mirrors/wlroots
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wlroots/wlroots.git synced 2025-11-13 13:29:44 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

wlr_seat destroy: fix use-after-free after primary selection source cancel

Browse source 
the primary_selection_source_destroy list points to memory freed by
that cancel callback, so remove from list before freeing
This commit is contained in:
Dominique Martinet 2018-07-01 21:02:35 +09:00
parent 07209d062c
commit 9ddc2f39d0
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
types/seat/wlr_seat.c
View file

@ -168,9 +168,9 @@ void wlr_seat_destroy(struct wlr_seat *seat) {
seat->selection_source = NULL;
}
if (seat->primary_selection_source) {
wl_list_remove(&seat->primary_selection_source_destroy.link);
seat->primary_selection_source->cancel(seat->primary_selection_source);
seat->primary_selection_source = NULL;
wl_list_remove(&seat->primary_selection_source_destroy.link);
}
struct wlr_seat_client *client, *tmp;