blankie
/
wlroots
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fixes use after free caused by signal lists 

A structs throughout the code use implementation specific free
functions.
When those functions are not used, they simply call free() on their
data, but this leaves around wl_signals linked into listeners.
When those listeners try to remove themself from the list, they write
into the now free memory.

This commit adds calls to remove the signals from those lists, so the
listeners can safely call wl_list_remove
This commit is contained in:
Markus Ongyerth 2017-09-08 16:02:26 +02:00
parent c59ccbde51
commit 935b6d871e
3 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
types/wlr_input_device.c
View File

@ -30,7 +30,7 @@ void wlr_input_device_destroy(struct wlr_input_device *dev) {
}
wl_signal_emit(&dev->events.destroy, dev);
if (dev->_device) {
switch (dev->type) {
case WLR_INPUT_DEVICE_KEYBOARD:
@ -58,6 +58,7 @@ void wlr_input_device_destroy(struct wlr_input_device *dev) {
if (dev->impl && dev->impl->destroy) {
dev->impl->destroy(dev);
} else {
wl_list_remove(&dev->events.destroy.listener_list);
free(dev);
}
}

1
types/wlr_keyboard.c
View File

@ -14,6 +14,7 @@ void wlr_keyboard_destroy(struct wlr_keyboard *kb) {
if (kb && kb->impl && kb->impl->destroy) {
kb->impl->destroy(kb);
} else {
wl_list_remove(&kb->events.key.listener_list);
free(kb);
}
}

4
types/wlr_pointer.c
View File

@ -17,6 +17,10 @@ void wlr_pointer_destroy(struct wlr_pointer *pointer) {
if (pointer && pointer->impl && pointer->impl->destroy) {
pointer->impl->destroy(pointer);
} else {
wl_list_remove(&pointer->events.motion.listener_list);
wl_list_remove(&pointer->events.motion_absolute.listener_list);
wl_list_remove(&pointer->events.button.listener_list);
wl_list_remove(&pointer->events.axis.listener_list);
free(pointer);
}
}