[Spice-devel] [PATCH 1/3] server/red_channel: release item on red_channel_reset_send_data

[Alon Levy]

This fixes an assertion in red_channel_init_send_data triggered by
the cursor channel. Also a result of frequent client connect/disconnects.
Since we already zero the type field of the header on
red_channel_reset_send_data it foils our check for a pending message
(red_channel_send_message_pending). So simplest to release the item at
the same time we zero the header->type field.
---
 server/red_channel.c |   26 +++++++++++++++-----------
 1 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/server/red_channel.c b/server/red_channel.c
index a700d20..80060ed 100644
--- a/server/red_channel.c
+++ b/server/red_channel.c
@@ -248,8 +248,23 @@ static void red_channel_peer_on_out_block(void *opaque)
                                      SPICE_WATCH_EVENT_WRITE);
 }
 
+static void red_channel_release_item(RedChannel *channel, PipeItem *item, int item_pushed)
+{
+    switch (item->type) {
+        case PIPE_ITEM_TYPE_SET_ACK:
+            free(item);
+            return;
+    }
+    /* only reached if not handled here */
+    channel->release_item(channel, item, item_pushed);
+}
+
 static void red_channel_reset_send_data(RedChannel *channel)
 {
+    if (channel->send_data.item != NULL) {
+        red_channel_release_item(channel, channel->send_data.item, FALSE);
+        channel->send_data.item = NULL;
+    }
     spice_marshaller_reset(channel->send_data.marshaller);
     channel->send_data.header = (SpiceDataHeader *)
         spice_marshaller_reserve_space(channel->send_data.marshaller, sizeof(SpiceDataHeader));
@@ -292,17 +307,6 @@ static void red_channel_send_item(RedChannel *channel, PipeItem *item)
     channel->send_item(channel, item);
 }
 
-static void red_channel_release_item(RedChannel *channel, PipeItem *item, int item_pushed)
-{
-    switch (item->type) {
-        case PIPE_ITEM_TYPE_SET_ACK:
-            free(item);
-            return;
-    }
-    /* only reached if not handled here */
-    channel->release_item(channel, item, item_pushed);
-}
-
 static void red_channel_peer_on_out_msg_done(void *opaque)
 {
     RedChannel *channel = (RedChannel *)opaque;
-- 
1.7.5