Re: [Tigervnc-devel] [Patch] Fix use after free in ZRLEEncoder.

2013-09-19 Thread Pierre Ossman
On Tue, 17 Sep 2013 14:22:50 +0300 Michal Srb wrote: > There is use after free crash when client using zrle disconnects: > ZRLEEncoder contains zos variable (rdr::ZlibOutStream) and mos variable > (pointer to rdr::MemOutStream). > mos is always allocated in constructor (it could be a copy of sta

[Tigervnc-devel] [Patch] Fix use after free in ZRLEEncoder.

2013-09-17 Thread Michal Srb
There is use after free crash when client using zrle disconnects: ZRLEEncoder contains zos variable (rdr::ZlibOutStream) and mos variable (pointer to rdr::MemOutStream). mos is always allocated in constructor (it could be a copy of static sharedMos pointer if sharedMos != 0, but it is always 0).