Merge branch 'main' into dev

ChangeLog.md

@@ -84,6 +84,9 @@ used to specify the external SSH client command.  In `Via`/`Tunnel` SSH
 command-line templates, including the default ones, `%S` is now replaced with
 the value of this new parameter.
 
+7. Fixed a regression introduced by 3.0 beta1[24] that caused the TurboVNC
+Server to leak memory when the RFB flow control extensions were used.
+
 
 3.1.1
 =====

unix/Xvnc/programs/Xserver/hw/vnc/flowcontrol.c

@@ -208,7 +208,7 @@ Bool rfbSendRTTPing(rfbClientPtr cl)
 static void HandleRTTPong(rfbClientPtr cl)
 {
   struct timeval now;
-  rfbRTTInfo *rttInfo;
+  rfbRTTInfo *rttInfo = NULL;
   unsigned rtt, delay;
 
   if (xorg_list_is_empty(&cl->pings))
@@ -233,7 +233,7 @@ static void HandleRTTPong(rfbClientPtr cl)
   /* Pings sent before the last adjustment aren't interesting, as they aren't a
      measure of the current congestion window. */
   if (isBefore(&rttInfo->tv, &cl->lastAdjustment))
-    return;
+    goto bailout;
 
   /* Estimate added delay because of overtaxed buffers (see above.) */
   delay = rttInfo->extra * cl->baseRTT / cl->congWindow;
@@ -265,6 +265,7 @@ static void HandleRTTPong(rfbClientPtr cl)
   cl->measurements++;
   UpdateCongestion(cl);
 
+bailout:
   free(rttInfo);
 }
 

unix/Xvnc/programs/Xserver/hw/vnc/init.c

@@ -1672,6 +1672,7 @@ void ddxGiveUp(enum ExitCode error)
 #endif
   ShutdownTightThreads();
   TimerFree(pointerLockTimer);
+  rfbRemoveScreens(&rfbScreens);
   free(rfbFB.pfbMemory);
   if (initOutputCalled) {
     char unixSocketName[32];

unix/Xvnc/programs/Xserver/hw/vnc/rfbssl_openssl.c

@@ -404,6 +404,8 @@ rfbSslCtx *rfbssl_init(rfbClientPtr cl, Bool anon)
       rfbssl_error("SSL_CTX_set_tmp_dh()");
       goto bailout;
     }
+    crypto.DH_free(dh);
+    dh = NULL;
     if (!ssl.SSL_CTX_set_cipher_list(ctx->ssl_ctx, rfbAuthCipherSuites ?
                                                    rfbAuthCipherSuites :
                                                    "aNULL")) {