Description of problem:

Xvnc segfaults when launched from inetd

Version-Release number of selected component (if applicable):

Latest RHEL 7.2 - tigervnc-server-1.3.1-3.el7.x86_64

How reproducible:

Always

Steps to Reproduce:
1. Add following to /etc/xinetd.d/rfb:

service rfb
{
        protocol = tcp
        wait = no
        user = nobody
        server = /usr/bin/Xvnc
        server_args = -inetd -query localhost -once -SecurityTypes None
}

2. Attempt to vnc to box on :5900

Actual results:

VNC session fails to launch, Xvnc segfaults

Expected results:

VNC session launches, GDM screen presented (this worked fine in RHEL 7.1)

Additional info:

Running GDB on core file created shows segfault in this line:

Core was generated by `Xvnc -inetd -query localhost -once -SecurityTypes None'.
Program terminated with signal 11, Segmentation fault.
#0  network::TcpListener::TcpListener (this=0x7ffe72cbda20, listenaddr=0x0, listenaddrlen=6000)
    at /usr/src/debug/tigervnc-1.3.1/common/network/TcpSocket.cxx:426
426	  if ((sock = socket (listenaddr->sa_family, SOCK_STREAM, 0)) < 0)

It turns out that listenaddr is NULL.

(gdb) bt
#0  network::TcpListener::TcpListener (this=0x7ffe72cbda20, listenaddr=0x0, listenaddrlen=6000)
    at /usr/src/debug/tigervnc-1.3.1/common/network/TcpSocket.cxx:426
#1  0x000000000044794e in displayNumFree (num=num@entry=0) at xvnc.cc:355
#2  0x000000000044d2eb in ddxProcessArgument (argc=argc@entry=7, argv=argv@entry=0x7ffe72cbdd98, i=i@entry=1) at xvnc.cc:580
#3  0x00000000005bf34f in ProcessCommandLine (argc=argc@entry=7, argv=argv@entry=0x7ffe72cbdd98) at utils.c:689
#4  0x000000000056d629 in dix_main (argc=7, argv=0x7ffe72cbdd98, envp=0x7ffe72cbddd8) at main.c:146
#5  0x00007f0eef251b15 in __libc_start_main (main=0x449ad0 <main>, argc=7, ubp_av=0x7ffe72cbdd98, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7ffe72cbdd88) at libc-start.c:274
#6  0x000000000044ad8d in _start ()

In displayNumFree, the logic repeatedly tries to find a display number, but NULL is passed directly into network::TcpListener::TcpListener and then dereferenced.  This is a clear logic bug.

(gdb) l xvnc.cc:355
350	
351	static 
352	bool displayNumFree(int num)
353	{
354	    try {
355		network::TcpListener l(NULL, 6000+num);
356	    } catch (rdr::Exception& e) {
357		return false;
358	    }
359	    char file[256];

A sort of workaround is to change

        server_args = -inetd -query localhost -once -SecurityTypes None

to

        server_args = :1 -inetd -query localhost -once -SecurityTypes None

in /etc/xinetd.d/rfb, as this bypasses the flawed logic.  However this prevents multiple concurrent logins via VNC/XDM to the box.