blankie
/
wlroots
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix use-after-free when destroying an offer

This commit is contained in:
emersion 2017-12-30 09:26:48 +01:00
parent b20aed66d6
commit 720c1154dc
No known key found for this signature in database
GPG Key ID: 0FDE7BE0E88F5E48
2 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
types/wlr_data_device.c
View File

@ -173,6 +173,8 @@ static void data_offer_resource_destroy(struct wl_resource *resource) {
goto out; goto out;
} }
offer->source->offer = NULL;
// If the drag destination has version < 3, wl_data_offer.finish // If the drag destination has version < 3, wl_data_offer.finish
// won't be called, so do this here as a safety net, because // won't be called, so do this here as a safety net, because
// we still want the version >= 3 drag source to be happy. // we still want the version >= 3 drag source to be happy.
@ -183,7 +185,6 @@ static void data_offer_resource_destroy(struct wl_resource *resource) {
offer->source->cancel(offer->source); offer->source->cancel(offer->source);
} }
offer->source->offer = NULL;
out: out:
free(offer); free(offer);
} }

5
types/wlr_primary_selection.c
View File

@ -44,11 +44,8 @@ static void offer_resource_handle_destroy(struct wl_resource *resource) {
goto out; goto out;
} }
if (offer->source->cancel) {
offer->source->cancel(offer->source);
}
offer->source->offer = NULL; offer->source->offer = NULL;
out: out:
free(offer); free(offer);
} }