[Qemu-devel] [PULL for-2.5 0/1] vnc: fix segfault

[Qemu-devel] [PULL for-2.5 0/1] vnc: fix segfault

[Gerd Hoffmann]

  Hi,

Here is the vnc patch queue with a single fix for 2.5

please pull,
  Gerd

The following changes since commit 4b6eda626fdb8bf90472c6868d502a2ac09abeeb:

  Merge remote-tracking branch 'remotes/lalrae/tags/mips-20151124' into staging (2015-11-24 17:05:06 +0000)

are available in the git repository at:


  git://git.kraxel.org/qemu tags/pull-vnc-20151126-1

for you to fetch changes up to 7fe4a41c262e2529dc79f77f6fe63c5309fa2fd9:

  vnc: fix segfault (2015-11-26 08:32:11 +0100)

----------------------------------------------------------------
vnc: fix segfault

----------------------------------------------------------------
Gerd Hoffmann (1):
      vnc: fix segfault

 ui/vnc.c | 5 +++++
 1 file changed, 5 insertions(+)

[Qemu-devel] [PULL 1/1] vnc: fix segfault

[Gerd Hoffmann]

Commit "c7628bf vnc: only alloc server surface with clients connected"
missed one rarely used codepath (cirrus with guest drivers using 2d
accel) where we have to check for the server surface being present,
to avoid qemu crashing with a NULL pointer dereference.  Add the check.

Reported-by: Anthony PERARD <anthony.perard@citrix.com>
Tested-by: Anthony PERARD <anthony.perard@citrix.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 ui/vnc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/ui/vnc.c b/ui/vnc.c
index c9f2fed..7538405 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -931,6 +931,11 @@ static void vnc_dpy_copy(DisplayChangeListener *dcl,
     int i, x, y, pitch, inc, w_lim, s;
     int cmp_bytes;
 
+    if (!vd->server) {
+        /* no client connected */
+        return;
+    }
+
     vnc_refresh_server_surface(vd);
     QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
         if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
-- 
1.8.3.1

Re: [Qemu-devel] [PULL for-2.5 0/1] vnc: fix segfault

[Peter Maydell]

On 26 November 2015 at 09:59, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> Here is the vnc patch queue with a single fix for 2.5
>
> please pull,
>   Gerd
>
> The following changes since commit 4b6eda626fdb8bf90472c6868d502a2ac09abeeb:
>
>   Merge remote-tracking branch 'remotes/lalrae/tags/mips-20151124' into staging (2015-11-24 17:05:06 +0000)
>
> are available in the git repository at:
>
>
>   git://git.kraxel.org/qemu tags/pull-vnc-20151126-1
>
> for you to fetch changes up to 7fe4a41c262e2529dc79f77f6fe63c5309fa2fd9:
>
>   vnc: fix segfault (2015-11-26 08:32:11 +0100)
>
> ----------------------------------------------------------------
> vnc: fix segfault
>
> ----------------------------------------------------------------
> Gerd Hoffmann (1):
>       vnc: fix segfault
>
>  ui/vnc.c | 5 +++++
>  1 file changed, 5 insertions(+)
>

Applied, thanks.

-- PMM