mirrors/wayland
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wayland/wayland.git synced 2025-10-29 05:40:16 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

shm: Remove refcount check which cannot be triggered

Browse source 
If the pool refcount reaches zero, it is freed, so accessing its members
is UB which ASan would catch.

Also simplify check for negative refcounts.

Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
This commit is contained in:
Sebastian Wick 2025-05-20 21:39:45 +02:00
parent 9ec01ab2dc
commit af453f876e
1 changed files with 2 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/wayland-shm.c
View file

@ -143,17 +143,16 @@ shm_pool_unref(struct wl_shm_pool *pool, bool external)
{ {
if (external) { if (external) {
pool->external_refcount--; pool->external_refcount--;
if (!(pool->external_refcount >= 0)) if (pool->external_refcount < 0)
wl_abort("Requested to unref an external reference to " wl_abort("Requested to unref an external reference to "
"pool but none found\n"); "pool but none found\n");
if (pool->external_refcount == 0) if (pool->external_refcount == 0)
shm_pool_finish_resize(pool); shm_pool_finish_resize(pool);
} else { } else {
pool->internal_refcount--; pool->internal_refcount--;
if (!(pool->internal_refcount >= 0)) if (pool->internal_refcount < 0)
wl_abort("Requested to unref an internal reference to " wl_abort("Requested to unref an internal reference to "
"pool but none found\n"); "pool but none found\n");
} }
if (pool->internal_refcount + pool->external_refcount > 0) if (pool->internal_refcount + pool->external_refcount > 0)
@ -513,10 +512,6 @@ wl_shm_buffer_get_height(const struct wl_shm_buffer *buffer)
WL_EXPORT struct wl_shm_pool * WL_EXPORT struct wl_shm_pool *
wl_shm_buffer_ref_pool(struct wl_shm_buffer *buffer) wl_shm_buffer_ref_pool(struct wl_shm_buffer *buffer)
{ {
if (!(buffer->pool->internal_refcount +
buffer->pool->external_refcount))
wl_abort("Can't get reference to pool that has been freed\n");
buffer->pool->external_refcount++; buffer->pool->external_refcount++;
return buffer->pool; return buffer->pool;
} }