From: Christian Beier Date: Sat, 10 Nov 2018 17:33:00 +0100 Subject: [5/5] tightvnc-filetransfer: do not close stuff from within a thread Origin: https://github.com/LibVNC/libvncserver/commit/495ffa3f3a213ab058eee1d7da48fa5ef71914d8 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2018-15126 Bug-Debian: https://bugs.debian.org/916941 Bug: https://github.com/LibVNC/libvncserver/issues/242 ... as this crashes badly and the client is closed by the main thread machinery afterwards. re #242 --- .../tightvnc-filetransfer/handlefiletransferrequest.c | 6 ------ 1 file changed, 6 deletions(-) --- a/libvncserver/tightvnc-filetransfer/handlefiletransferrequest.c +++ b/libvncserver/tightvnc-filetransfer/handlefiletransferrequest.c @@ -487,12 +487,6 @@ if(rfbWriteExact(cl, fileDownloadMsg.data, fileDownloadMsg.length) < 0) { rfbLog("File [%s]: Method [%s]: Error while writing to socket \n" , __FILE__, __FUNCTION__); - - if(cl != NULL) { - rfbCloseClient(cl); - CloseUndoneFileDownload(cl, rtcp); - } - FreeFileTransferMsg(fileDownloadMsg); return NULL; }