mirrors/labwc
1
0
Fork 0
mirror of https://github.com/labwc/labwc.git synced 2025-10-29 05:40:24 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix UAF when granting an output lease

Browse source 
Wlroots now destroys the wlr_output when granting a lease.
So we can't iterate through the outputs in the request after
granting the lease. This is also not necessary anymore because
they are already destroyed and thus removed from the layout.
This commit is contained in:
Consolatis 2025-07-05 00:15:53 +02:00 • committed by Johan Malm
parent d5e93dcfef
commit 4699d446cb
3 changed files with 2 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

1
include/labwc.h
View file

@ -433,7 +433,6 @@ struct output {
struct wl_listener frame;
struct wl_listener request_state;
bool leased;
bool gamma_lut_changed;
};

4
src/output.c
View file

@ -609,7 +609,7 @@ output_config_apply(struct server *server,
struct wlr_output *o = head->state.output;
struct output *output = output_from_wlr_output(server, o);
struct wlr_output_state *os = &output->pending;
bool output_enabled = head->state.enabled && !output->leased;
bool output_enabled = head->state.enabled;
wlr_output_state_set_enabled(os, output_enabled);
if (output_enabled) {
@ -1006,7 +1006,7 @@ bool
output_is_usable(struct output *output)
{
/* output_is_usable(NULL) is safe and returns false */
return output && output->wlr_output->enabled && !output->leased;
return output && output->wlr_output->enabled;
}
/* returns true if usable area changed */

16
src/server.c
View file

@ -183,22 +183,6 @@ handle_drm_lease_request(struct wl_listener *listener, void *data)
wlr_drm_lease_request_v1_reject(req);
return;
}
for (size_t i = 0; i < req->n_connectors; ++i) {
struct output *output = req->connectors[i]->output->data;
if (!output) {
continue;
}
wlr_output_state_set_enabled(&output->pending, false);
output_state_commit(output);
wlr_output_layout_remove(output->server->output_layout,
output->wlr_output);
output->scene_output = NULL;
output->leased = true;
}
}
static bool