GUACAMOLE-424: Merge changes addressing potential NULL-pointer dereference in VNC user leave handler.

src/common/cursor.c

@@ -34,6 +34,16 @@
 #include <stdlib.h>
 #include <string.h>
 
+
+/**
+ * Allocates a cursor as well as an image buffer where the cursor is rendered.
+ *
+ * @param client
+ *     The client owning the cursor.
+ *
+ * @return
+ *     The newly-allocated cursor or NULL if cursor cannot be allocated.
+ */
 guac_common_cursor* guac_common_cursor_alloc(guac_client* client) {
 
     guac_common_cursor* cursor = malloc(sizeof(guac_common_cursor));

src/common/display.c

@@ -99,6 +99,22 @@ static void guac_common_display_free_layers(guac_common_display_layer* layers,
 
 }
 
+/**
+ * Allocates a display and a cursor which are used to represent the remote
+ * display and cursor.
+ *
+ * @param client
+ *     The client owning the cursor.
+ *
+ * @param width
+ *     The desired width of the display.
+ *
+ * @param height
+ *     The desired height of the display.
+ *
+ * @return
+ *     The newly-allocated display or NULL if display cannot be allocated.
+ */
 guac_common_display* guac_common_display_alloc(guac_client* client,
         int width, int height) {
 
@@ -107,14 +123,18 @@ guac_common_display* guac_common_display_alloc(guac_client* client,
     if (display == NULL)
         return NULL;
 
+    /* Allocate shared cursor */
+    display->cursor = guac_common_cursor_alloc(client);
+    if (display->cursor == NULL) {
+        free(display);
+        return NULL;
+    }
+
     pthread_mutex_init(&display->_lock, NULL);
 
     /* Associate display with given client */
     display->client = client;
 
-    /* Allocate shared cursor */
-    display->cursor = guac_common_cursor_alloc(client);
-
     display->default_surface = guac_common_surface_alloc(client,
             client->socket, GUAC_DEFAULT_LAYER, width, height);
 

src/protocols/vnc/user.c

@@ -112,8 +112,10 @@ int guac_vnc_user_leave_handler(guac_user* user) {
 
     guac_vnc_client* vnc_client = (guac_vnc_client*) user->client->data;
 
-    /* Update shared cursor state */
+    if (vnc_client->display) {
-    guac_common_cursor_remove_user(vnc_client->display->cursor, user);
+        /* Update shared cursor state */
+        guac_common_cursor_remove_user(vnc_client->display->cursor, user);
+    }
 
     /* Free settings if not owner (owner settings will be freed with client) */
     if (!user->owner) {