuConsole *src, KeyValue *key, bool down)
     } else if (queue_count < queue_limit) {
         qemu_input_queue_event(&kbd_queue, src, evt);
         qemu_input_queue_sync(&kbd_queue);
+    } else {
+        qapi_free_InputEvent(evt);
     }
 }
 
-- 
1.8.3.1