ui/vnc: Do not copy z_stream
vnc_worker_thread_loop() copies z_stream stored in its local VncState to
the persistent VncState, and the copied one is freed with deflateEnd()
later. However, deflateEnd() refuses to operate with a copied z_stream
and returns Z_STREAM_ERROR, leaking the allocated memory.
Avoid copying the zlib state to fix the memory leak.
Fixes: bd023f953e ("vnc: threaded VNC server")
Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250603-zlib-v3-1-20b857bd8d05@rsg.ci.i.u-tokyo.ac.jp>
This commit is contained in:
Akihiko Odaki
Marc-André Lureau
parent
9a4e273dde
commit
aef22331b5
3 changed files with 26 additions and 19 deletions
|
|
@ -48,21 +48,21 @@ void vnc_zlib_zfree(void *x, void *addr)
|
|||
|
||||
static void vnc_zlib_start(VncState *vs)
|
||||
{
|
||||
buffer_reset(&vs->zlib.zlib);
|
||||
buffer_reset(&vs->zlib->zlib);
|
||||
|
||||
// make the output buffer be the zlib buffer, so we can compress it later
|
||||
vs->zlib.tmp = vs->output;
|
||||
vs->output = vs->zlib.zlib;
|
||||
vs->zlib->tmp = vs->output;
|
||||
vs->output = vs->zlib->zlib;
|
||||
}
|
||||
|
||||
static int vnc_zlib_stop(VncState *vs)
|
||||
{
|
||||
z_streamp zstream = &vs->zlib.stream;
|
||||
z_streamp zstream = &vs->zlib->stream;
|
||||
int previous_out;
|
||||
|
||||
// switch back to normal output/zlib buffers
|
||||
vs->zlib.zlib = vs->output;
|
||||
vs->output = vs->zlib.tmp;
|
||||
vs->zlib->zlib = vs->output;
|
||||
vs->output = vs->zlib->tmp;
|
||||
|
||||
// compress the zlib buffer
|
||||
|
||||
|
|
@ -85,24 +85,24 @@ static int vnc_zlib_stop(VncState *vs)
|
|||
return -1;
|
||||
}
|
||||
|
||||
vs->zlib.level = vs->tight->compression;
|
||||
vs->zlib->level = vs->tight->compression;
|
||||
zstream->opaque = vs;
|
||||
}
|
||||
|
||||
if (vs->tight->compression != vs->zlib.level) {
|
||||
if (vs->tight->compression != vs->zlib->level) {
|
||||
if (deflateParams(zstream, vs->tight->compression,
|
||||
Z_DEFAULT_STRATEGY) != Z_OK) {
|
||||
return -1;
|
||||
}
|
||||
vs->zlib.level = vs->tight->compression;
|
||||
vs->zlib->level = vs->tight->compression;
|
||||
}
|
||||
|
||||
// reserve memory in output buffer
|
||||
buffer_reserve(&vs->output, vs->zlib.zlib.offset + 64);
|
||||
buffer_reserve(&vs->output, vs->zlib->zlib.offset + 64);
|
||||
|
||||
// set pointers
|
||||
zstream->next_in = vs->zlib.zlib.buffer;
|
||||
zstream->avail_in = vs->zlib.zlib.offset;
|
||||
zstream->next_in = vs->zlib->zlib.buffer;
|
||||
zstream->avail_in = vs->zlib->zlib.offset;
|
||||
zstream->next_out = vs->output.buffer + vs->output.offset;
|
||||
zstream->avail_out = vs->output.capacity - vs->output.offset;
|
||||
previous_out = zstream->avail_out;
|
||||
|
|
@ -147,8 +147,8 @@ int vnc_zlib_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
|
|||
|
||||
void vnc_zlib_clear(VncState *vs)
|
||||
{
|
||||
if (vs->zlib.stream.opaque) {
|
||||
deflateEnd(&vs->zlib.stream);
|
||||
if (vs->zlib->stream.opaque) {
|
||||
deflateEnd(&vs->zlib->stream);
|
||||
}
|
||||
buffer_free(&vs->zlib.zlib);
|
||||
buffer_free(&vs->zlib->zlib);
|
||||
}
|
||||
|
|
|
|||
13
ui/vnc.c
13
ui/vnc.c
|
|
@ -56,6 +56,11 @@
|
|||
#include "io/dns-resolver.h"
|
||||
#include "monitor/monitor.h"
|
||||
|
||||
typedef struct VncConnection {
|
||||
VncState vs;
|
||||
VncZlib zlib;
|
||||
} VncConnection;
|
||||
|
||||
#define VNC_REFRESH_INTERVAL_BASE GUI_REFRESH_INTERVAL_DEFAULT
|
||||
#define VNC_REFRESH_INTERVAL_INC 50
|
||||
#define VNC_REFRESH_INTERVAL_MAX GUI_REFRESH_INTERVAL_IDLE
|
||||
|
|
@ -1362,7 +1367,7 @@ void vnc_disconnect_finish(VncState *vs)
|
|||
vs->magic = 0;
|
||||
g_free(vs->zrle);
|
||||
g_free(vs->tight);
|
||||
g_free(vs);
|
||||
g_free(container_of(vs, VncConnection, vs));
|
||||
}
|
||||
|
||||
size_t vnc_client_io_error(VncState *vs, ssize_t ret, Error *err)
|
||||
|
|
@ -3241,11 +3246,13 @@ static void vnc_refresh(DisplayChangeListener *dcl)
|
|||
static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
|
||||
bool skipauth, bool websocket)
|
||||
{
|
||||
VncState *vs = g_new0(VncState, 1);
|
||||
VncConnection *vc = g_new0(VncConnection, 1);
|
||||
VncState *vs = &vc->vs;
|
||||
bool first_client = QTAILQ_EMPTY(&vd->clients);
|
||||
int i;
|
||||
|
||||
trace_vnc_client_connect(vs, sioc);
|
||||
vs->zlib = &vc->zlib;
|
||||
vs->zrle = g_new0(VncZrle, 1);
|
||||
vs->tight = g_new0(VncTight, 1);
|
||||
vs->magic = VNC_MAGIC;
|
||||
|
|
@ -3268,7 +3275,7 @@ static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
|
|||
#ifdef CONFIG_PNG
|
||||
buffer_init(&vs->tight->png, "vnc-tight-png/%p", sioc);
|
||||
#endif
|
||||
buffer_init(&vs->zlib.zlib, "vnc-zlib/%p", sioc);
|
||||
buffer_init(&vc->zlib.zlib, "vnc-zlib/%p", sioc);
|
||||
buffer_init(&vs->zrle->zrle, "vnc-zrle/%p", sioc);
|
||||
buffer_init(&vs->zrle->fb, "vnc-zrle-fb/%p", sioc);
|
||||
buffer_init(&vs->zrle->zlib, "vnc-zrle-zlib/%p", sioc);
|
||||
|
|
|
|||
2
ui/vnc.h
2
ui/vnc.h
|
|
@ -342,7 +342,7 @@ struct VncState
|
|||
* update vnc_async_encoding_start()
|
||||
*/
|
||||
VncTight *tight;
|
||||
VncZlib zlib;
|
||||
VncZlib *zlib;
|
||||
VncHextile hextile;
|
||||
VncZrle *zrle;
|
||||
VncZywrle zywrle;
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue