[Spice-devel] [PATCH spice-server 2/3] red-worker: Do not leak memory for surface commands

[Christophe Fergeau]

On Tue, Jan 10, 2017 at 03:59:37PM +0000, Frediano Ziglio wrote:
> This happened during VM resume.
> RedSurfaceCmd were allocated but never freed.

I'd add something like "We don't need to malloc the RedSurfaceCmd used
in handle_dev_close() as display_channel_process_surface_cmd() will not
try to reference it after it has returned".

Acked-by: Christophe Fergeau <cfergeau at redhat.com>

> 
> Signed-off-by: Frediano Ziglio <fziglio at redhat.com>
> ---
>  server/red-worker.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/server/red-worker.c b/server/red-worker.c
> index 1cd6250..394a935 100644
> --- a/server/red-worker.c
> +++ b/server/red-worker.c
> @@ -984,19 +984,19 @@ static void handle_dev_close(void *opaque, void *payload)
>  
>  static int loadvm_command(RedWorker *worker, QXLCommandExt *ext)
>  {
> -    RedSurfaceCmd *surface_cmd;
> +    RedSurfaceCmd surface_cmd;
>  
>      switch (ext->cmd.type) {
>      case QXL_CMD_CURSOR:
>          return red_process_cursor_cmd(worker, ext);
>  
>      case QXL_CMD_SURFACE:
> -        surface_cmd = spice_new0(RedSurfaceCmd, 1);
> -        if (red_get_surface_cmd(&worker->mem_slots, ext->group_id, surface_cmd, ext->cmd.data)) {
> -            free(surface_cmd);
> +        if (red_get_surface_cmd(&worker->mem_slots, ext->group_id, &surface_cmd, ext->cmd.data)) {
>              return FALSE;
>          }
> -        display_channel_process_surface_cmd(worker->display_channel, surface_cmd, TRUE);
> +        display_channel_process_surface_cmd(worker->display_channel, &surface_cmd, TRUE);
> +        // do not release resource as is released inside display_channel_process_surface_cmd
> +        red_put_surface_cmd(&surface_cmd);
>          break;
>      default:
>          spice_warning("unhandled loadvm command type (%d)", ext->cmd.type);
> -- 
> 2.9.3
> 
> _______________________________________________
> Spice-devel mailing list
> Spice-devel at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/spice-devel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: not available
URL: <https://lists.freedesktop.org/archives/spice-devel/attachments/20170120/9eeac200/attachment.sig>