vnc: clear vs->tlscreds after unparenting it
commit67c4c2bd958b0074ffbcde12cb434cd064adab12
authorWolfgang Bumiller <w.bumiller@proxmox.com>
Tue, 12 Jan 2016 12:52:39 +0000 (12 13:52 +0100)
committerGerd Hoffmann <kraxel@redhat.com>
Mon, 18 Jan 2016 15:36:21 +0000 (18 16:36 +0100)
treeb57a08ad7cb13184413fa35aab7946d7f38dc5d8
parentfba958c692e47a373d15c1fd3d72b255bf76adbd
vnc: clear vs->tlscreds after unparenting it

This pointer should be cleared in vnc_display_close()
otherwise a use-after-free can happen when when using the
old style 'x509' and 'tls' options rather than a persistent
tls-creds -object, by issuing monitor commands to change
the vnc server like so:

Start with: -vnc unix:test.socket,x509,tls
Then use the following monitor command:
  change vnc unix:test.socket

After this the pointer is still set but invalid and a crash
can be triggered for instance by issuing the same command a
second time which will try to object_unparent() the same
pointer again.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
ui/vnc.c