From ad46e125d5d0effebbe9015acb07f561935164df Mon Sep 17 00:00:00 2001 From: Andri Yngvason Date: Mon, 28 Dec 2020 15:10:42 +0000 Subject: [PATCH] types/seat: Clear focus in wlr_seat_destroy() This fixes use-after-free in surface destroy signal listeners. --- types/seat/wlr_seat.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/types/seat/wlr_seat.c b/types/seat/wlr_seat.c index 9395a5b18..7318252f2 100644 --- a/types/seat/wlr_seat.c +++ b/types/seat/wlr_seat.c @@ -159,6 +159,14 @@ void wlr_seat_destroy(struct wlr_seat *seat) { return; } + wlr_seat_pointer_clear_focus(seat); + wlr_seat_keyboard_clear_focus(seat); + + struct wlr_touch_point* point; + wl_list_for_each(point, &seat->touch_state.touch_points, link) { + wlr_seat_touch_point_clear_focus(seat, 0, point->touch_id); + } + wlr_signal_emit_safe(&seat->events.destroy, seat); wl_list_remove(&seat->display_destroy.link);