[Spice-devel] [PATCH 2/4] do not crash if client send spurious messages

Frediano Ziglio fziglio at redhat.com
Fri Feb 5 15:41:54 UTC 2016


Reduce critical message to a warning.
This condition can be easily be trigger by malicious clients.
This patch could be squashed in another.

Signed-off-by: Frediano Ziglio <fziglio at redhat.com>
---
 server/dcc.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/server/dcc.c b/server/dcc.c
index 750e2e8..2367c5e 100644
--- a/server/dcc.c
+++ b/server/dcc.c
@@ -1402,7 +1402,11 @@ static int dcc_handle_gl_draw_done(DisplayChannelClient *dcc)
 {
     DisplayChannel *display = DCC_TO_DC(dcc);
 
-    g_return_val_if_fail(dcc->gl_draw_ongoing, FALSE);
+    if (G_UNLIKELY(!dcc->gl_draw_ongoing)) {
+        g_warning("unexpected DRAW_DONE received\n");
+        /* close client connection */
+        return FALSE;
+    }
 
     dcc->gl_draw_ongoing = FALSE;
     display_channel_gl_draw_done(display);
-- 
2.5.0



More information about the Spice-devel mailing list