mirror of
https://gitlab.freedesktop.org/wayland/wayland.git
synced 2026-04-03 07:15:42 -04:00
e647f6304d
for_each_helper caches the entries->data pointer and array size before iterating. If a compositor calls wl_client_for_each_resource() and the provided callback triggers the creation of a new client object, the underlying wl_array may be reallocated via realloc(). When this happens, the cached start pointer becomes dangling. Subsequent iterations will read from the freed memory block, causing already-destroyed resources to be destroyed a second time (e.g., leading to a double-free crash in wl_list_remove()). Fix this by dynamically re-fetching entries->data and entries->size on every loop iteration, ensuring the iterator always accesses the valid live array. Signed-off-by: YaNing Lu <luyaning@uniontech.com> |
||
|---|---|---|
| .. | ||
| .gitignore | ||
| connection.c | ||
| embed.py | ||
| event-loop.c | ||
| meson.build | ||
| scanner.c | ||
| timespec-util.h | ||
| wayland-client-core.h | ||
| wayland-client.c | ||
| wayland-client.h | ||
| wayland-os.c | ||
| wayland-os.h | ||
| wayland-private.h | ||
| wayland-server-core.h | ||
| wayland-server-private.h | ||
| wayland-server.c | ||
| wayland-server.h | ||
| wayland-shm.c | ||
| wayland-util.c | ||
| wayland-util.h | ||
| wayland-version.h.in | ||