From 844b166c1bed117ef654de3f9ad68eebad67f6be Mon Sep 17 00:00:00 2001 From: Dominique Martinet Date: Wed, 1 Nov 2017 20:59:28 +0100 Subject: [PATCH] multi_backend_destroy: fix trivial use-after-free --- backend/multi/backend.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/multi/backend.c b/backend/multi/backend.c index a7ee648c..c35303e0 100644 --- a/backend/multi/backend.c +++ b/backend/multi/backend.c @@ -30,8 +30,8 @@ static bool multi_backend_start(struct wlr_backend *_backend) { static void multi_backend_destroy(struct wlr_backend *_backend) { struct wlr_multi_backend *backend = (struct wlr_multi_backend *)_backend; - struct subbackend_state *sub; - wl_list_for_each(sub, &backend->backends, link) { + struct subbackend_state *sub, *next; + wl_list_for_each_safe(sub, next, &backend->backends, link) { wlr_backend_destroy(sub->backend); free(sub); }