From 61efca48f000d9a31aa23b550be62b6951dc21af Mon Sep 17 00:00:00 2001
From: Andri Yngvason <andri@yngvason.is>
Date: Wed, 29 Jan 2020 21:33:13 +0000
Subject: [PATCH] damage: Increment/decrement reference count before/after
 check

This is prudent. The user might throw away these buffers before the
damage check finishes.
---
 include/neatvnc.h |  2 +-
 src/damage.c      | 21 ++++++++++++++-------
 2 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/include/neatvnc.h b/include/neatvnc.h
index 36a3881..4f700b5 100644
--- a/include/neatvnc.h
+++ b/include/neatvnc.h
@@ -91,6 +91,6 @@ int nvnc_feed_frame(struct nvnc* self, struct nvnc_fb* fb,
  *
  * This is a utility function that may be used to reduce network traffic.
  */
-int nvnc_check_damage(const struct nvnc_fb* fb0, const struct nvnc_fb* fb1,
+int nvnc_check_damage(struct nvnc_fb* fb0, struct nvnc_fb* fb1,
                       int x_hint, int y_hint, int width_hint, int height_hint,
                       nvnc_damage_fn on_check_done, void* userdata);
diff --git a/src/damage.c b/src/damage.c
index d8c7682..a419fd9 100644
--- a/src/damage.c
+++ b/src/damage.c
@@ -16,8 +16,8 @@
 
 struct damage_check {
 	uv_work_t work;
-	const struct nvnc_fb* fb0;
-	const struct nvnc_fb* fb1;
+	struct nvnc_fb* fb0;
+	struct nvnc_fb* fb1;
 	int x_hint;
 	int y_hint;
 	int width_hint;
@@ -103,13 +103,16 @@ void on_damage_check_done_linear(uv_work_t* work, int status)
 
 	check->on_done(&check->damage, check->userdata);
 
+	nvnc_fb_unref(check->fb1);
+	nvnc_fb_unref(check->fb0);
+
 	pixman_region_fini(&check->damage);
 	free(check);
 }
 
-int check_damage_linear_threaded(const struct nvnc_fb* fb0,
-                                 const struct nvnc_fb* fb1, int x_hint,
-                                 int y_hint, int width_hint, int height_hint,
+int check_damage_linear_threaded(struct nvnc_fb* fb0, struct nvnc_fb* fb1,
+                                 int x_hint, int y_hint,
+                                 int width_hint, int height_hint,
                                  nvnc_damage_fn on_check_done, void* userdata)
 {
 	struct damage_check* work = calloc(1, sizeof(*work));
@@ -130,14 +133,18 @@ int check_damage_linear_threaded(const struct nvnc_fb* fb0,
 	int rc = uv_queue_work(uv_default_loop(), &work->work,
 	                       do_damage_check_linear,
 	                       on_damage_check_done_linear);
-	if (rc < 0)
+	if (rc >= 0) {
+		nvnc_fb_ref(fb0);
+		nvnc_fb_ref(fb1);
+	} else {
 		free(work);
+	}
 
 	return rc;
 }
 
 EXPORT
-int nvnc_check_damage(const struct nvnc_fb* fb0, const struct nvnc_fb* fb1,
+int nvnc_check_damage(struct nvnc_fb* fb0, struct nvnc_fb* fb1,
                       int x_hint, int y_hint, int width_hint, int height_hint,
                       nvnc_damage_fn on_check_done, void* userdata)
 {