blankie
/
wlroots
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #664 from emersion/fix-various-use-after-free 

Fix a bunch of use-after-free
This commit is contained in:
Drew DeVault 2018-02-23 08:19:37 -05:00 committed by GitHub
parent bd9583a7e8 ca3a947864
commit 5ad15c90d5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
7 changed files with 54 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
include/rootston/output.h
View File

@ -19,7 +19,8 @@ struct roots_output {
struct wlr_output_damage *damage; struct wlr_output_damage *damage;
struct wl_listener destroy; struct wl_listener destroy;
struct wl_listener frame; struct wl_listener damage_frame;
struct wl_listener damage_destroy;
}; };
void handle_new_output(struct wl_listener *listener, void *data); void handle_new_output(struct wl_listener *listener, void *data);

1
include/wlr/types/wlr_compositor.h
View File

@ -14,6 +14,7 @@ struct wlr_compositor {
struct { struct {
struct wl_signal new_surface; struct wl_signal new_surface;
struct wl_signal destroy;
} events; } events;
}; };

3
include/wlr/xwm.h
View File

@ -93,7 +93,8 @@ struct wlr_xwm {
const xcb_query_extension_reply_t *xfixes; const xcb_query_extension_reply_t *xfixes;
struct wl_listener compositor_surface_create; struct wl_listener compositor_new_surface;
struct wl_listener compositor_destroy;
struct wl_listener seat_selection; struct wl_listener seat_selection;
struct wl_listener seat_primary_selection; struct wl_listener seat_primary_selection;
}; };

38
rootston/output.c
View File

@ -514,12 +514,6 @@ damage_finish:
pixman_region32_fini(&damage); pixman_region32_fini(&damage);
} }
static void output_damage_handle_frame(struct wl_listener *listener,
void *data) {
struct roots_output *output = wl_container_of(listener, output, frame);
render_output(output);
}
void output_damage_whole(struct roots_output *output) { void output_damage_whole(struct roots_output *output) {
wlr_output_damage_add_whole(output->damage); wlr_output_damage_add_whole(output->damage);
} }
@ -681,19 +675,37 @@ static void set_mode(struct wlr_output *output,
} }
} }
static void output_handle_destroy(struct wl_listener *listener, void *data) { static void output_destroy(struct roots_output *output) {
struct roots_output *output = wl_container_of(listener, output, destroy);
// TODO: cursor // TODO: cursor
//example_config_configure_cursor(sample->config, sample->cursor, //example_config_configure_cursor(sample->config, sample->cursor,
// sample->compositor); // sample->compositor);
wl_list_remove(&output->link); wl_list_remove(&output->link);
wl_list_remove(&output->destroy.link); wl_list_remove(&output->destroy.link);
wl_list_remove(&output->frame.link); wl_list_remove(&output->damage_frame.link);
wl_list_remove(&output->damage_destroy.link);
free(output); free(output);
} }
static void output_handle_destroy(struct wl_listener *listener, void *data) {
struct roots_output *output = wl_container_of(listener, output, destroy);
output_destroy(output);
}
static void output_damage_handle_frame(struct wl_listener *listener,
void *data) {
struct roots_output *output =
wl_container_of(listener, output, damage_frame);
render_output(output);
}
static void output_damage_handle_destroy(struct wl_listener *listener,
void *data) {
struct roots_output *output =
wl_container_of(listener, output, damage_destroy);
output_destroy(output);
}
void handle_new_output(struct wl_listener *listener, void *data) { void handle_new_output(struct wl_listener *listener, void *data) {
struct roots_desktop *desktop = wl_container_of(listener, desktop, struct roots_desktop *desktop = wl_container_of(listener, desktop,
new_output); new_output);
@ -722,8 +734,10 @@ void handle_new_output(struct wl_listener *listener, void *data) {
output->destroy.notify = output_handle_destroy; output->destroy.notify = output_handle_destroy;
wl_signal_add(&wlr_output->events.destroy, &output->destroy); wl_signal_add(&wlr_output->events.destroy, &output->destroy);
output->frame.notify = output_damage_handle_frame; output->damage_frame.notify = output_damage_handle_frame;
wl_signal_add(&output->damage->events.frame, &output->frame); wl_signal_add(&output->damage->events.frame, &output->damage_frame);
output->damage_destroy.notify = output_damage_handle_destroy;
wl_signal_add(&output->damage->events.destroy, &output->damage_destroy);
struct roots_output_config *output_config = struct roots_output_config *output_config =
roots_config_get_output(config, wlr_output); roots_config_get_output(config, wlr_output);

2
rootston/seat.c
View File

@ -408,10 +408,10 @@ static void handle_keyboard_destroy(struct wl_listener *listener, void *data) {
struct roots_keyboard *keyboard = struct roots_keyboard *keyboard =
wl_container_of(listener, keyboard, device_destroy); wl_container_of(listener, keyboard, device_destroy);
struct roots_seat *seat = keyboard->seat; struct roots_seat *seat = keyboard->seat;
roots_keyboard_destroy(keyboard);
wl_list_remove(&keyboard->device_destroy.link); wl_list_remove(&keyboard->device_destroy.link);
wl_list_remove(&keyboard->keyboard_key.link); wl_list_remove(&keyboard->keyboard_key.link);
wl_list_remove(&keyboard->keyboard_modifiers.link); wl_list_remove(&keyboard->keyboard_modifiers.link);
roots_keyboard_destroy(keyboard);
seat_update_capabilities(seat); seat_update_capabilities(seat);
} }

2
types/wlr_compositor.c
View File

@ -90,6 +90,7 @@ void wlr_compositor_destroy(struct wlr_compositor *compositor) {
if (compositor == NULL) { if (compositor == NULL) {
return; return;
} }
wlr_signal_emit_safe(&compositor->events.destroy, compositor);
wl_list_remove(&compositor->display_destroy.link); wl_list_remove(&compositor->display_destroy.link);
wl_global_destroy(compositor->wl_global); wl_global_destroy(compositor->wl_global);
free(compositor); free(compositor);
@ -195,6 +196,7 @@ struct wlr_compositor *wlr_compositor_create(struct wl_display *display,
wl_list_init(&compositor->wl_resources); wl_list_init(&compositor->wl_resources);
wl_list_init(&compositor->surfaces); wl_list_init(&compositor->surfaces);
wl_signal_init(&compositor->events.new_surface); wl_signal_init(&compositor->events.new_surface);
wl_signal_init(&compositor->events.destroy);
compositor->display_destroy.notify = handle_display_destroy; compositor->display_destroy.notify = handle_display_destroy;
wl_display_add_destroy_listener(display, &compositor->display_destroy); wl_display_add_destroy_listener(display, &compositor->display_destroy);

26
xwayland/xwm.c
View File

@ -1019,11 +1019,11 @@ static int x11_event_handler(int fd, uint32_t mask, void *data) {
return count; return count;
} }
static void handle_compositor_surface_create(struct wl_listener *listener, static void handle_compositor_new_surface(struct wl_listener *listener,
void *data) { void *data) {
struct wlr_surface *surface = data;
struct wlr_xwm *xwm = struct wlr_xwm *xwm =
wl_container_of(listener, xwm, compositor_surface_create); wl_container_of(listener, xwm, compositor_new_surface);
struct wlr_surface *surface = data;
if (wl_resource_get_client(surface->resource) != xwm->xwayland->client) { if (wl_resource_get_client(surface->resource) != xwm->xwayland->client) {
return; return;
} }
@ -1043,6 +1043,16 @@ static void handle_compositor_surface_create(struct wl_listener *listener,
} }
} }
static void handle_compositor_destroy(struct wl_listener *listener,
void *data) {
struct wlr_xwm *xwm =
wl_container_of(listener, xwm, compositor_destroy);
wl_list_remove(&xwm->compositor_new_surface.link);
wl_list_remove(&xwm->compositor_destroy.link);
wl_list_init(&xwm->compositor_new_surface.link);
wl_list_init(&xwm->compositor_destroy.link);
}
void wlr_xwayland_surface_activate(struct wlr_xwayland_surface *xsurface, void wlr_xwayland_surface_activate(struct wlr_xwayland_surface *xsurface,
bool activated) { bool activated) {
struct wlr_xwayland_surface *focused = xsurface->xwm->focus_surface; struct wlr_xwayland_surface *focused = xsurface->xwm->focus_surface;
@ -1124,7 +1134,8 @@ void xwm_destroy(struct wlr_xwm *xwm) {
wl_list_for_each_safe(xsurface, tmp, &xwm->unpaired_surfaces, link) { wl_list_for_each_safe(xsurface, tmp, &xwm->unpaired_surfaces, link) {
wlr_xwayland_surface_destroy(xsurface); wlr_xwayland_surface_destroy(xsurface);
} }
wl_list_remove(&xwm->compositor_surface_create.link); wl_list_remove(&xwm->compositor_new_surface.link);
wl_list_remove(&xwm->compositor_destroy.link);
xcb_disconnect(xwm->xcb_conn); xcb_disconnect(xwm->xcb_conn);
free(xwm); free(xwm);
@ -1407,9 +1418,12 @@ struct wlr_xwm *xwm_create(struct wlr_xwayland *wlr_xwayland) {
xwm_selection_init(xwm); xwm_selection_init(xwm);
xwm->compositor_surface_create.notify = handle_compositor_surface_create; xwm->compositor_new_surface.notify = handle_compositor_new_surface;
wl_signal_add(&wlr_xwayland->compositor->events.new_surface, wl_signal_add(&wlr_xwayland->compositor->events.new_surface,
&xwm->compositor_surface_create); &xwm->compositor_new_surface);
xwm->compositor_destroy.notify = handle_compositor_destroy;
wl_signal_add(&wlr_xwayland->compositor->events.destroy,
&xwm->compositor_destroy);
xwm_create_wm_window(xwm); xwm_create_wm_window(xwm);