wlr_seat destroy: fix use-after-free after primary selection source cancel
the primary_selection_source_destroy list points to memory freed by that cancel callback, so remove from list before freeing
This commit is contained in:
parent
07209d062c
commit
9ddc2f39d0
|
@ -168,9 +168,9 @@ void wlr_seat_destroy(struct wlr_seat *seat) {
|
|||
seat->selection_source = NULL;
|
||||
}
|
||||
if (seat->primary_selection_source) {
|
||||
wl_list_remove(&seat->primary_selection_source_destroy.link);
|
||||
seat->primary_selection_source->cancel(seat->primary_selection_source);
|
||||
seat->primary_selection_source = NULL;
|
||||
wl_list_remove(&seat->primary_selection_source_destroy.link);
|
||||
}
|
||||
|
||||
struct wlr_seat_client *client, *tmp;
|
||||
|
|
Loading…
Reference in New Issue