blankie
/
wlroots
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

backend/drm: fix segfault in init_drm_surface 

When surf->gbm was previously set, we destroy it without setting it to
NULL. Later on, we only create the GBM surface if surf->gbm is NULL.
This result in a use-after-free when we start using surf->gbm.

Closes: https://github.com/swaywm/wlroots/issues/1868
Closes: https://github.com/swaywm/wlroots/issues/1874
Closes: https://github.com/swaywm/sway/issues/4785
Closes: https://github.com/swaywm/sway/issues/4717
Closes: https://github.com/swaywm/sway/issues/4730
Fixes: 2bdd1d0896 ("backend/drm: use modifiers for our GBM buffers")
This commit is contained in:
Simon Ser 2019-12-05 16:35:55 +01:00 committed by Drew DeVault
parent 8681e4ab8a
commit 6ca82087b1
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
backend/drm/renderer.c
View File

@ -81,6 +81,7 @@ bool init_drm_surface(struct wlr_drm_surface *surf,
surf->back = NULL; surf->back = NULL;
} }
gbm_surface_destroy(surf->gbm); gbm_surface_destroy(surf->gbm);
surf->gbm = NULL;
} }
wlr_egl_destroy_surface(&surf->renderer->egl, surf->egl); wlr_egl_destroy_surface(&surf->renderer->egl, surf->egl);