blankie
/
wlroots
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #143 from Ongy/signal_remove 

fixes use after free caused by signal lists
This commit is contained in:
Drew DeVault 2017-09-08 23:11:36 +09:00 committed by GitHub
parent c59ccbde51 935b6d871e
commit f4faa731f0
3 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
types/wlr_input_device.c
View File

@ -30,7 +30,7 @@ void wlr_input_device_destroy(struct wlr_input_device *dev) {
} }
wl_signal_emit(&dev->events.destroy, dev); wl_signal_emit(&dev->events.destroy, dev);
if (dev->_device) { if (dev->_device) {
switch (dev->type) { switch (dev->type) {
case WLR_INPUT_DEVICE_KEYBOARD: case WLR_INPUT_DEVICE_KEYBOARD:
@ -58,6 +58,7 @@ void wlr_input_device_destroy(struct wlr_input_device *dev) {
if (dev->impl && dev->impl->destroy) { if (dev->impl && dev->impl->destroy) {
dev->impl->destroy(dev); dev->impl->destroy(dev);
} else { } else {
wl_list_remove(&dev->events.destroy.listener_list);
free(dev); free(dev);
} }
} }

1
types/wlr_keyboard.c
View File

@ -14,6 +14,7 @@ void wlr_keyboard_destroy(struct wlr_keyboard *kb) {
if (kb && kb->impl && kb->impl->destroy) { if (kb && kb->impl && kb->impl->destroy) {
kb->impl->destroy(kb); kb->impl->destroy(kb);
} else { } else {
wl_list_remove(&kb->events.key.listener_list);
free(kb); free(kb);
} }
} }

4
types/wlr_pointer.c
View File

@ -17,6 +17,10 @@ void wlr_pointer_destroy(struct wlr_pointer *pointer) {
if (pointer && pointer->impl && pointer->impl->destroy) { if (pointer && pointer->impl && pointer->impl->destroy) {
pointer->impl->destroy(pointer); pointer->impl->destroy(pointer);
} else { } else {
wl_list_remove(&pointer->events.motion.listener_list);
wl_list_remove(&pointer->events.motion_absolute.listener_list);
wl_list_remove(&pointer->events.button.listener_list);
wl_list_remove(&pointer->events.axis.listener_list);
free(pointer); free(pointer);
} }
} }