wlr_seat: clear drag->seat_client when destroyed

This was previously a use-after-free in `wlr_drag.c`.

(cherry picked from commit 8b12037cad)
This commit is contained in:
bi4k8 2022-11-15 01:00:27 +00:00 committed by Simon Ser
parent a6ff023df2
commit 990cba8966
2 changed files with 7 additions and 3 deletions

View file

@ -75,6 +75,10 @@ static void seat_client_handle_resource_destroy(
client->seat->keyboard_state.focused_client = NULL;
}
if (client->seat->drag && client == client->seat->drag->seat_client) {
client->seat->drag->seat_client = NULL;
}
struct wl_resource *resource, *tmp;
wl_resource_for_each_safe(resource, tmp, &client->pointers) {
wl_resource_destroy(resource);