Thomas Lukaszewicz d275bc7f84 Mitigate UAF crashes due to iteration over freed wl_resources ... Currently it is possible to iterate over client-owned resources during client destruction that have had their associated memory released. This can occur when client code calls wl_client_destroy(). The following sequence illustrates how this may occur. 1. The server initiates destruction of the connected client via call to wl_client_destroy(). 2. Resource destroy listeners / destructors are invoked and resource memory is freed one resource at a time [1]. 3. If a listener / destructor for a resource results in a call to wl_client_for_each_resource(), the iteration will proceed over resources that have been previously freed in step 2, resulting in UAFs / crashes. The issue is that resources remain in the client's object map even after they have had their memory freed, and are removed from the map only after each individual resource has had its memory released. This patch corrects this by ensuring resource destruction first invokes listeners / destructors and then removing them from the client's object map before releasing the associated memory. [1] https://gitlab.freedesktop.org/wayland/wayland/-/blob/main/src/wayland-server.c?ref_type=heads#L928 Signed-off-by: Thomas Lukaszewicz thomaslukaszewicz@gmail.com		2024-02-07 09:45:41 +00:00
..
data	build: add a gen-scanner-test target	2024-01-15 14:29:10 +01:00
array-test.c
client-test.c
compositor-introspection-test.c
connection-test.c
cpp-compile-test.cpp
display-test.c
event-loop-test.c
exec-fd-leak-checker.c
fixed-test.c
headers-protocol-core-test.c
headers-protocol-test.c
headers-test.c
interface-test.c
list-test.c
map-test.c
meson.build	build: add a gen-scanner-test target	2024-01-15 14:29:10 +01:00
message-test.c
newsignal-test.c
os-wrappers-test.c	tests: manually wrap libc functions	2023-06-27 13:31:50 +02:00
protocol-logger-test.c
proxy-test.c	client: Add method to get display for a given proxy	2023-08-07 13:38:01 +00:00
queue-test.c	client: Allow setting names for queues	2024-01-22 12:34:14 +00:00
resources-test.c	Mitigate UAF crashes due to iteration over freed wl_resources	2024-02-07 09:45:41 +00:00
sanity-test.c
scanner-test-gen.sh	build: add a gen-scanner-test target	2024-01-15 14:29:10 +01:00
scanner-test.sh
signal-test.c
socket-test.c
test-compositor.c	tests: Support tests that check for client failure	2023-02-28 11:22:04 +00:00
test-compositor.h	tests: Support tests that check for client failure	2023-02-28 11:22:04 +00:00
test-helpers.c
test-runner.c
test-runner.h