From b876ba9988f48fc6c7d82e3f74e4ed520dc6785a Mon Sep 17 00:00:00 2001
From: Marco Fortina <marco_fortina@hotmail.it>
Date: Sun, 7 Jun 2026 01:28:47 +0200
Subject: [PATCH] Fix Svacer cursor and iterator leaks

---
 src/libvncserver/cursor.c    | 46 ++++++++++++++++++++++--------------
 src/libvncserver/main.c      |  3 +--
 src/libvncserver/rfbserver.c |  1 +
 3 files changed, 30 insertions(+), 20 deletions(-)

diff --git a/src/libvncserver/cursor.c b/src/libvncserver/cursor.c
index 1d14e6350..75e63a4f3 100644
--- a/src/libvncserver/cursor.c
+++ b/src/libvncserver/cursor.c
@@ -364,28 +364,39 @@ char* rfbMakeMaskFromAlphaSource(int width,int height,unsigned char* alphaSource
 	return (char *) result;
 }
 
+static void rfbFreeCursorBuffers(rfbCursorPtr cursor)
+{
+   if(!cursor)
+      return;
+
+   if(cursor->cleanupRichSource) {
+      free(cursor->richSource);
+      free(cursor->alphaSource);
+      cursor->richSource = NULL;
+      cursor->alphaSource = NULL;
+      cursor->cleanupRichSource = FALSE;
+   }
+
+   if(cursor->cleanupSource) {
+      free(cursor->source);
+      cursor->source = NULL;
+      cursor->cleanupSource = FALSE;
+   }
+
+   if(cursor->cleanupMask) {
+      free(cursor->mask);
+      cursor->mask = NULL;
+      cursor->cleanupMask = FALSE;
+   }
+}
+
 void rfbFreeCursor(rfbCursorPtr cursor)
 {
    if(cursor) {
-       if(cursor->cleanupRichSource)
-       {
-         free(cursor->richSource);
-         free(cursor->alphaSource);
-       }
-       if(cursor->cleanupSource)
-        free(cursor->source);
-       if(cursor->cleanupMask)
-        free(cursor->mask);
+       rfbFreeCursorBuffers(cursor);
        if(cursor->cleanup)
         free(cursor);
-       else {
-	   cursor->cleanup=cursor->cleanupSource=cursor->cleanupMask
-	       =cursor->cleanupRichSource=FALSE;
-	   cursor->source=cursor->mask=cursor->richSource=NULL;
-	   cursor->alphaSource=NULL;
-       }
    }
-   
 }
 
 /* background and foregroud colour have to be set beforehand */
@@ -774,8 +785,7 @@ void rfbSetCursor(rfbScreenInfoPtr rfbScreen,rfbCursorPtr c)
 	  rfbRedrawAfterHideCursor(cl,NULL);
     rfbReleaseClientIterator(iterator);
 
-    if(rfbScreen->cursor->cleanup)
-	 rfbFreeCursor(rfbScreen->cursor);
+    rfbFreeCursor(rfbScreen->cursor);
   }
 
   rfbScreen->cursor = c;
diff --git a/src/libvncserver/main.c b/src/libvncserver/main.c
index 3387d1666..700a84511 100644
--- a/src/libvncserver/main.c
+++ b/src/libvncserver/main.c
@@ -1168,8 +1168,7 @@ void rfbScreenCleanup(rfbScreenInfoPtr screen)
   FREE_SCREEN_MEMBER(underCursorBuffer);
   TINI_MUTEX(screen->cursorMutex);
 
-  if(screen->cursor != &myCursor)
-      rfbFreeCursor(screen->cursor);
+  rfbFreeCursor(screen->cursor);
 
 #ifdef LIBVNCSERVER_HAVE_LIBZ
 
diff --git a/src/libvncserver/rfbserver.c b/src/libvncserver/rfbserver.c
index 5cb42654e..5f19d6093 100644
--- a/src/libvncserver/rfbserver.c
+++ b/src/libvncserver/rfbserver.c
@@ -3143,6 +3143,7 @@ rfbProcessClientNormalMessage(rfbClientPtr cl)
                     clp->requestedDesktopSizeChange = rfbExtDesktopSize_OtherClientRequestedChange;
                 UNLOCK(clp->updateMutex);
             }
+            rfbReleaseClientIterator(iterator);
         }
         else
         {