blankie
/
wlroots
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #1084 from martinetd/use-after-free 

use-after-free fixes (xdg_shell popups, primary selection source, xwm parents)
This commit is contained in:
Tony Crisci 2018-06-25 11:03:07 -04:00 committed by GitHub
parent 253a88f030 ffd37b664f
commit e51829ff7c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
types/wlr_primary_selection.c
View File

@ -229,9 +229,9 @@ void wlr_seat_set_primary_selection(struct wlr_seat *seat,
} }
if (seat->primary_selection_source) { if (seat->primary_selection_source) {
wl_list_remove(&seat->primary_selection_source_destroy.link);
seat->primary_selection_source->cancel(seat->primary_selection_source); seat->primary_selection_source->cancel(seat->primary_selection_source);
seat->primary_selection_source = NULL; seat->primary_selection_source = NULL;
wl_list_remove(&seat->primary_selection_source_destroy.link);
} }
seat->primary_selection_source = source; seat->primary_selection_source = source;

6
types/xdg_shell/wlr_xdg_surface.c
View File

@ -415,6 +415,12 @@ void destroy_xdg_surface(struct wlr_xdg_surface *surface) {
wlr_signal_emit_safe(&surface->events.destroy, surface); wlr_signal_emit_safe(&surface->events.destroy, surface);
struct wlr_xdg_popup *popup_state, *next;
wl_list_for_each_safe(popup_state, next, &surface->popups, link) {
xdg_popup_send_popup_done(popup_state->resource);
destroy_xdg_popup(popup_state->base);
}
switch (surface->role) { switch (surface->role) {
case WLR_XDG_SURFACE_ROLE_TOPLEVEL: case WLR_XDG_SURFACE_ROLE_TOPLEVEL:
destroy_xdg_toplevel(surface); destroy_xdg_toplevel(surface);

6
types/xdg_shell_v6/wlr_xdg_surface_v6.c
View File

@ -100,6 +100,12 @@ void destroy_xdg_surface_v6(struct wlr_xdg_surface_v6 *surface) {
wlr_signal_emit_safe(&surface->events.destroy, surface); wlr_signal_emit_safe(&surface->events.destroy, surface);
struct wlr_xdg_popup_v6 *popup_state, *next;
wl_list_for_each_safe(popup_state, next, &surface->popups, link) {
zxdg_popup_v6_send_popup_done(popup_state->resource);
destroy_xdg_popup_v6(popup_state->base);
}
switch (surface->role) { switch (surface->role) {
case WLR_XDG_SURFACE_V6_ROLE_TOPLEVEL: case WLR_XDG_SURFACE_V6_ROLE_TOPLEVEL:
destroy_xdg_toplevel_v6(surface); destroy_xdg_toplevel_v6(surface);

6
xwayland/xwm.c
View File

@ -294,6 +294,12 @@ static void xwayland_surface_destroy(
wl_list_remove(&xsurface->link); wl_list_remove(&xsurface->link);
wl_list_remove(&xsurface->parent_link); wl_list_remove(&xsurface->parent_link);
struct wlr_xwayland_surface *child, *next;
wl_list_for_each_safe(child, next, &xsurface->children, parent_link) {
wl_list_remove(&child->parent_link);
wl_list_init(&child->parent_link);
}
if (xsurface->surface_id) { if (xsurface->surface_id) {
wl_list_remove(&xsurface->unpaired_link); wl_list_remove(&xsurface->unpaired_link);
} }