libvncserver: fix show server-side cursor by multiple clients

Author: Volodymyr Samokhatko

include/rfb/rfb.h

@@ -372,6 +372,12 @@ typedef struct _rfbScreenInfo
 #ifdef LIBVNCSERVER_HAVE_LIBZ
     rfbSetXCutTextUTF8ProcPtr setXCutTextUTF8;
 #endif
+
+    /** how many clients have requested to show the cursor in the framebuffer */
+    int showCursorRefCount;
+    /** where the cursor is shown */
+    int underCursorBufferX, underCursorBufferY;
+    RWLOCK(showCursorRWLock);
 } rfbScreenInfo, *rfbScreenInfoPtr;
 
 

src/libvncserver/cursor.c

@@ -500,29 +500,32 @@ void rfbMakeRichCursorFromXCursor(rfbScreenInfoPtr rfbScreen,rfbCursorPtr cursor
 
 /* functions to draw/hide cursor directly in the frame buffer */
 
-void rfbHideCursor(rfbClientPtr cl)
+void rfbHideCursor(rfbScreenInfoPtr s)
 {
-   rfbScreenInfoPtr s=cl->screen;
    rfbCursorPtr c;
    int j,x1,x2,y1,y2,bpp=s->serverFormat.bitsPerPixel/8,
      rowstride=s->paddedWidthInBytes;
    LOCK(s->cursorMutex);
+   if(--s->showCursorRefCount != 0) {
+     UNLOCK(s->cursorMutex);
+     return;
+   }
    c=s->cursor;
    if(!c) {
      UNLOCK(s->cursorMutex);
      return;
    }
 
    /* restore what is under the cursor */
-   x1=cl->cursorX-c->xhot;
+   x1=s->underCursorBufferX-c->xhot;
    x2=x1+c->width;
    if(x1<0) x1=0;
    if(x2>=s->width) x2=s->width-1;
    x2-=x1; if(x2<=0) {
      UNLOCK(s->cursorMutex);
      return;
    }
-   y1=cl->cursorY-c->yhot;
+   y1=s->underCursorBufferY-c->yhot;
    y2=y1+c->height;
    if(y1<0) y1=0;
    if(y2>=s->height) y2=s->height-1;
@@ -543,16 +546,19 @@ void rfbHideCursor(rfbClientPtr cl)
    UNLOCK(s->cursorMutex);
 }
 
-void rfbShowCursor(rfbClientPtr cl)
+void rfbShowCursor(rfbScreenInfoPtr s)
 {
-   rfbScreenInfoPtr s=cl->screen;
    rfbCursorPtr c;
    int i,j,x1,x2,y1,y2,i1,j1,bpp=s->serverFormat.bitsPerPixel/8,
      rowstride=s->paddedWidthInBytes,
      bufSize,w;
    rfbBool wasChanged=FALSE;
 
    LOCK(s->cursorMutex);
+   if(++s->showCursorRefCount != 1) {
+     UNLOCK(s->cursorMutex);
+     return;
+   }
    c=s->cursor;
    if(!c) {
 	UNLOCK(s->cursorMutex);
@@ -570,7 +576,7 @@ void rfbShowCursor(rfbClientPtr cl)
 
    /* save what is under the cursor */
    i1=j1=0; /* offset in cursor */
-   x1=cl->cursorX-c->xhot;
+   x1=s->cursorX-c->xhot;
    x2=x1+c->width;
    if(x1<0) { i1=-x1; x1=0; }
    if(x2>=s->width) x2=s->width-1;
@@ -579,7 +585,7 @@ void rfbShowCursor(rfbClientPtr cl)
      return; /* nothing to do */
    }
 
-   y1=cl->cursorY-c->yhot;
+   y1=s->cursorY-c->yhot;
    y2=y1+c->height;
    if(y1<0) { j1=-y1; y1=0; }
    if(y2>=s->height) y2=s->height-1;
@@ -704,6 +710,10 @@ void rfbShowCursor(rfbClientPtr cl)
    /* Copy to all scaled versions */
    rfbScaledScreenUpdate(s, x1, y1, x1+x2, y1+y2);
 
+   /* Memorize the coords where the cursor was drawn */
+   s->underCursorBufferX = s->cursorX;
+   s->underCursorBufferY = s->cursorY;
+
    UNLOCK(s->cursorMutex);
 }
 
@@ -764,6 +774,8 @@ void rfbSetCursor(rfbScreenInfoPtr rfbScreen,rfbCursorPtr c)
   rfbClientIteratorPtr iterator;
   rfbClientPtr cl;
 
+  /* wait until the cursor is not shown in the framebuffer */
+  WRLOCK(rfbScreen->showCursorRWLock);
   LOCK(rfbScreen->cursorMutex);
 
   if(rfbScreen->cursor) {
@@ -788,5 +800,6 @@ void rfbSetCursor(rfbScreenInfoPtr rfbScreen,rfbCursorPtr c)
   rfbReleaseClientIterator(iterator);
 
   UNLOCK(rfbScreen->cursorMutex);
+  RWUNLOCK(rfbScreen->showCursorRWLock);
 }
 

src/libvncserver/main.c

@@ -996,6 +996,11 @@ rfbScreenInfoPtr rfbGetScreen(int* argc,char** argv,
 
    screen->permitFileTransfer = FALSE;
 
+   screen->showCursorRefCount = 0;
+   screen->underCursorBufferX = 0;
+   screen->underCursorBufferY = 0;
+   INIT_RWLOCK(screen->showCursorRWLock);
+
    if(!rfbProcessArguments(screen,argc,argv)) {
      free(screen);
      return NULL;
@@ -1156,6 +1161,8 @@ void rfbScreenCleanup(rfbScreenInfoPtr screen)
     cl1=cl;
   }
   rfbReleaseClientIterator(i);
+
+  TINI_RWLOCK(screen->showCursorRWLock);
 
 #define FREE_IF(x) if(screen->x) free(screen->x)
   FREE_IF(colourMap.data.bytes);

src/libvncserver/private.h

@@ -3,8 +3,8 @@
 
 /* from cursor.c */
 
-void rfbShowCursor(rfbClientPtr cl);
-void rfbHideCursor(rfbClientPtr cl);
+void rfbShowCursor(rfbScreenInfoPtr s);
+void rfbHideCursor(rfbScreenInfoPtr s);
 void rfbRedrawAfterHideCursor(rfbClientPtr cl,sraRegionPtr updateRegion);
 
 /* from main.c */

src/libvncserver/rfbserver.c

@@ -3328,7 +3328,12 @@ rfbSendFramebufferUpdate(rfbClientPtr cl,
 	UNLOCK(cl->screen->cursorMutex);
 	rfbRedrawAfterHideCursor(cl,updateRegion);
       }
-      rfbShowCursor(cl);
+      /* show the cursor if the cursor is not shown in the framebuffer, increment the refcount */
+      RDLOCK(cl->screen->showCursorRWLock);
+      rfbShowCursor(cl->screen);
+    } else {
+      /* wait until the cursor is not shown in the framebuffer */
+      WRLOCK(cl->screen->showCursorRWLock);
     }
 
     /*
@@ -3574,6 +3579,7 @@ rfbSendFramebufferUpdate(rfbClientPtr cl,
     if (!cl->enableCursorShapeUpdates) {
       rfbHideCursor(cl);
     }
+    RWUNLOCK(cl->screen->showCursorRWLock);
 
     if(i)
         sraRgnReleaseIterator(i);