Go to file
Tudor Brindus feb0e1c74d xwayland: fix use-after-free in selection handling
Fixes #2425.

wlroots can only handle one outgoing transfer at a time, so it keeps a
list of pending selections. The head of the list is the currently-active
selection, and when that transfer completes and is destroyed, the next
one is started.

The trouble is when you have a transfer to some app that is misbehaving.
fcitx is one such application. With really large transfers, fcitx will
hang and never wake up again. So, you can end up with a transfer list
that looks like this:

| T1: started | T2: pending | T3: pending | T4: pending |

The file descriptor for transfer T1 is registered in libwayland's epoll
loop. The rest are waiting in wlroots' list.

As a user, you want your clipboard back, so you `pkill fcitx`. Now
Xwayland sends `XCB_DESTROY_NOTIFY` to let us know to give up. We clean
up T4 first.

Due to a bug in wlroots code, we register the (fd, transfer data
pointer) pair for T1 with libwayland *again*, despite it already being
registered. We do this 2 more times as we remove T3 and T2.

Finally, we remove T1 and `free` all the memory associated with it,
before `close`-ing its transfer file descriptor.

However, we still have 3 copies of T1's file descriptor left in the
epoll loop, since we erroneously added them as part of removing T2/3/4.
When we `close` the file descriptor as part of T1's teardown, we
actually cause the epoll loop to wake up the next time around, saying
"this file descriptor has activity!" (it was closed, so `read`-ing would
normally return 0 to let us know of EOF).

But instead of returning 0, it returns -1 with `EBADF`, because the file
descriptor has already been closed. And finally, as part of error-handling
this, we access the transfer pointer, which was `free`'d. And we crash.
2020-10-11 08:59:08 +02:00
.builds session: Add libseat backend 2020-08-24 11:13:55 +02:00
backend backend/libinput: improve logger callback 2020-10-10 10:51:32 -04:00
contrib build: replace version with soversion 2020-01-24 11:17:03 +01:00
docs backend/drm: add env variable to disable modifiers 2020-01-24 19:43:51 +01:00
examples examples: use `perror` instead of `fprintf` GNU %m `printf` extension 2020-10-11 06:36:23 +02:00
include layer-shell: add for_each_popup 2020-09-10 17:44:55 +02:00
protocol output-management-v1: add head identifying events 2020-09-04 21:21:18 +02:00
render render: Don't crash on 0 dimensions 2020-08-27 17:39:31 +02:00
tinywl tinywl: Fix wrong anchor point while resizing a window 2020-04-28 21:44:27 +02:00
types output-management-v1: send complete head state on enable change 2020-10-09 16:28:09 +02:00
util util/region: add wlr_region_scale_xy 2020-06-17 09:10:54 -06:00
xcursor Fix undefined behavior 2020-09-01 11:58:56 +02:00
xwayland xwayland: fix use-after-free in selection handling 2020-10-11 08:59:08 +02:00
.editorconfig Set .editorconfig ident_size 2019-01-25 11:37:46 +01:00
.gitignore Remove rootston 2019-08-09 08:34:59 +09:00
CONTRIBUTING.md contributing: add note about events that destroy objects 2020-06-08 10:12:38 -06:00
LICENSE Update LICENSE year (MIT license) 2018-04-12 21:29:59 -04:00
README.md Remove libcap support 2020-04-29 10:39:09 +02:00
meson.build session: Add libseat backend 2020-08-24 11:13:55 +02:00
meson_options.txt session: Add libseat backend 2020-08-24 11:13:55 +02:00
wlroots.syms util: add wlr_output_destroy_safe 2020-02-17 20:52:37 +01:00

README.md

wlroots

Pluggable, composable, unopinionated modules for building a Wayland compositor; or about 50,000 lines of code you were going to write anyway.

  • wlroots provides backends that abstract the underlying display and input hardware, including KMS/DRM, libinput, Wayland, X11, and headless backends, plus any custom backends you choose to write, which can all be created or destroyed at runtime and used in concert with each other.
  • wlroots provides unopinionated, mostly standalone implementations of many Wayland interfaces, both from wayland.xml and various protocol extensions. We also promote the standardization of portable extensions across many compositors.
  • wlroots provides several powerful, standalone, and optional tools that implement components common to many compositors, such as the arrangement of outputs in physical space.
  • wlroots provides an Xwayland abstraction that allows you to have excellent Xwayland support without worrying about writing your own X11 window manager on top of writing your compositor.
  • wlroots provides a renderer abstraction that simple compositors can use to avoid writing GL code directly, but which steps out of the way when your needs demand custom rendering code.

wlroots implements a huge variety of Wayland compositor features and implements them right, so you can focus on the features that make your compositor unique. By using wlroots, you get high performance, excellent hardware compatibility, broad support for many wayland interfaces, and comfortable development tools - or any subset of these features you like, because all of them work independently of one another and freely compose with anything you want to implement yourself.

Check out our wiki to get started with wlroots.

wlroots is developed under the direction of the sway project. A variety of wrapper libraries are available for using it with your favorite programming language.

Building

Install dependencies:

  • meson
  • wayland
  • wayland-protocols
  • EGL
  • GLESv2
  • libdrm
  • GBM
  • libinput
  • xkbcommon
  • udev
  • pixman
  • systemd (optional, for logind support)
  • elogind (optional, for logind support on systems without systemd)

If you choose to enable X11 support:

  • xcb
  • xcb-composite
  • xcb-xfixes
  • xcb-xinput
  • xcb-image
  • xcb-render
  • x11-xcb
  • xcb-errors (optional, for improved error reporting)
  • x11-icccm (optional, for improved Xwayland introspection)

Run these commands:

meson build
ninja -C build

Install like so:

sudo ninja -C build install

Contributing

See CONTRIBUTING.md.