Code:  void red_channel_pipes_add_empty_msg(RedChannel *channel, int msg_type)
 {
    RingItem *link;
 
    RING_FOREACH(link, &channel->clients) {
         red_channel_client_pipe_add_empty_msg(
             SPICE_CONTAINEROF(link, RedChannelClient, channel_link),
             msg_type);
    }
}

Vulnerability Type: DoS
CWE ID: CWE-399
Summary: The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.
Commit Message: 