Use-after-free issue in rfbShutdownServer

[ateska]

libvncserver/libvncserver/main.c

Line 1090 in 6814e94

rfbClientConnectionGone(cl);

See rfbClientIteratorNext (rfbClientIteratorNext:224) - i->next = i->next->next; a memory that has been freed at the end of rfbClientConnectionGone() is accessed thru iterator.

[ateska]

The issue appears when server is shutdown with one or more client still connected.

[bk138]

@ateska I guess this happens when the server shuts down and a client disconnects the very same point in time? Or do you experience something different?

Are you running a threaded server or not?

[ateska]

The server is running in a dedicated thread. However, the mistake is obvious, it is likely caused by more strict heap management policy on iOS. The code obviously accesses the memory that has been free()d just few steps back.

[bk138]

Closed by #238 in conjuction with 14c24e2 and d3a4292