From 41396c032d887156c518feb4aa60875063687147 Mon Sep 17 00:00:00 2001 From: Marco Fortina Date: Sat, 16 May 2026 05:43:34 +0000 Subject: [PATCH] libvncserver: close resources on error paths --- src/libvncserver/rfbserver.c | 13 ++++++++++++- src/libvncserver/sockets.c | 4 +++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/src/libvncserver/rfbserver.c b/src/libvncserver/rfbserver.c index 22af22d7d..2af180c2e 100644 --- a/src/libvncserver/rfbserver.c +++ b/src/libvncserver/rfbserver.c @@ -423,6 +423,10 @@ rfbNewTCPOrUDPClient(rfbScreenInfoPtr rfbScreen, #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION if(!rfbSetNonBlocking(sock)) { rfbCloseSocket(sock); + free(cl->host); + if (cl->scaledScreen != NULL) + cl->scaledScreen->scaledScreenRefCount--; + free(cl); return NULL; } @@ -1482,7 +1486,14 @@ rfbBool rfbSendDirContent(rfbClientPtr cl, int length, char *buffer) return rfbSendFileTransferMessage(cl, rfbDirPacket, rfbADirectory, 0, 0, NULL); /* send back the path name (necessary for links) */ - if (rfbSendFileTransferMessage(cl, rfbDirPacket, rfbADirectory, 0, length, buffer)==FALSE) return FALSE; + if (rfbSendFileTransferMessage(cl, rfbDirPacket, rfbADirectory, 0, length, buffer)==FALSE) { +#ifdef WIN32 + FindClose(findHandle); +#else + closedir(dirp); +#endif + return FALSE; + } #ifdef WIN32 while (findHandle != INVALID_HANDLE_VALUE) diff --git a/src/libvncserver/sockets.c b/src/libvncserver/sockets.c index 3a4c6da70..494ae04a6 100644 --- a/src/libvncserver/sockets.c +++ b/src/libvncserver/sockets.c @@ -1208,8 +1208,10 @@ rfbConnectToTcpAddr(char *host, sock = RFB_INVALID_SOCKET; /* set return value */ } else { /* one succeeded, re-set to blocking */ - if (!sock_set_nonblocking(sock, FALSE, rfbErr)) + if (!sock_set_nonblocking(sock, FALSE, rfbErr)) { rfbCloseSocket(sock); + sock = RFB_INVALID_SOCKET; + } } /* all done with this structure now */