Skip to content

Commit eae4f70

Browse files
committed
libvncserver: don't give invalid fds to FD_* macros
re #655
1 parent b17c592 commit eae4f70

File tree

2 files changed

+16
-0
lines changed

2 files changed

+16
-0
lines changed

src/libvncserver/rfbserver.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1575,6 +1575,10 @@ rfbBool rfbSendFileTransferChunk(rfbClientPtr cl)
15751575
/* If not sending, or no file open... Return as if we sent something! */
15761576
if ((cl->fileTransfer.fd!=-1) && (cl->fileTransfer.sending==1))
15771577
{
1578+
if(cl->sock == RFB_INVALID_SOCKET) {
1579+
errno = EBADF;
1580+
return FALSE;
1581+
}
15781582
FD_ZERO(&wfds);
15791583
FD_SET(cl->sock, &wfds);
15801584

src/libvncserver/sockets.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -672,6 +672,10 @@ rfbReadExactTimeout(rfbClientPtr cl, char* buf, int len, int timeout)
672672
struct timeval tv;
673673

674674
while (len > 0) {
675+
if(sock == RFB_INVALID_SOCKET) {
676+
errno = EBADF;
677+
return -1;
678+
}
675679
#ifdef LIBVNCSERVER_WITH_WEBSOCKETS
676680
if (cl->wsctx) {
677681
n = webSocketsDecode(cl, buf, len);
@@ -772,6 +776,10 @@ rfbPeekExactTimeout(rfbClientPtr cl, char* buf, int len, int timeout)
772776
struct timeval tv;
773777

774778
while (len > 0) {
779+
if(sock == RFB_INVALID_SOCKET) {
780+
errno = EBADF;
781+
return -1;
782+
}
775783
#ifdef LIBVNCSERVER_WITH_WEBSOCKETS
776784
if (cl->sslctx)
777785
n = rfbssl_peek(cl, buf, len);
@@ -888,6 +896,10 @@ rfbWriteExact(rfbClientPtr cl,
888896

889897
LOCK(cl->outputMutex);
890898
while (len > 0) {
899+
if(sock == RFB_INVALID_SOCKET) {
900+
errno = EBADF;
901+
return -1;
902+
}
891903
#ifdef LIBVNCSERVER_WITH_WEBSOCKETS
892904
if (cl->sslctx)
893905
n = rfbssl_write(cl, buf, len);

0 commit comments

Comments
 (0)