mirror of
https://gitlab.freedesktop.org/wayland/wayland.git
synced 2025-10-29 05:40:16 -04:00
47de87263c
There are situations in which a call into wl_client_destroy() can result in a reentrant call into wl_client_destroy() - which results in UAF / double free crashes. For example, this can occur in the following scenario. 1. Server receives a message notifying it that a client has disconnected (WL_EVENT_HANGUP [1]) 2. This beings client destruction with a call to wl_client_destroy() 3. wl_client_destroy() kicks off callbacks as client-associated resources are cleaned up and their destructors and destruction signals are invoked. 4. These callbacks eventually lead to an explicit call to wl_display_flush_clients() as the server attempts to flush events to other connected clients. 5. Since the client has already begun destruction, when it is reached in the iteration the flush fails wl_client_destroy() is called again [2]. This patch guards against this reentrant condition by removing the client from the display's client list when wl_client_destroy() is first called. This prevents access / iteration over the client after wl_client_destroy() is called. In the example above, wl_display_flush_clients() will pass over the client currently undergoing destruction and the reentrant call is avoided. [1] |
||
|---|---|---|
| .. | ||
| data | ||
| array-test.c | ||
| client-test.c | ||
| compositor-introspection-test.c | ||
| connection-test.c | ||
| cpp-compile-test.cpp | ||
| display-test.c | ||
| event-loop-test.c | ||
| exec-fd-leak-checker.c | ||
| fixed-test.c | ||
| headers-protocol-core-test.c | ||
| headers-protocol-test.c | ||
| headers-test.c | ||
| interface-test.c | ||
| list-test.c | ||
| map-test.c | ||
| meson.build | ||
| message-test.c | ||
| newsignal-test.c | ||
| os-wrappers-test.c | ||
| protocol-logger-test.c | ||
| proxy-test.c | ||
| queue-test.c | ||
| resources-test.c | ||
| sanity-test.c | ||
| scanner-test-gen.sh | ||
| scanner-test.sh | ||
| signal-test.c | ||
| socket-test.c | ||
| test-compositor.c | ||
| test-compositor.h | ||
| test-helpers.c | ||
| test-runner.c | ||
| test-runner.h | ||