From 4b240dad0ee49c24295dfb3d21faf9001c362ac2 Mon Sep 17 00:00:00 2001
From: David Fort <contact@hardening-consulting.com>
Date: Fri, 26 Jan 2018 15:21:49 +0100
Subject: [PATCH] video+geometry: fixed leaks, a segfault and concurrent
 accesses

---
 channels/geometry/client/geometry_main.c |  5 +++++
 channels/video/client/video_main.c       |  6 ++++--
 client/X11/xf_channels.c                 |  9 +++++++++
 client/X11/xf_video.c                    | 17 +++++++++++------
 4 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/channels/geometry/client/geometry_main.c b/channels/geometry/client/geometry_main.c
index 526f3e1f3..9c3a16b90 100644
--- a/channels/geometry/client/geometry_main.c
+++ b/channels/geometry/client/geometry_main.c
@@ -384,6 +384,11 @@ static UINT geometry_plugin_initialize(IWTSPlugin* pPlugin, IWTSVirtualChannelMa
 static UINT geometry_plugin_terminated(IWTSPlugin* pPlugin)
 {
 	GEOMETRY_PLUGIN* geometry = (GEOMETRY_PLUGIN*) pPlugin;
+	GeometryClientContext* context = (GeometryClientContext *)geometry->iface.pInterface;
+
+	if (context)
+		HashTable_Free(context->geometries);
+
 	free(geometry->listener_callback);
 	free(geometry->iface.pInterface);
 	free(pPlugin);
diff --git a/channels/video/client/video_main.c b/channels/video/client/video_main.c
index 9c00d2668..ed1e55ab7 100755
--- a/channels/video/client/video_main.c
+++ b/channels/video/client/video_main.c
@@ -204,7 +204,7 @@ static UINT video_control_on_data_received(IWTSVirtualChannelCallback* pChannelC
 
 static UINT video_control_send_client_notification(VideoClientContext *context, TSMM_CLIENT_NOTIFICATION *notif)
 {
-	BYTE buf[30];
+	BYTE buf[100];
 	wStream *s;
 	VIDEO_PLUGIN* video = (VIDEO_PLUGIN *)context->handle;
 	IWTSVirtualChannel* channel;
@@ -240,10 +240,10 @@ static UINT video_control_send_client_notification(VideoClientContext *context,
 	Stream_SealLength(s);
 	Stream_SetPosition(s, 0);
 	Stream_Write_UINT32(s, cbSize);
+	Stream_Free(s, FALSE);
 
 	channel = video->control_callback->channel_callback->channel;
 	ret = channel->Write(channel, cbSize, buf, NULL);
-	Stream_Free(s, FALSE);
 
 	return ret;
 }
@@ -440,7 +440,9 @@ static UINT video_plugin_initialize(IWTSPlugin* plugin, IWTSVirtualChannelManage
 static UINT video_plugin_terminated(IWTSPlugin* pPlugin)
 {
 	VIDEO_PLUGIN* video = (VIDEO_PLUGIN*) pPlugin;
+
 	free(video->control_callback);
+	free(video->data_callback);
 	free(video->wtsPlugin.pInterface);
 	free(pPlugin);
 	return CHANNEL_RC_OK;
diff --git a/client/X11/xf_channels.c b/client/X11/xf_channels.c
index 900d4e98b..88c309f9d 100644
--- a/client/X11/xf_channels.c
+++ b/client/X11/xf_channels.c
@@ -115,4 +115,13 @@ void xf_OnChannelDisconnectedEventHandler(rdpContext* context, ChannelDisconnect
 	{
 		xf_encomsp_uninit(xfc, (EncomspClientContext*) e->pInterface);
 	}
+	else if (strcmp(e->name, VIDEO_CONTROL_DVC_CHANNEL_NAME) == 0)
+	{
+		xf_video_control_uninit(xfc, (VideoClientContext*)e->pInterface);
+	}
+	else if (strcmp(e->name, VIDEO_DATA_DVC_CHANNEL_NAME) == 0)
+	{
+		xf_video_data_uninit(xfc, (VideoClientContext*)e->pInterface);
+	}
+
 }
diff --git a/client/X11/xf_video.c b/client/X11/xf_video.c
index 09c980e97..37045299a 100644
--- a/client/X11/xf_video.c
+++ b/client/X11/xf_video.c
@@ -315,6 +315,8 @@ static UINT xf_video_PresentationRequest(VideoClientContext* context, TSMM_PRESE
 		}
 
 		xfVideo->currentPresentation = NULL;
+		xfVideo->droppedFrames = 0;
+		xfVideo->publishedFrames = 0;
 		xfPresentationContext_unref(presentation);
 	}
 
@@ -359,9 +361,6 @@ static void xf_video_timer(xfContext *xfc, TimerEventArgs *timer)
 	xfPresentationContext *presentation;
 	xfVideoFrame *peekFrame, *frame = NULL;
 
-	if (!xfVideo->currentPresentation)
-		return;
-
 	EnterCriticalSection(&xfVideo->framesLock);
 	do
 	{
@@ -404,11 +403,15 @@ static void xf_video_timer(xfContext *xfc, TimerEventArgs *timer)
 treat_feedback:
 	if (xfVideo->nextFeedbackTime < timer->now)
 	{
-		/* we can compute some feedback only if we have some published frames */
-		if (xfVideo->publishedFrames)
+		/* we can compute some feedback only if we have some published frames and
+		 * a current presentation
+		 */
+		if (xfVideo->publishedFrames && xfVideo->currentPresentation)
 		{
 			UINT32 computedRate;
 
+			InterlockedIncrement(&xfVideo->currentPresentation->refCounter);
+
 			if (xfVideo->droppedFrames)
 			{
 				/**
@@ -444,7 +447,7 @@ treat_feedback:
 			if (computedRate != xfVideo->lastSentRate)
 			{
 				TSMM_CLIENT_NOTIFICATION notif;
-				notif.PresentationId = presentation->PresentationId;
+				notif.PresentationId = xfVideo->currentPresentation->PresentationId;
 				notif.NotificationType = TSMM_CLIENT_NOTIFICATION_TYPE_FRAMERATE_OVERRIDE;
 				if (computedRate == XF_VIDEO_UNLIMITED_RATE)
 				{
@@ -463,6 +466,8 @@ treat_feedback:
 				WLog_DBG(TAG, "server notified with rate %d published=%d dropped=%d", xfVideo->lastSentRate,
 						xfVideo->publishedFrames, xfVideo->droppedFrames);
 			}
+
+			xfPresentationContext_unref(xfVideo->currentPresentation);
 		}
 
 		WLog_DBG(TAG, "currentRate=%d published=%d dropped=%d", xfVideo->lastSentRate,