blankie
/
wlroots
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

rootston: fix user-after-free in output_handle_destroy

This commit is contained in:
emersion 2018-02-23 10:29:18 +01:00
parent 5dba27216c
commit ca3a947864
No known key found for this signature in database
GPG Key ID: 0FDE7BE0E88F5E48
2 changed files with 28 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
include/rootston/output.h
View File

@ -19,7 +19,8 @@ struct roots_output {
struct wlr_output_damage *damage; struct wlr_output_damage *damage;
struct wl_listener destroy; struct wl_listener destroy;
struct wl_listener frame; struct wl_listener damage_frame;
struct wl_listener damage_destroy;
}; };
void handle_new_output(struct wl_listener *listener, void *data); void handle_new_output(struct wl_listener *listener, void *data);

38
rootston/output.c
View File

@ -514,12 +514,6 @@ damage_finish:
pixman_region32_fini(&damage); pixman_region32_fini(&damage);
} }
static void output_damage_handle_frame(struct wl_listener *listener,
void *data) {
struct roots_output *output = wl_container_of(listener, output, frame);
render_output(output);
}
void output_damage_whole(struct roots_output *output) { void output_damage_whole(struct roots_output *output) {
wlr_output_damage_add_whole(output->damage); wlr_output_damage_add_whole(output->damage);
} }
@ -681,19 +675,37 @@ static void set_mode(struct wlr_output *output,
} }
} }
static void output_handle_destroy(struct wl_listener *listener, void *data) { static void output_destroy(struct roots_output *output) {
struct roots_output *output = wl_container_of(listener, output, destroy);
// TODO: cursor // TODO: cursor
//example_config_configure_cursor(sample->config, sample->cursor, //example_config_configure_cursor(sample->config, sample->cursor,
// sample->compositor); // sample->compositor);
wl_list_remove(&output->link); wl_list_remove(&output->link);
wl_list_remove(&output->destroy.link); wl_list_remove(&output->destroy.link);
wl_list_remove(&output->frame.link); wl_list_remove(&output->damage_frame.link);
wl_list_remove(&output->damage_destroy.link);
free(output); free(output);
} }
static void output_handle_destroy(struct wl_listener *listener, void *data) {
struct roots_output *output = wl_container_of(listener, output, destroy);
output_destroy(output);
}
static void output_damage_handle_frame(struct wl_listener *listener,
void *data) {
struct roots_output *output =
wl_container_of(listener, output, damage_frame);
render_output(output);
}
static void output_damage_handle_destroy(struct wl_listener *listener,
void *data) {
struct roots_output *output =
wl_container_of(listener, output, damage_destroy);
output_destroy(output);
}
void handle_new_output(struct wl_listener *listener, void *data) { void handle_new_output(struct wl_listener *listener, void *data) {
struct roots_desktop *desktop = wl_container_of(listener, desktop, struct roots_desktop *desktop = wl_container_of(listener, desktop,
new_output); new_output);
@ -722,8 +734,10 @@ void handle_new_output(struct wl_listener *listener, void *data) {
output->destroy.notify = output_handle_destroy; output->destroy.notify = output_handle_destroy;
wl_signal_add(&wlr_output->events.destroy, &output->destroy); wl_signal_add(&wlr_output->events.destroy, &output->destroy);
output->frame.notify = output_damage_handle_frame; output->damage_frame.notify = output_damage_handle_frame;
wl_signal_add(&output->damage->events.frame, &output->frame); wl_signal_add(&output->damage->events.frame, &output->damage_frame);
output->damage_destroy.notify = output_damage_handle_destroy;
wl_signal_add(&output->damage->events.destroy, &output->damage_destroy);
struct roots_output_config *output_config = struct roots_output_config *output_config =
roots_config_get_output(config, wlr_output); roots_config_get_output(config, wlr_output);