diff options
| author | runge <runge> | 2008-06-24 22:33:41 +0000 |
|---|---|---|
| committer | runge <runge> | 2008-06-24 22:33:41 +0000 |
| commit | dbfa4ad1f78f6133bc5f50e766f7f3bfdb8fa049 (patch) | |
| tree | b05c0734db9d8558f6b3de010d95766a68746a55 /libvncserver | |
| parent | 975b6902344216c2e4b0e1a38320b822639640dc (diff) | |
| download | libtdevnc-dbfa4ad1f78f6133bc5f50e766f7f3bfdb8fa049.tar.gz libtdevnc-dbfa4ad1f78f6133bc5f50e766f7f3bfdb8fa049.zip | |
We seem to need to guard against freeing iterator 'i' twice in rfbSendFramebufferUpdate() (italc reported bug)
Diffstat (limited to 'libvncserver')
| -rw-r--r-- | libvncserver/rfbserver.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/libvncserver/rfbserver.c b/libvncserver/rfbserver.c index 767b673..1fc90c1 100644 --- a/libvncserver/rfbserver.c +++ b/libvncserver/rfbserver.c @@ -2631,7 +2631,7 @@ rfbSendFramebufferUpdate(rfbClientPtr cl, rows = (h-1)/cl->correMaxHeight+1; nUpdateRegionRects += rectsPerRow*rows; } - sraRgnReleaseIterator(i); + sraRgnReleaseIterator(i); i=NULL; } else if (cl->preferredEncoding == rfbEncodingUltra) { nUpdateRegionRects = 0; @@ -2645,7 +2645,7 @@ rfbSendFramebufferUpdate(rfbClientPtr cl, rfbScaledCorrection(cl->screen, cl->scaledScreen, &x, &y, &w, &h, "rfbSendFramebufferUpdate"); nUpdateRegionRects += (((h-1) / (ULTRA_MAX_SIZE( w ) / w)) + 1); } - sraRgnReleaseIterator(i); + sraRgnReleaseIterator(i); i=NULL; #ifdef LIBVNCSERVER_HAVE_LIBZ } else if (cl->preferredEncoding == rfbEncodingZlib) { nUpdateRegionRects = 0; @@ -2660,7 +2660,7 @@ rfbSendFramebufferUpdate(rfbClientPtr cl, rfbScaledCorrection(cl->screen, cl->scaledScreen, &x, &y, &w, &h, "rfbSendFramebufferUpdate"); nUpdateRegionRects += (((h-1) / (ZLIB_MAX_SIZE( w ) / w)) + 1); } - sraRgnReleaseIterator(i); + sraRgnReleaseIterator(i); i=NULL; #ifdef LIBVNCSERVER_HAVE_LIBJPEG } else if (cl->preferredEncoding == rfbEncodingTight) { nUpdateRegionRects = 0; @@ -2681,7 +2681,7 @@ rfbSendFramebufferUpdate(rfbClientPtr cl, } nUpdateRegionRects += n; } - sraRgnReleaseIterator(i); + sraRgnReleaseIterator(i); i=NULL; #endif #endif } else { @@ -2806,6 +2806,10 @@ rfbSendFramebufferUpdate(rfbClientPtr cl, #endif } } + if (i) { + sraRgnReleaseIterator(i); + i = NULL; + } if ( nUpdateRegionRects == 0xFFFF && !rfbSendLastRectMarker(cl) ) |