mirrors/labwc
1
0
Fork 0
mirror of https://github.com/labwc/labwc.git synced 2025-10-29 05:40:24 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

menu: fix UAF in client-list-combined-menu after window destruction

Browse source 
Update client-list-combined-menu when a window is destroyed to avoid
SEGFAULT when selecting an that window entry in it.
This commit is contained in:
Johan Malm 2024-10-23 20:47:50 +01:00 • committed by Johan Malm
parent 2b1a694154
commit e912964f73
3 changed files with 32 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

1
include/menu/menu.h
View file

@ -85,6 +85,7 @@ bool menu_call_selected_actions(struct server *server);
void menu_init(struct server *server);
void menu_finish(struct server *server);
void menu_on_view_destroy(struct view *view);
/**
* menu_get_by_id - get menu by id

30
src/menu/menu.c
View file

@ -1190,6 +1190,36 @@ menu_finish(struct server *server)
current_menu = NULL;
}
void
menu_on_view_destroy(struct view *view)
{
struct server *server = view->server;
/* If the view being destroy has an open window menu, then close it */
if (server->menu_current
&& server->menu_current->triggered_by_view == view) {
menu_close_root(server);
}
/*
* TODO: Instead of just setting client_list_view to NULL and deleting
* the actions (as below), consider destroying the item and somehow
* updating the menu and its selection state.
*/
/* Also nullify the destroyed view in client-list-combined-menu */
struct menu *menu = menu_get_by_id(server, "client-list-combined-menu");
if (menu) {
struct menuitem *item;
wl_list_for_each(item, &menu->menuitems, link) {
if (item->client_list_view == view) {
item->client_list_view = NULL;
action_list_free(&item->actions);
}
}
}
}
/* Sets selection (or clears selection if passing NULL) */
static void
menu_set_selection(struct menu *menu, struct menuitem *item)

6
src/view.c
View file

@ -2453,11 +2453,7 @@ view_destroy(struct view *view)
}
}
/* If we spawned a window menu, close it */
if (server->menu_current
&& server->menu_current->triggered_by_view == view) {
menu_close_root(server);
}
menu_on_view_destroy(view);
/*
* Destroy the view's scene tree. View methods assume this is non-NULL,