vnc: add missing lock for vnc_cursor_define()

All vnc_write() calls must be locked (except the ones present before
the protocol initialization).

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/ui/vnc.c b/ui/vnc.c
index 7330b2c889..7fc40acae8 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -796,6 +796,7 @@ static int vnc_cursor_define(VncState *vs)
     int isize;
 
     if (vnc_has_feature(vs, VNC_FEATURE_RICH_CURSOR)) {
+        vnc_lock_output(vs);
         vnc_write_u8(vs,  VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
         vnc_write_u8(vs,  0);  /*  padding     */
         vnc_write_u16(vs, 1);  /*  # of rects  */
@@ -804,6 +805,7 @@ static int vnc_cursor_define(VncState *vs)
         isize = c->width * c->height * vs->clientds.pf.bytes_per_pixel;
         vnc_write_pixels_generic(vs, &pf, c->data, isize);
         vnc_write(vs, vs->vd->cursor_mask, vs->vd->cursor_msize);
+        vnc_unlock_output(vs);
         return 0;
     }
     return -1;