qemu-e2k/ui/vnc-enc-zrle.inc.c
Li Qiang 6bf21f3d83 vnc: fix memory leak when vnc disconnect
Currently when qemu receives a vnc connect, it creates a 'VncState' to
represent this connection. In 'vnc_worker_thread_loop' it creates a
local 'VncState'. The connection 'VcnState' and local 'VncState' exchange
data in 'vnc_async_encoding_start' and 'vnc_async_encoding_end'.
In 'zrle_compress_data' it calls 'deflateInit2' to allocate the libz library
opaque data. The 'VncState' used in 'zrle_compress_data' is the local
'VncState'. In 'vnc_zrle_clear' it calls 'deflateEnd' to free the libz
library opaque data. The 'VncState' used in 'vnc_zrle_clear' is the connection
'VncState'. In currently implementation there will be a memory leak when the
vnc disconnect. Following is the asan output backtrack:

Direct leak of 29760 byte(s) in 5 object(s) allocated from:
    0 0xffffa67ef3c3 in __interceptor_calloc (/lib64/libasan.so.4+0xd33c3)
    1 0xffffa65071cb in g_malloc0 (/lib64/libglib-2.0.so.0+0x571cb)
    2 0xffffa5e968f7 in deflateInit2_ (/lib64/libz.so.1+0x78f7)
    3 0xaaaacec58613 in zrle_compress_data ui/vnc-enc-zrle.c:87
    4 0xaaaacec58613 in zrle_send_framebuffer_update ui/vnc-enc-zrle.c:344
    5 0xaaaacec34e77 in vnc_send_framebuffer_update ui/vnc.c:919
    6 0xaaaacec5e023 in vnc_worker_thread_loop ui/vnc-jobs.c:271
    7 0xaaaacec5e5e7 in vnc_worker_thread ui/vnc-jobs.c:340
    8 0xaaaacee4d3c3 in qemu_thread_start util/qemu-thread-posix.c:502
    9 0xffffa544e8bb in start_thread (/lib64/libpthread.so.0+0x78bb)
    10 0xffffa53965cb in thread_start (/lib64/libc.so.6+0xd55cb)

This is because the opaque allocated in 'deflateInit2' is not freed in
'deflateEnd'. The reason is that the 'deflateEnd' calls 'deflateStateCheck'
and in the latter will check whether 's->strm != strm'(libz's data structure).
This check will be true so in 'deflateEnd' it just return 'Z_STREAM_ERROR' and
not free the data allocated in 'deflateInit2'.

The reason this happens is that the 'VncState' contains the whole 'VncZrle',
so when calling 'deflateInit2', the 's->strm' will be the local address.
So 's->strm != strm' will be true.

To fix this issue, we need to make 'zrle' of 'VncState' to be a pointer.
Then the connection 'VncState' and local 'VncState' exchange mechanism will
work as expection. The 'tight' of 'VncState' has the same issue, let's also turn
it to a pointer.

Reported-by: Ying Fang <fangying1@huawei.com>
Signed-off-by: Li Qiang <liq3ea@163.com>
Message-id: 20190831153922.121308-1-liq3ea@163.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-09-17 13:45:10 +02:00

264 lines
7.0 KiB
C

/*
* QEMU VNC display driver: Zlib Run-length Encoding (ZRLE)
*
* From libvncserver/libvncserver/zrleencodetemplate.c
* Copyright (C) 2002 RealVNC Ltd. All Rights Reserved.
* Copyright (C) 2003 Sun Microsystems, Inc.
*
* Copyright (C) 2010 Corentin Chary <corentin.chary@gmail.com>
*
* This work is licensed under the terms of the GNU GPL, version 2 or later.
* See the COPYING file in the top-level directory.
*/
/*
* Before including this file, you must define a number of CPP macros.
*
* ZRLE_BPP should be 8, 16 or 32 depending on the bits per pixel.
*
* Note that the buf argument to ZRLE_ENCODE needs to be at least one pixel
* bigger than the largest tile of pixel data, since the ZRLE encoding
* algorithm writes to the position one past the end of the pixel data.
*/
#include "qemu/osdep.h"
#undef ZRLE_ENDIAN_SUFFIX
#if ZYWRLE_ENDIAN == ENDIAN_LITTLE
#define ZRLE_ENDIAN_SUFFIX le
#elif ZYWRLE_ENDIAN == ENDIAN_BIG
#define ZRLE_ENDIAN_SUFFIX be
#else
#define ZRLE_ENDIAN_SUFFIX ne
#endif
#ifndef ZRLE_CONCAT
#define ZRLE_CONCAT_I(a, b) a##b
#define ZRLE_CONCAT2(a, b) ZRLE_CONCAT_I(a, b)
#define ZRLE_CONCAT3(a, b, c) ZRLE_CONCAT2(a, ZRLE_CONCAT2(b, c))
#endif
#ifdef ZRLE_COMPACT_PIXEL
#define ZRLE_ENCODE_SUFFIX ZRLE_CONCAT2(ZRLE_COMPACT_PIXEL,ZRLE_ENDIAN_SUFFIX)
#define ZRLE_WRITE_SUFFIX ZRLE_COMPACT_PIXEL
#define ZRLE_PIXEL ZRLE_CONCAT3(uint,ZRLE_BPP,_t)
#define ZRLE_BPP_OUT 24
#elif ZRLE_BPP == 15
#define ZRLE_ENCODE_SUFFIX ZRLE_CONCAT2(ZRLE_BPP,ZRLE_ENDIAN_SUFFIX)
#define ZRLE_WRITE_SUFFIX 16
#define ZRLE_PIXEL uint16_t
#define ZRLE_BPP_OUT 16
#else
#define ZRLE_ENCODE_SUFFIX ZRLE_CONCAT2(ZRLE_BPP,ZRLE_ENDIAN_SUFFIX)
#define ZRLE_WRITE_SUFFIX ZRLE_BPP
#define ZRLE_BPP_OUT ZRLE_BPP
#define ZRLE_PIXEL ZRLE_CONCAT3(uint,ZRLE_BPP,_t)
#endif
#define ZRLE_WRITE_PIXEL ZRLE_CONCAT2(zrle_write_u, ZRLE_WRITE_SUFFIX)
#define ZRLE_ENCODE ZRLE_CONCAT2(zrle_encode_, ZRLE_ENCODE_SUFFIX)
#define ZRLE_ENCODE_TILE ZRLE_CONCAT2(zrle_encode_tile, ZRLE_ENCODE_SUFFIX)
#define ZRLE_WRITE_PALETTE ZRLE_CONCAT2(zrle_write_palette,ZRLE_ENCODE_SUFFIX)
static void ZRLE_ENCODE_TILE(VncState *vs, ZRLE_PIXEL *data, int w, int h,
int zywrle_level);
#if ZRLE_BPP != 8
#include "vnc-enc-zywrle-template.c"
#endif
static void ZRLE_ENCODE(VncState *vs, int x, int y, int w, int h,
int zywrle_level)
{
int ty;
for (ty = y; ty < y + h; ty += VNC_ZRLE_TILE_HEIGHT) {
int tx, th;
th = MIN(VNC_ZRLE_TILE_HEIGHT, y + h - ty);
for (tx = x; tx < x + w; tx += VNC_ZRLE_TILE_WIDTH) {
int tw;
ZRLE_PIXEL *buf;
tw = MIN(VNC_ZRLE_TILE_WIDTH, x + w - tx);
buf = zrle_convert_fb(vs, tx, ty, tw, th, ZRLE_BPP);
ZRLE_ENCODE_TILE(vs, buf, tw, th, zywrle_level);
}
}
}
static void ZRLE_ENCODE_TILE(VncState *vs, ZRLE_PIXEL *data, int w, int h,
int zywrle_level)
{
VncPalette *palette = &vs->zrle->palette;
int runs = 0;
int single_pixels = 0;
bool use_rle;
bool use_palette;
int i;
ZRLE_PIXEL *ptr = data;
ZRLE_PIXEL *end = ptr + h * w;
*end = ~*(end-1); /* one past the end is different so the while loop ends */
/* Real limit is 127 but we wan't a way to know if there is more than 127 */
palette_init(palette, 256, ZRLE_BPP);
while (ptr < end) {
ZRLE_PIXEL pix = *ptr;
if (*++ptr != pix) { /* FIXME */
single_pixels++;
} else {
while (*++ptr == pix) ;
runs++;
}
palette_put(palette, pix);
}
/* Solid tile is a special case */
if (palette_size(palette) == 1) {
bool found;
vnc_write_u8(vs, 1);
ZRLE_WRITE_PIXEL(vs, palette_color(palette, 0, &found));
return;
}
zrle_choose_palette_rle(vs, w, h, palette, ZRLE_BPP_OUT,
runs, single_pixels, zywrle_level,
&use_rle, &use_palette);
if (!use_palette) {
vnc_write_u8(vs, (use_rle ? 128 : 0));
} else {
uint32_t colors[VNC_PALETTE_MAX_SIZE];
size_t size = palette_size(palette);
vnc_write_u8(vs, (use_rle ? 128 : 0) | size);
palette_fill(palette, colors);
for (i = 0; i < size; i++) {
ZRLE_WRITE_PIXEL(vs, colors[i]);
}
}
if (use_rle) {
ZRLE_PIXEL *ptr = data;
ZRLE_PIXEL *end = ptr + w * h;
ZRLE_PIXEL *run_start;
ZRLE_PIXEL pix;
while (ptr < end) {
int len;
int index = 0;
run_start = ptr;
pix = *ptr++;
while (*ptr == pix && ptr < end) {
ptr++;
}
len = ptr - run_start;
if (use_palette)
index = palette_idx(palette, pix);
if (len <= 2 && use_palette) {
if (len == 2) {
vnc_write_u8(vs, index);
}
vnc_write_u8(vs, index);
continue;
}
if (use_palette) {
vnc_write_u8(vs, index | 128);
} else {
ZRLE_WRITE_PIXEL(vs, pix);
}
len -= 1;
while (len >= 255) {
vnc_write_u8(vs, 255);
len -= 255;
}
vnc_write_u8(vs, len);
}
} else if (use_palette) { /* no RLE */
int bppp;
ZRLE_PIXEL *ptr = data;
/* packed pixels */
assert (palette_size(palette) < 17);
bppp = bits_per_packed_pixel[palette_size(palette)-1];
for (i = 0; i < h; i++) {
uint8_t nbits = 0;
uint8_t byte = 0;
ZRLE_PIXEL *eol = ptr + w;
while (ptr < eol) {
ZRLE_PIXEL pix = *ptr++;
uint8_t index = palette_idx(palette, pix);
byte = (byte << bppp) | index;
nbits += bppp;
if (nbits >= 8) {
vnc_write_u8(vs, byte);
nbits = 0;
}
}
if (nbits > 0) {
byte <<= 8 - nbits;
vnc_write_u8(vs, byte);
}
}
} else {
/* raw */
#if ZRLE_BPP != 8
if (zywrle_level > 0 && !(zywrle_level & 0x80)) {
ZYWRLE_ANALYZE(data, data, w, h, w, zywrle_level, vs->zywrle.buf);
ZRLE_ENCODE_TILE(vs, data, w, h, zywrle_level | 0x80);
}
else
#endif
{
#ifdef ZRLE_COMPACT_PIXEL
ZRLE_PIXEL *ptr;
for (ptr = data; ptr < data + w * h; ptr++) {
ZRLE_WRITE_PIXEL(vs, *ptr);
}
#else
vnc_write(vs, data, w * h * (ZRLE_BPP / 8));
#endif
}
}
}
#undef ZRLE_PIXEL
#undef ZRLE_WRITE_PIXEL
#undef ZRLE_ENCODE
#undef ZRLE_ENCODE_TILE
#undef ZYWRLE_ENCODE_TILE
#undef ZRLE_BPP_OUT
#undef ZRLE_WRITE_SUFFIX
#undef ZRLE_ENCODE_SUFFIX