Merge branch 'master' into multicastvnc

Author: bk138

include/rfb/rfb.h

@@ -390,6 +390,11 @@ typedef struct _rfbScreenInfo
     /* Timeout value for select() calls, mainly used for multithreaded servers. */
     int select_timeout_usec;
 
+    /** Set by rfbRequestListenRebind() to ask the listener thread to re-create
+     * its listening sockets from the current listenInterface/listen6Interface/
+     * port/ipv6port values on its next loop iteration. Cleared by the thread. */
+    rfbBool rebindListenSockets;
+
     /*
       multicast stuff 
     */
@@ -852,6 +857,15 @@ extern int rfbMaxClientWait;
 
 extern void rfbInitSockets(rfbScreenInfoPtr rfbScreen);
 extern void rfbShutdownSockets(rfbScreenInfoPtr rfbScreen);
+/** Close and re-create the TCP/TCP6 listening sockets from the screen's current
+ * listenInterface/listen6Interface/port/ipv6port. Must run on the same thread
+ * that select()s on those sockets; off-thread callers use rfbRequestListenRebind().
+ * Returns TRUE if at least one family is now listening. */
+extern rfbBool rfbRebindListenSockets(rfbScreenInfoPtr rfbScreen);
+/** Thread-safe request to rebind the listening sockets: the actual swap is done
+ * by the background listener thread on its next iteration. Caller must have set
+ * the desired listenInterface/listen6Interface/port/ipv6port beforehand. */
+extern void rfbRequestListenRebind(rfbScreenInfoPtr rfbScreen);
 extern void rfbDisconnectUDPSock(rfbScreenInfoPtr rfbScreen);
 extern void rfbCloseClient(rfbClientPtr cl);
 extern int rfbReadExact(rfbClientPtr cl, char *buf, int len);

src/libvncclient/tight.c

@@ -341,6 +341,16 @@ HandleTightBPP (rfbClient* client, int rx, int ry, int rw, int rh)
 
       numRows = (bufferSize - zs->avail_out) / rowSize;
 
+      /* The decompressed stream is server-controlled and may yield more rows
+         than the rectangle's declared height.  filterFn() writes directly into
+         client->frameBuffer, so clamp here before writing to avoid running past
+         the framebuffer (heap out-of-bounds write).  The post-loop
+         "rowsProcessed != rh" check happens too late. */
+      if (numRows > rh - rowsProcessed) {
+	rfbClientLog("Tight: too many scan lines after decompression.\n");
+	return FALSE;
+      }
+
       filterFn(client, rx, ry+rowsProcessed, numRows);
 
       extraBytes = bufferSize - zs->avail_out - numRows * rowSize;

src/libvncserver/httpd.c

@@ -130,6 +130,10 @@ rfbHttpInitSockets(rfbScreenInfoPtr rfbScreen)
     INIT_MUTEX(cl.outputMutex);
     INIT_MUTEX(cl.refCountMutex);
     INIT_MUTEX(cl.sendMutex);
+    cl.readFromSocket = rfbDefaultReadFromSocket;
+    cl.peekAtSocket = rfbDefaultPeekAtSocket;
+    cl.hasPendingOnSocket = rfbDefaultHasPendingOnSocket;
+    cl.writeToSocket = rfbDefaultWriteToSocket;
 }
 
 void rfbHttpShutdownSockets(rfbScreenInfoPtr rfbScreen) {
@@ -225,15 +229,20 @@ rfbHttpCheckFds(rfbScreenInfoPtr rfbScreen)
         || (rfbScreen->httpListen6Sock != RFB_INVALID_SOCKET && FD_ISSET(rfbScreen->httpListen6Sock, &fds))) {
 	if (rfbScreen->httpSock != RFB_INVALID_SOCKET) rfbCloseSocket(rfbScreen->httpSock);
 
+	/*
+	 * Mirror the RFB listener in listenerRun(): on a failed accept() just bail and
+	 * keep the listening socket. While the bound interface's address is gone the
+	 * accept() fails (e.g. EINVAL), but the socket is not dead -- it resumes once
+	 * the address returns. Logging every failure here would flood the log for the
+	 * whole down period, so stay silent like the RFB path does.
+	 */
 	if(FD_ISSET(rfbScreen->httpListenSock, &fds)) {
 	    if ((rfbScreen->httpSock = accept(rfbScreen->httpListenSock, (struct sockaddr *)&addr, &addrlen)) == RFB_INVALID_SOCKET) {
-	      rfbLogPerror("httpCheckFds: accept");
 	      return;
 	    }
 	}
 	else if(FD_ISSET(rfbScreen->httpListen6Sock, &fds)) {
 	    if ((rfbScreen->httpSock = accept(rfbScreen->httpListen6Sock, (struct sockaddr *)&addr, &addrlen)) == RFB_INVALID_SOCKET) {
-	      rfbLogPerror("httpCheckFds: accept");
 	      return;
 	    }
 	}

src/libvncserver/main.c

@@ -736,6 +736,12 @@ listenerRun(void *data)
 	    /* Reset the pipe */
 	    char buf;
 	    while (read(screen->pipe_notify_listener_thread[0], &buf, sizeof(buf)) == sizeof(buf));
+	    /* A rebind request is serviced here, on the listener thread, so the
+	       close()/socket() swap cannot race the select() above. */
+	    if (screen->rebindListenSockets) {
+		screen->rebindListenSockets = FALSE;
+		rfbRebindListenSockets(screen);
+	    }
 	    /* Go on with loop */
 	    continue;
 	}
@@ -761,7 +767,28 @@ listenerRun(void *data)
 
 #endif
 
-void 
+void
+rfbRequestListenRebind(rfbScreenInfoPtr screen)
+{
+    /* Flag the request; the listener thread picks it up after being woken. */
+    screen->rebindListenSockets = TRUE;
+
+#if defined(LIBVNCSERVER_HAVE_LIBPTHREAD) && !defined(WIN32)
+    if (screen->backgroundLoop && screen->pipe_notify_listener_thread[1] != -1) {
+	const char buf = 'r';
+	if (write(screen->pipe_notify_listener_thread[1], &buf, sizeof(buf)) < 0)
+	    rfbLogPerror("rfbRequestListenRebind: write to notify pipe");
+	return;
+    }
+#endif
+
+    /* No background listener thread: do the swap inline. Safe because the
+       single-threaded event loop is not concurrently in select() here. */
+    screen->rebindListenSockets = FALSE;
+    rfbRebindListenSockets(screen);
+}
+
+void
 rfbStartOnHoldClient(rfbClientPtr cl)
 {
     cl->onHold = FALSE;

src/libvncserver/rfbserver.c

@@ -660,6 +660,12 @@ rfbClientConnectionGone(rfbClientPtr cl)
     if(cl->sock != RFB_INVALID_SOCKET)
 	rfbCloseSocket(cl->sock);
 
+    /* Clean up file descriptor of an interrupted file transfer */
+    if (cl->fileTransfer.fd != -1) {
+        close(cl->fileTransfer.fd);
+        cl->fileTransfer.fd = -1;
+    }
+
     if (cl->scaledScreen!=NULL)
         cl->scaledScreen->scaledScreenRefCount--;
 
@@ -4921,7 +4927,7 @@ rfbSendExtDesktopSize(rfbClientPtr cl,
 rfbBool
 rfbSendUpdateBuf(rfbClientPtr cl)
 {
-    if(cl->sock<0)
+    if(cl->sock<0 || cl->state == RFB_SHUTDOWN)
       return FALSE;
 
     if (rfbWriteExact(cl, cl->updateBuf, cl->ublen) < 0) {

src/libvncserver/sockets.c

@@ -460,6 +460,83 @@ void rfbShutdownSockets(rfbScreenInfoPtr rfbScreen)
 
 }
 
+/*
+ * rfbRebindListenSockets closes the current TCP/TCP6 listening sockets and
+ * re-creates them from the screen's current listenInterface/listen6Interface
+ * and port/ipv6port. This is used to follow an interface whose IP address
+ * changed (e.g. after the bound network interface went down and back up).
+ *
+ * It must be called on the thread that select()s on the listening sockets so
+ * that the close()/socket() swap cannot race a concurrent select(): in the
+ * threaded (background loop) case that is the listener thread, which invokes
+ * this from listenerRun() in response to rfbRequestListenRebind(). Already-
+ * connected clients keep their own sockets and are unaffected. The HTTP
+ * listeners are bound to the same interface address, so they are re-created too.
+ */
+rfbBool
+rfbRebindListenSockets(rfbScreenInfoPtr rfbScreen)
+{
+    in_addr_t iface = rfbScreen->listenInterface;
+
+    /* This deliberately only handles the plain TCP/TCP6 listeners; inetd and
+       autoPort setups have no stable address to rebind to. */
+    if (rfbScreen->inetdSock != RFB_INVALID_SOCKET || rfbScreen->autoPort)
+        return FALSE;
+
+    /* tear down the existing listeners; rfbCloseSocket() also resets the fd to
+       RFB_INVALID_SOCKET, the outer if only skips the FD_CLR when there is none */
+    if (rfbScreen->listenSock != RFB_INVALID_SOCKET) {
+        FD_CLR(rfbScreen->listenSock, &rfbScreen->allFds);
+        rfbCloseSocket(rfbScreen->listenSock);
+    }
+#ifdef LIBVNCSERVER_IPv6
+    if (rfbScreen->listen6Sock != RFB_INVALID_SOCKET) {
+        FD_CLR(rfbScreen->listen6Sock, &rfbScreen->allFds);
+        rfbCloseSocket(rfbScreen->listen6Sock);
+    }
+#endif
+
+    /* re-create from the current interface addresses */
+    if (rfbScreen->port > 0) {
+        if ((rfbScreen->listenSock = rfbListenOnTCPPort(rfbScreen->port, iface)) == RFB_INVALID_SOCKET) {
+            rfbLogPerror("rfbRebindListenSockets: ListenOnTCPPort");
+        } else {
+            rfbLog("rfbRebindListenSockets: listening for VNC connections on TCP port %d\n", rfbScreen->port);
+            FD_SET(rfbScreen->listenSock, &rfbScreen->allFds);
+            rfbScreen->maxFd = rfbMax((int)rfbScreen->listenSock, rfbScreen->maxFd);
+        }
+    }
+
+#ifdef LIBVNCSERVER_IPv6
+    if (rfbScreen->ipv6port > 0) {
+        if ((rfbScreen->listen6Sock = rfbListenOnTCP6Port(rfbScreen->ipv6port, rfbScreen->listen6Interface)) == RFB_INVALID_SOCKET) {
+            /* rfbListenOnTCP6Port has its own detailed error printout */
+        } else {
+            rfbLog("rfbRebindListenSockets: listening for VNC connections on TCP6 port %d\n", rfbScreen->ipv6port);
+            FD_SET(rfbScreen->listen6Sock, &rfbScreen->allFds);
+            rfbScreen->maxFd = rfbMax((int)rfbScreen->listen6Sock, rfbScreen->maxFd);
+        }
+    }
+#endif
+
+    /* The HTTP listeners are bound to the same interface address and go stale the
+       same way, so re-create them too. rfbHttpCheckFds() runs on this same listener
+       thread, so closing/reopening here cannot race it. Only relevant with an httpDir
+       configured; reset httpInitDone so rfbHttpInitSockets() actually runs again. This
+       is best-effort and does not affect the RFB-based return value below. */
+    if (rfbScreen->httpDir) {
+        rfbHttpShutdownSockets(rfbScreen);
+        rfbScreen->httpInitDone = FALSE;
+        rfbHttpInitSockets(rfbScreen);
+    }
+
+    return (rfbScreen->listenSock != RFB_INVALID_SOCKET
+#ifdef LIBVNCSERVER_IPv6
+            || rfbScreen->listen6Sock != RFB_INVALID_SOCKET
+#endif
+           ) ? TRUE : FALSE;
+}
+
 /*
  * rfbCheckFds is called from ProcessInputEvents to check for input on the RFB
  * socket(s).  If there is input to process, the appropriate function in the