mirrors/wlroots
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wlroots/wlroots.git synced 2025-11-03 09:01:40 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

wlr_scene: Fix potential use-after-free in wlr_scene_buffer_set_buffer

Browse source 
Fixes: #3636
This commit is contained in:
Alexander Orzechowski 2023-04-16 14:01:54 +02:00
parent 39be67df46
commit eac2eaa6a9
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
types/scene/wlr_scene.c
View file

@ -602,7 +602,6 @@ void wlr_scene_buffer_set_buffer_with_damage(struct wlr_scene_buffer *scene_buff
assert(buffer || !damage); assert(buffer || !damage);
bool update = false; bool update = false;
wlr_buffer_unlock(scene_buffer->buffer);
wlr_texture_destroy(scene_buffer->texture); wlr_texture_destroy(scene_buffer->texture);
scene_buffer->texture = NULL; scene_buffer->texture = NULL;
@ -616,8 +615,10 @@ void wlr_scene_buffer_set_buffer_with_damage(struct wlr_scene_buffer *scene_buff
(scene_buffer->buffer->width != buffer->width || (scene_buffer->buffer->width != buffer->width ||
scene_buffer->buffer->height != buffer->height)); scene_buffer->buffer->height != buffer->height));
wlr_buffer_unlock(scene_buffer->buffer);
scene_buffer->buffer = wlr_buffer_lock(buffer); scene_buffer->buffer = wlr_buffer_lock(buffer);
} else { } else {
wlr_buffer_unlock(scene_buffer->buffer);
update = true; update = true;
scene_buffer->buffer = NULL; scene_buffer->buffer = NULL;
} }