From 970687a01c953773d911032c9ab13fd080212296 Mon Sep 17 00:00:00 2001 From: Dominique Martinet Date: Thu, 28 Jun 2018 13:37:59 +0900 Subject: [PATCH 1/2] xdg_shell popup: fix potential segv in handle_destroy surface could be NULL there if the popup had been made inert before --- types/xdg_shell/wlr_xdg_popup.c | 2 +- types/xdg_shell_v6/wlr_xdg_popup_v6.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/types/xdg_shell/wlr_xdg_popup.c b/types/xdg_shell/wlr_xdg_popup.c index 284f36ad..2435b9c4 100644 --- a/types/xdg_shell/wlr_xdg_popup.c +++ b/types/xdg_shell/wlr_xdg_popup.c @@ -186,7 +186,7 @@ static void xdg_popup_handle_destroy(struct wl_client *client, struct wlr_xdg_surface *surface = wlr_xdg_surface_from_popup_resource(resource); - if (!wl_list_empty(&surface->popups)) { + if (surface && !wl_list_empty(&surface->popups)) { wl_resource_post_error(surface->client->resource, XDG_WM_BASE_ERROR_NOT_THE_TOPMOST_POPUP, "xdg_popup was destroyed while it was not the topmost popup"); diff --git a/types/xdg_shell_v6/wlr_xdg_popup_v6.c b/types/xdg_shell_v6/wlr_xdg_popup_v6.c index 334519a5..cc6fa58a 100644 --- a/types/xdg_shell_v6/wlr_xdg_popup_v6.c +++ b/types/xdg_shell_v6/wlr_xdg_popup_v6.c @@ -214,7 +214,7 @@ static void xdg_popup_handle_destroy(struct wl_client *client, struct wlr_xdg_surface_v6 *surface = xdg_surface_from_xdg_popup_resource(resource); - if (!wl_list_empty(&surface->popups)) { + if (surface && !wl_list_empty(&surface->popups)) { wl_resource_post_error(surface->client->resource, ZXDG_SHELL_V6_ERROR_NOT_THE_TOPMOST_POPUP, "xdg_popup was destroyed while it was not the topmost popup"); From a3e2a77734f98311d017a21a74557041b1627739 Mon Sep 17 00:00:00 2001 From: Dominique Martinet Date: Thu, 28 Jun 2018 20:14:37 +0900 Subject: [PATCH 2/2] xdg_popup: fix call to to handle_grab for inert popup --- types/xdg_shell/wlr_xdg_popup.c | 3 +++ types/xdg_shell_v6/wlr_xdg_popup_v6.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/types/xdg_shell/wlr_xdg_popup.c b/types/xdg_shell/wlr_xdg_popup.c index 2435b9c4..bd969147 100644 --- a/types/xdg_shell/wlr_xdg_popup.c +++ b/types/xdg_shell/wlr_xdg_popup.c @@ -152,6 +152,9 @@ static void xdg_popup_handle_grab(struct wl_client *client, wlr_xdg_surface_from_popup_resource(resource); struct wlr_seat_client *seat_client = wlr_seat_client_from_resource(seat_resource); + if (!surface) { + return; + } if (surface->popup->committed) { wl_resource_post_error(surface->popup->resource, diff --git a/types/xdg_shell_v6/wlr_xdg_popup_v6.c b/types/xdg_shell_v6/wlr_xdg_popup_v6.c index cc6fa58a..378ae963 100644 --- a/types/xdg_shell_v6/wlr_xdg_popup_v6.c +++ b/types/xdg_shell_v6/wlr_xdg_popup_v6.c @@ -174,6 +174,9 @@ static void xdg_popup_handle_grab(struct wl_client *client, xdg_surface_from_xdg_popup_resource(resource); struct wlr_seat_client *seat_client = wlr_seat_client_from_resource(seat_resource); + if (!surface) { + return; + } if (surface->popup->committed) { wl_resource_post_error(surface->popup->resource,