From 133ebc76d9ad0b5f3820271261b0972b33cc8958 Mon Sep 17 00:00:00 2001
From: DreamMaoMao <2523610504@qq.com>
Date: Wed, 3 Jun 2026 23:15:06 +0800
Subject: [PATCH] fix: miss detect valid poiter in talbe device create

---
 src/ext-protocol/tablet.h | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/src/ext-protocol/tablet.h b/src/ext-protocol/tablet.h
index 6aa7ae86..9c89138e 100644
--- a/src/ext-protocol/tablet.h
+++ b/src/ext-protocol/tablet.h
@@ -22,6 +22,7 @@ static struct wlr_tablet_manager_v2 *tablet_mgr;
 struct Tablet {
 	struct wlr_tablet_v2_tablet *tablet_v2;
 	struct wl_listener destroy;
+	struct wlr_input_device *device;
 	struct wl_list link;
 };
 static struct wl_list tablets;
@@ -72,11 +73,18 @@ void createtablet(struct wlr_input_device *device) {
 		return;
 	}
 
+	tablet->device = device;
 	tablet->tablet_v2 = wlr_tablet_create(tablet_mgr, seat, device);
+
+	if (!tablet->tablet_v2) {
+		free(tablet);
+		return;
+	}
+
 	tablet->tablet_v2->wlr_tablet->data = tablet;
 	tablet->destroy.notify = destroytablet;
-	wl_signal_add(&tablet->tablet_v2->wlr_device->events.destroy,
-				  &tablet->destroy);
+	wl_signal_add(&tablet->device->events.destroy, &tablet->destroy);
+
 	if (libinput_device_config_send_events_get_modes(device_handle)) {
 		libinput_device_config_send_events_set_mode(device_handle,
 													config.send_events_mode);
@@ -129,8 +137,7 @@ void attach_tablet_pad(struct TabletPad *tablet_pad, struct Tablet *tablet) {
 
 	wl_list_remove(&tablet_pad->tablet_destroy.link);
 	tablet_pad->tablet_destroy.notify = tabletpadtabletdestroy;
-	wl_signal_add(&tablet->tablet_v2->wlr_device->events.destroy,
-				  &tablet_pad->tablet_destroy);
+	wl_signal_add(&tablet->device->events.destroy, &tablet_pad->tablet_destroy);
 }
 
 void tabletpadattach(struct wl_listener *listener, void *data) {
@@ -153,11 +160,19 @@ void createtabletpad(struct wlr_input_device *device) {
 		return;
 	}
 	tablet_pad->pad_v2 = wlr_tablet_pad_create(tablet_mgr, seat, device);
+
+	if (!tablet_pad->pad_v2) {
+		wlr_log(WLR_ERROR, "could not create tablet_pad_v2 wrapper");
+		free(tablet_pad);
+		return;
+	}
+
 	tablet_pad->destroy.notify = destroytabletpad;
 	tablet_pad->attach.notify = tabletpadattach;
 	wl_list_init(&tablet_pad->tablet_destroy.link);
-	wl_signal_add(&tablet_pad->pad_v2->wlr_device->events.destroy,
-				  &tablet_pad->destroy);
+
+	wl_signal_add(&device->events.destroy, &tablet_pad->destroy);
+
 	wl_signal_add(&tablet_pad->pad_v2->wlr_pad->events.attach_tablet,
 				  &tablet_pad->attach);
 	wl_list_insert(&tablet_pads, &tablet_pad->link);