Fix sound and clipboard crashes

- In case clipboard is not initialized, clipboard_data_in returns
    (fixes a segfault)
- If less than 4 bytes are sent to sound_send_wave_data_chunk, it
  returns
    (fixes a segfault)
- When sending sound initiliazation messages set g_chan in chansrv to 0,
  so the server waits for client to reply (this makes sound work afte
  reconnecting)
- In process_message_channel_setup, clear any leftover data in
  chan_items

3 files changed, 26 insertions, 0 deletions

diff --git a/sesman/chansrv/chansrv.c b/sesman/chansrv/chansrv.c
index 0f7ff042..a3b3f913 100644
--- a/sesman/chansrv/chansrv.c
+++ b/sesman/chansrv/chansrv.c
@@ -336,6 +336,23 @@ process_message_channel_setup(struct stream *s)
         g_memset(ci->name, 0, sizeof(ci->name));
         in_uint8a(s, ci->name, 8);
         in_uint16_le(s, ci->id);
+        // there might be leftover data from last session after reconnecting
+        // so free it
+        if (ci->head != 0) { 
+            struct chan_out_data* cod = ci->head;
+            struct chan_out_data* old_cod; 
+            while (1) {
+                free_stream(cod->s);
+                old_cod = cod; 
+                cod = cod->next;
+                g_free(old_cod);
+                if (ci->tail == old_cod) {
+                    break;
+                }    
+            }    
+        }    
+        ci->head = 0; 
+        ci->tail = 0; 
         in_uint16_le(s, ci->flags);
         LOGM((LOG_LEVEL_DEBUG, "process_message_channel_setup: chan name '%s' "
               "id %d flags %8.8x", ci->name, ci->id, ci->flags));
@@ -386,6 +403,8 @@ process_message_channel_setup(struct stream *s)
 
     if (g_rdpsnd_index >= 0)
     {
+        // gets reset to 1 by next send_data_from_chan_item
+        g_sent = 0; // wait for response!
         sound_init();
     }
 
diff --git a/sesman/chansrv/clipboard.c b/sesman/chansrv/clipboard.c
index 27c45fff..dc6d2484 100644
--- a/sesman/chansrv/clipboard.c
+++ b/sesman/chansrv/clipboard.c
@@ -1490,6 +1490,12 @@ clipboard_data_in(struct stream *s, int chan_id, int chan_flags, int length,
     struct stream *ls;
     char *holdp;
 
+    if (! g_clip_up) {
+        LOG(10, ("aborting clipboard_data_in - clipboard has not been initialized"));
+        // we return 0 here to indicate no protocol problem occured
+        return 0;
+    }
+
     LLOGLN(10, ("clipboard_data_in: chan_id %d "
             "chan_flags 0x%x length %d total_length %d "
             "in_request %d g_ins->size %d",
diff --git a/sesman/chansrv/sound.c b/sesman/chansrv/sound.c
index 55f6f88d..c4ca8261 100644
--- a/sesman/chansrv/sound.c
+++ b/sesman/chansrv/sound.c
@@ -302,6 +302,7 @@ sound_send_wave_data_chunk(char *data, int data_bytes)
     if ((data_bytes < 4) || (data_bytes > 128 * 1024))
     {
         LOG(0, ("sound_send_wave_data_chunk: bad data_bytes %d", data_bytes));
+        return 0;
     }
 
     /* part one of 2 PDU wave info */