wlroots/types
Dominique Martinet 48e8da851d wlr_seat destroy: fix use-after-free when destroying clients
wl_resource_for_each_safe isn't safe to use here because it accesses
the list's head memory one last time at the end of the loop. Work
around this by breaking out early.

==19880==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d0000e6368 at pc 0x7fab68619de2 bp 0x7ffd5c91cee0 sp 0x7ffd5c91ced0
READ of size 8 at 0x60d0000e6368 thread T0
    #0 0x7fab68619de1 in wlr_seat_destroy ../types/seat/wlr_seat.c:179
    #1 0x7fab68619fb9 in handle_display_destroy ../types/seat/wlr_seat.c:196
    #2 0x7fab688e4f8f in wl_priv_signal_emit src/wayland-server.c:2024
    #3 0x7fab688e56ca in wl_display_destroy src/wayland-server.c:1092
    #4 0x40c11e in server_fini ../sway/server.c:138
    #5 0x40b1a8 in main ../sway/main.c:438
    #6 0x7fab67b5e18a in __libc_start_main ../csu/libc-start.c:308
    #7 0x409359 in _start (/opt/wayland/bin/sway+0x409359)

0x60d0000e6368 is located 24 bytes inside of 144-byte region [0x60d0000e6350,0x60d0000e63e0)
freed by thread T0 here:
    #0 0x7fab6a7d6880 in __interceptor_free (/lib64/libasan.so.5+0xee880)
    #1 0x7fab68619805 in seat_client_handle_resource_destroy ../types/seat/wlr_seat.c:97
    #2 0x7fab688e5025 in destroy_resource src/wayland-server.c:688

previously allocated by thread T0 here:
    #0 0x7fab6a7d6e50 in calloc (/lib64/libasan.so.5+0xeee50)
    #1 0x7fab686198df in seat_handle_bind ../types/seat/wlr_seat.c:127
    #2 0x7fab6530503d in ffi_call_unix64 (/lib64/libffi.so.6+0x603d)
2018-07-04 14:50:14 +09:00
..
data_device update drag position at the right times 2018-06-05 23:45:03 -04:00
seat wlr_seat destroy: fix use-after-free when destroying clients 2018-07-04 14:50:14 +09:00
xdg_shell Introduce wlr_xdg_surface_for_each_popup 2018-07-01 23:24:39 +10:00
xdg_shell_v6 Introduce wlr_xdg_surface_for_each_popup 2018-07-01 23:24:39 +10:00
meson.build screencopy-v1: add basic implementation 2018-06-30 22:17:59 +01:00
wlr_box.c box: fix wlr_box_intersection 2018-06-06 08:47:04 +01:00
wlr_buffer.c buffer: fix wlr_texture leak on failed alloc 2018-06-16 19:01:13 +01:00
wlr_compositor.c s/wlr_subsurface_from_surface/wlr_subsurface_from_wlr_surface/ 2018-06-30 21:21:13 +09:00
wlr_cursor.c cleanup: Use void for zero-parameter functions 2018-05-30 20:19:16 -04:00
wlr_export_dmabuf_v1.c export dmabuf manager_handle_capture_output: fix leak on error 2018-06-30 11:47:25 +09:00
wlr_gamma_control.c Revert "ELF Visibility" 2018-02-19 18:01:27 -05:00
wlr_idle.c wlr_idle: add helper to enable/disable all timers 2018-06-27 22:47:05 +09:00
wlr_idle_inhibit_v1.c wlr_idle_inhibit_v1: cleanup destroy handlers 2018-06-28 22:04:28 +09:00
wlr_input_device.c input-device: add output_name field, populate it from libinput 2018-04-29 14:30:09 +01:00
wlr_input_inhibitor.c input-inhibit: use wlr_signal_emit_safe 2018-06-24 19:33:15 -04:00
wlr_keyboard.c wlr_keyboard: fix mmap leak + logic on close for keymap_fd 2018-06-30 11:38:21 +09:00
wlr_layer_shell.c layer-shell: check whether the surface is mapped in layer_surface_destroy() 2018-06-16 17:29:53 +03:00
wlr_linux_dmabuf.c Merge branch 'master' into screencontent 2018-06-17 14:49:18 +01:00
wlr_list.c Revert "ELF Visibility" 2018-02-19 18:01:27 -05:00
wlr_matrix.c Fix typos in comments and strings 2018-05-03 21:59:43 +01:00
wlr_output.c wlr_output: fix scope for 'now' 2018-06-30 11:38:21 +09:00
wlr_output_damage.c output-damage: limit the number of damaged rectangles 2018-05-05 14:28:55 +01:00
wlr_output_layout.c cleanup: Use void for zero-parameter functions 2018-05-30 20:19:16 -04:00
wlr_pointer.c backend/x11: correctly destroy input devices 2018-04-28 12:55:36 +01:00
wlr_primary_selection.c wlr_primary_selection: fix use-after-free when cancelling source 2018-06-25 17:28:44 +09:00
wlr_region.c compositor: redesign how resources are managed 2018-04-26 17:51:06 +01:00
wlr_screencopy_v1.c screencopy: listen to buffer destroy 2018-06-30 22:18:04 +01:00
wlr_screenshooter.c screencopy: add support for frame flags 2018-06-30 22:18:03 +01:00
wlr_server_decoration.c Revert "ELF Visibility" 2018-02-19 18:01:27 -05:00
wlr_surface.c properly check if the point is inside the surface in wlr_surface_point_accepts_input 2018-07-03 10:29:02 +03:00
wlr_tablet_pad.c Revert "ELF Visibility" 2018-02-19 18:01:27 -05:00
wlr_tablet_tool.c Revert "ELF Visibility" 2018-02-19 18:01:27 -05:00
wlr_touch.c Revert "ELF Visibility" 2018-02-19 18:01:27 -05:00
wlr_virtual_keyboard_v1.c virtual-keyboard: fix wlr_virtual_keyboard_manager_v1_destroy 2018-05-30 09:25:46 +01:00
wlr_wl_shell.c Send axis source event 2018-05-12 13:53:21 +01:00
wlr_xcursor_manager.c Redesign wlr_texture 2018-03-24 23:48:32 -04:00
wlr_xdg_output.c xdg-output: bump output manager version to 2 2018-05-17 09:30:10 +01:00