diff --git a/SOURCES/0069-red-channel-make-red_client_-ref-unref-thread-safe.patch b/SOURCES/0069-red-channel-make-red_client_-ref-unref-thread-safe.patch new file mode 100644 index 0000000..a429d17 --- /dev/null +++ b/SOURCES/0069-red-channel-make-red_client_-ref-unref-thread-safe.patch @@ -0,0 +1,40 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Frediano Ziglio +Date: Tue, 12 Apr 2016 16:28:07 +0100 +Subject: [PATCH] red-channel: make red_client_{ref,unref} thread safe + +These function are called on both sides of dispatcher so the +increment/decrement of the counter is done in multiple threads. +This caused the counter to not get incremented correctly and +freed the structure too early, leaving a dangling pointer in +the other thread. + +This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1253375. + +Signed-off-by: Frediano Ziglio +Acked-by: Christophe Fergeau +Acked-by: Jonathon Jongsma +--- + server/red_channel.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/server/red_channel.c b/server/red_channel.c +index 449e628..82e7137 100644 +--- a/server/red_channel.c ++++ b/server/red_channel.c +@@ -2060,13 +2060,13 @@ RedClient *red_client_new(int migrated) + RedClient *red_client_ref(RedClient *client) + { + spice_assert(client); +- client->refs++; ++ g_atomic_int_inc(&client->refs); + return client; + } + + RedClient *red_client_unref(RedClient *client) + { +- if (!--client->refs) { ++ if (g_atomic_int_dec_and_test(&client->refs)) { + spice_debug("release client=%p", client); + pthread_mutex_destroy(&client->lock); + free(client); diff --git a/SPECS/spice.spec b/SPECS/spice.spec index 06d2236..33a94ff 100644 --- a/SPECS/spice.spec +++ b/SPECS/spice.spec @@ -1,6 +1,6 @@ Name: spice Version: 0.12.4 -Release: 15%{?dist}.1 +Release: 15%{?dist}.2 Summary: Implements the SPICE protocol Group: User Interface/Desktops License: LGPLv2+ @@ -74,6 +74,7 @@ Patch65: 0065-smartcard-add-a-ref-to-item-before-adding-to-pipe.patch Patch66: 0066-smartcard-allocate-msg-with-the-expected-size.patch Patch67: 0067-create-a-function-to-validate-surface-parameters.patch Patch68: 0068-improve-primary-surface-parameter-checks.patch +Patch69: 0069-red-channel-make-red_client_-ref-unref-thread-safe.patch # https://bugzilla.redhat.com/show_bug.cgi?id=613529 @@ -198,6 +199,7 @@ using spice-server, you will need to install spice-server-devel. %patch66 -p1 %patch67 -p1 %patch68 -p1 +%patch69 -p1 %build @@ -228,6 +230,11 @@ mkdir -p %{buildroot}%{_libexecdir} %changelog +* Fri Aug 05 2016 Christophe Fergeau 0.12.4-15.2 +- Fix thread-safety issue causing a crash when playing a Youtube video spanning + multiple monitors + Resolves: rhbz#1253375 + * Mon Apr 25 2016 Christophe Fergeau - 0.12.4-15.1 - Fix heap-based memory corruption within smartcard handling Resolves: CVE-2016-0749