From 102e5134b95938381b8bb1b45934bc502d6a8a2d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <fidencio@redhat.com>
Date: Tue, 15 Mar 2016 16:51:41 +0100
Subject: [PATCH] spice: avoid crashing when using invalid video config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

virt-viewer _only_ supports guests that have either:

A) a signle graphics device with multiple displays (monitorid=0,
displayid=(0,1,2,3)).

B) multiple graphics device with a single display each
(monitorid=(0,1,2,3), displayid=0).

From now on, avoid crashing connecting to a guest which has a graphics
configuration that violates A or B. However, even avoiding the crash, we
cannot ensure the guest will work as expected.

Resolves: rhbz#1250820

Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
(cherry picked from commit 01b66ef88bc142d6716b40b1e384e94a2629a99f)
---
 src/virt-viewer-display-spice.c | 7 +++++--
 src/virt-viewer-session-spice.c | 8 +++++++-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/virt-viewer-display-spice.c b/src/virt-viewer-display-spice.c
index 399c207..0cafec3 100644
--- a/src/virt-viewer-display-spice.c
+++ b/src/virt-viewer-display-spice.c
@@ -266,8 +266,11 @@ virt_viewer_display_spice_new(VirtViewerSessionSpice *session,
     g_return_val_if_fail(SPICE_IS_DISPLAY_CHANNEL(channel), NULL);
 
     g_object_get(channel, "channel-id", &channelid, NULL);
-    // We don't allow monitorid != 0 && channelid != 0
-    g_return_val_if_fail(channelid == 0 || monitorid == 0, NULL);
+    if (channelid != 0 && monitorid != 0) {
+        g_warning("Unsupported graphics configuration:\n"
+                  "spice-gtk only supports multiple graphics channels if they are single-head");
+        return NULL;
+    }
 
     self = g_object_new(VIRT_VIEWER_TYPE_DISPLAY_SPICE,
                         "session", session,
diff --git a/src/virt-viewer-session-spice.c b/src/virt-viewer-session-spice.c
index 6c74f99..1f5242c 100644
--- a/src/virt-viewer-session-spice.c
+++ b/src/virt-viewer-session-spice.c
@@ -682,8 +682,11 @@ static void
 destroy_display(gpointer data)
 {
     VirtViewerDisplay *display = VIRT_VIEWER_DISPLAY(data);
-    VirtViewerSession *session = virt_viewer_display_get_session(display);
+    VirtViewerSession *session;
 
+    g_return_if_fail (display != NULL);
+
+    session = virt_viewer_display_get_session(display);
     g_debug("Destroying spice display %p", display);
     virt_viewer_session_remove_display(session, display);
     g_object_unref(display);
@@ -732,6 +735,9 @@ virt_viewer_session_spice_display_monitors(SpiceChannel *channel,
         display = g_ptr_array_index(displays, i);
         if (display == NULL) {
             display = virt_viewer_display_spice_new(self, channel, i);
+            if (display == NULL)
+                continue;
+
             g_debug("creating spice display (#:%d)", i);
             g_ptr_array_index(displays, i) = g_object_ref_sink(display);
         }