mirrors/labwc
1
0
Fork 0
mirror of https://github.com/labwc/labwc.git synced 2025-11-02 09:01:47 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

img: fix UAF on Reconfigure by refcounting

Browse source 
Before this commit, there was a use-after-free bug on Reconfigure:
- theme_finish() destroys lab_imgs for titlebar icons
- For some reason, undecorate() calls _create_buffer() in
  scaled-img-buffer.c, which calls img_render() on a destroyed lab_img.

So in this commit, the lifetime of lab_img is expanded to when the
scaled_img_buffers referencing it are all destroyed. This is achieved by
calling lab_img_copy() when setting a lab_img to scaled_img_buffer and
calling lab_img_destroy() when clearing a lab_img.

Now that scaled_img_buffer.img are always different, lab_img_equal() is
added to compare the content of scaled_img_buffer.img.
This commit is contained in:
tokyo4j 2025-01-04 00:05:12 +09:00 • committed by Consolatis
parent 90a8c3e793
commit 70fb713874
6 changed files with 32 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/ssd/ssd-titlebar.c
View file

@ -345,9 +345,6 @@ ssd_titlebar_destroy(struct ssd *ssd)
if (ssd->state.app_id) {
zfree(ssd->state.app_id);
}
if (ssd->state.icon_img) {
lab_img_destroy(ssd->state.icon_img);
}
wlr_scene_node_destroy(&ssd->titlebar.tree->node);
ssd->titlebar.tree = NULL;
@ -642,10 +639,7 @@ ssd_update_window_icon(struct ssd *ssd)
}
} FOR_EACH_END
if (ssd->state.icon_img) {
lab_img_destroy(ssd->state.icon_img);
}
ssd->state.icon_img = icon_img;
lab_img_destroy(icon_img);
#endif
}