Merge branches 'fix' and 'fix-double-free-fences' of https://github.com/michalsrb/tigervnc

common/rfb/CConnection.cxx

@@ -44,7 +44,6 @@ CConnection::CConnection()
     state_(RFBSTATE_UNINITIALISED), useProtocol3_3(false),
     framebuffer(NULL), decoder(this)
 {
-  security = new SecurityClient();
 }
 
 CConnection::~CConnection()
@@ -167,7 +166,7 @@ void CConnection::processSecurityTypesMsg()
   int secType = secTypeInvalid;
 
   std::list<rdr::U8> secTypes;
-  secTypes = security->GetEnabledSecTypes();
+  secTypes = security.GetEnabledSecTypes();
 
   if (cp.isVersion(3,3)) {
 
@@ -235,7 +234,7 @@ void CConnection::processSecurityTypesMsg()
   }
 
   state_ = RFBSTATE_SECURITY;
-  csecurity = security->GetCSecurity(secType);
+  csecurity = security.GetCSecurity(secType);
   processSecurityMsg();
 }
 

common/rfb/CConnection.h

@@ -26,6 +26,7 @@
 
 #include <rfb/CMsgHandler.h>
 #include <rfb/DecodeManager.h>
+#include <rfb/SecurityClient.h>
 #include <rfb/util.h>
 
 namespace rfb {
@@ -34,7 +35,6 @@ namespace rfb {
   class CMsgWriter;
   class CSecurity;
   class IdentityVerifier;
-  class SecurityClient;
 
   class CConnection : public CMsgHandler {
   public:
@@ -148,7 +148,7 @@ namespace rfb {
     stateEnum state() { return state_; }
 
     CSecurity *csecurity;
-    SecurityClient *security;
+    SecurityClient security;
   protected:
     void setState(stateEnum s) { state_ = s; }
 

common/rfb/SConnection.cxx

@@ -51,7 +51,7 @@ const SConnection::AccessRights SConnection::AccessFull           = 0xffff;
 SConnection::SConnection()
   : readyForSetColourMapEntries(false),
     is(0), os(0), reader_(0), writer_(0),
-    security(0), ssecurity(0), state_(RFBSTATE_UNINITIALISED),
+    ssecurity(0), state_(RFBSTATE_UNINITIALISED),
     preferredEncoding(encodingRaw)
 {
   defaultMajorVersion = 3;
@@ -60,8 +60,6 @@ SConnection::SConnection()
     defaultMinorVersion = 3;
 
   cp.setVersion(defaultMajorVersion, defaultMinorVersion);
-
-  security = new SecurityServer();
 }
 
 SConnection::~SConnection()
@@ -142,7 +140,7 @@ void SConnection::processVersionMsg()
 
   std::list<rdr::U8> secTypes;
   std::list<rdr::U8>::iterator i;
-  secTypes = security->GetEnabledSecTypes();
+  secTypes = security.GetEnabledSecTypes();
 
   if (cp.isVersion(3,3)) {
 
@@ -161,7 +159,7 @@ void SConnection::processVersionMsg()
     os->writeU32(*i);
     if (*i == secTypeNone) os->flush();
     state_ = RFBSTATE_SECURITY;
-    ssecurity = security->GetSSecurity(*i);
+    ssecurity = security.GetSSecurity(*i);
     processSecurityMsg();
     return;
   }
@@ -193,7 +191,7 @@ void SConnection::processSecurityType(int secType)
   std::list<rdr::U8> secTypes;
   std::list<rdr::U8>::iterator i;
 
-  secTypes = security->GetEnabledSecTypes();
+  secTypes = security.GetEnabledSecTypes();
   for (i=secTypes.begin(); i!=secTypes.end(); i++)
     if (*i == secType) break;
   if (i == secTypes.end())
@@ -204,7 +202,7 @@ void SConnection::processSecurityType(int secType)
 
   try {
     state_ = RFBSTATE_SECURITY;
-    ssecurity = security->GetSSecurity(secType);
+    ssecurity = security.GetSSecurity(secType);
   } catch (rdr::Exception& e) {
     throwConnFailedException(e.str());
   }

common/rfb/SConnection.h

@@ -196,7 +196,7 @@ namespace rfb {
     rdr::OutStream* os;
     SMsgReader* reader_;
     SMsgWriter* writer_;
-    SecurityServer *security;
+    SecurityServer security;
     SSecurity* ssecurity;
     stateEnum state_;
     rdr::S32 preferredEncoding;

common/rfb/SMsgReader.cxx

@@ -200,6 +200,9 @@ void SMsgReader::readClientCutText()
 {
   is->skip(3);
   int len = is->readU32();
+  if (len < 0) {
+    throw Exception("Cut text too long.");
+  }
   if (len > maxCutText) {
     is->skip(len);
     vlog.error("Cut text too long (%d bytes) - ignoring", len);

common/rfb/SMsgWriter.cxx

@@ -101,7 +101,9 @@ void SMsgWriter::writeFence(rdr::U32 flags, unsigned len, const char data[])
   os->writeU32(flags);
 
   os->writeU8(len);
-  os->writeBytes(data, len);
+
+  if (len > 0)
+    os->writeBytes(data, len);
 
   endMsg();
 }

common/rfb/VNCSConnectionST.cxx

@@ -666,6 +666,7 @@ void VNCSConnectionST::fence(rdr::U32 flags, unsigned len, const char data[])
       fenceFlags = flags & (fenceFlagBlockBefore | fenceFlagBlockAfter | fenceFlagSyncNext);
       fenceDataLen = len;
       delete [] fenceData;
+      fenceData = NULL;
       if (len > 0) {
         fenceData = new char[len];
         memcpy(fenceData, data, len);