From: Christian Beier <dontmind@freeshell.org>
Date: Sun, 21 Oct 2018 23:44:39 +0200
Subject: [2/5] tightvnc-filetransfer: refactor CloseUndoneFileTransfer() into
 two functions
Origin: https://github.com/LibVNC/libvncserver/commit/f8912fee5a58fb3975eda2589f6d4686f0c1ae68
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2018-15126
Bug-Debian: https://bugs.debian.org/916941
Bug: https://github.com/LibVNC/libvncserver/issues/242

...for closing upload and download separately.

re #242
---
 libvncserver/tightvnc-filetransfer/filetransfermsg.c | 12 ++++++++++--
 libvncserver/tightvnc-filetransfer/filetransfermsg.h |  3 ++-
 .../handlefiletransferrequest.c                      |  8 ++++----
 3 files changed, 16 insertions(+), 7 deletions(-)

--- a/libvncserver/tightvnc-filetransfer/filetransfermsg.c
+++ b/libvncserver/tightvnc-filetransfer/filetransfermsg.c
@@ -670,7 +670,7 @@
 		char reason[] = "Error writing file data";
 		int reasonLen = strlen(reason);
 		ftm = CreateFileUploadErrMsg(reason, reasonLen);
-		CloseUndoneFileTransfer(cl, rtcp);
+		CloseUndoneFileUpload(cl, rtcp);
 	}		
 	return ftm;
 }
@@ -733,7 +733,7 @@
  ******************************************************************************/
 
 void
-CloseUndoneFileTransfer(rfbClientPtr cl, rfbTightClientPtr rtcp)
+CloseUndoneFileUpload(rfbClientPtr cl, rfbTightClientPtr rtcp)
 {
 	/* TODO :: File Upload case is not handled currently */
 	/* TODO :: In case of concurrency we need to use Critical Section */
@@ -757,6 +757,14 @@
 
 		memset(rtcp->rcft.rcfu.fName, 0 , PATH_MAX);
 	}
+}
+
+
+void
+CloseUndoneFileDownload(rfbClientPtr cl, rfbTightClientPtr rtcp)
+{
+	if(cl == NULL)
+		return;
 	
 	if(rtcp->rcft.rcfd.downloadInProgress == TRUE) {
 		rtcp->rcft.rcfd.downloadInProgress = FALSE;
--- a/libvncserver/tightvnc-filetransfer/filetransfermsg.h
+++ b/libvncserver/tightvnc-filetransfer/filetransfermsg.h
@@ -51,7 +51,8 @@
 
 void CreateDirectory(char* dirName);
 void FileUpdateComplete(rfbClientPtr cl, rfbTightClientPtr data);
-void CloseUndoneFileTransfer(rfbClientPtr cl, rfbTightClientPtr data);
+void CloseUndoneFileUpload(rfbClientPtr cl, rfbTightClientPtr data);
+void CloseUndoneFileDownload(rfbClientPtr cl, rfbTightClientPtr data);
 
 void FreeFileTransferMsg(FileTransferMsg ftm);
 
--- a/libvncserver/tightvnc-filetransfer/handlefiletransferrequest.c
+++ b/libvncserver/tightvnc-filetransfer/handlefiletransferrequest.c
@@ -490,7 +490,7 @@
 
 				if(cl != NULL) {
 			    	rfbCloseClient(cl);
-				CloseUndoneFileTransfer(cl, rtcp);
+				CloseUndoneFileDownload(cl, rtcp);
 				}
 				
 				FreeFileTransferMsg(fileDownloadMsg);
@@ -588,7 +588,7 @@
 					" reason <%s>\n", __FILE__, __FUNCTION__, reason);
 	
 	pthread_mutex_lock(&fileDownloadMutex);
-	CloseUndoneFileTransfer(cl, rtcp);
+	CloseUndoneFileDownload(cl, rtcp);
 	pthread_mutex_unlock(&fileDownloadMutex);
 	
 	if(reason != NULL) {
@@ -831,7 +831,7 @@
 			FreeFileTransferMsg(ftm);
 		}
 
-		CloseUndoneFileTransfer(cl, rtcp);
+		CloseUndoneFileUpload(cl, rtcp);
 
 	    if(pBuf != NULL) {
 	    	free(pBuf);
@@ -931,7 +931,7 @@
 	rfbLog("File [%s]: Method [%s]: File Upload Failed Request received:"
 				" reason <%s>\n", __FILE__, __FUNCTION__, reason);
 
-	CloseUndoneFileTransfer(cl, rtcp);
+	CloseUndoneFileUpload(cl, rtcp);
 
 	if(reason != NULL) {
 		free(reason);