mirrors/labwc
1
0
Fork 0
mirror of https://github.com/labwc/labwc.git synced 2025-11-03 09:01:51 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

keyboard: Fix use-after-free in keyboard_finish()

Browse source
This commit is contained in:
John Lindgren 2022-09-15 19:50:07 -04:00 • committed by Consolatis
parent bbc6c6bb94
commit 086a887058
1 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/keyboard.c
View file

@ -241,8 +241,15 @@ void
keyboard_finish(struct seat *seat) keyboard_finish(struct seat *seat)
{ {
if (seat->keyboard_group) { if (seat->keyboard_group) {
/*
* Caution - these event listeners are connected to
* seat->keyboard_group->keyboard and must be
* unregistered before wlr_keyboard_group_destroy(),
* otherwise a use-after-free occurs.
*/
wl_list_remove(&seat->keyboard_key.link);
wl_list_remove(&seat->keyboard_modifiers.link);
wlr_keyboard_group_destroy(seat->keyboard_group); wlr_keyboard_group_destroy(seat->keyboard_group);
seat->keyboard_group = NULL;
} }
wl_list_remove(&seat->keyboard_key.link);
wl_list_remove(&seat->keyboard_modifiers.link);
} }