diff options
| author | Ryan Dwyer <RyanDwyer@users.noreply.github.com> | 2018-06-26 22:51:38 +1000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-06-26 22:51:38 +1000 |
| commit | af0f0375ef9aefb1d53e2058ec2f4cf51ee287a5 (patch) | |
| tree | 14be83d7e63450352c85e9723977c5f1001ae3c7 | |
| parent | 59086fabbfaa545641827b0e181100027de08205 (diff) | |
| parent | 6856866a612c9f0708a42cbe6d9627173d9e3569 (diff) | |
Merge pull request #2163 from martinetd/use-after-free
layer shell: fix some use after free on destroy
| -rw-r--r-- | include/sway/output.h | 4 | ||||
| -rw-r--r-- | sway/desktop/layer_shell.c | 9 | ||||
| -rw-r--r-- | sway/desktop/output.c | 3 |
3 files changed, 12 insertions, 4 deletions
diff --git a/include/sway/output.h b/include/sway/output.h index 70f746dc..8180ce3d 100644 --- a/include/sway/output.h +++ b/include/sway/output.h @@ -32,6 +32,10 @@ struct sway_output { struct wl_list link; pid_t bg_pid; + + struct { + struct wl_signal destroy; + } events; }; void output_damage_whole(struct sway_output *output); diff --git a/sway/desktop/layer_shell.c b/sway/desktop/layer_shell.c index 3accdefb..b57d1ee6 100644 --- a/sway/desktop/layer_shell.c +++ b/sway/desktop/layer_shell.c @@ -219,6 +219,8 @@ static void handle_output_destroy(struct wl_listener *listener, void *data) { struct sway_layer_surface *sway_layer = wl_container_of(listener, sway_layer, output_destroy); wl_list_remove(&sway_layer->output_destroy.link); + wl_list_remove(&sway_layer->link); + wl_list_init(&sway_layer->link); sway_layer->layer_surface->output = NULL; wlr_layer_surface_close(sway_layer->layer_surface); } @@ -350,10 +352,6 @@ void handle_layer_shell_surface(struct wl_listener *listener, void *data) { wl_signal_add(&layer_surface->surface->events.commit, &sway_layer->surface_commit); - sway_layer->output_destroy.notify = handle_output_destroy; - wl_signal_add(&layer_surface->output->events.destroy, - &sway_layer->output_destroy); - sway_layer->destroy.notify = handle_destroy; wl_signal_add(&layer_surface->events.destroy, &sway_layer->destroy); sway_layer->map.notify = handle_map; @@ -366,6 +364,9 @@ void handle_layer_shell_surface(struct wl_listener *listener, void *data) { layer_surface->data = sway_layer; struct sway_output *output = layer_surface->output->data; + sway_layer->output_destroy.notify = handle_output_destroy; + wl_signal_add(&output->events.destroy, &sway_layer->output_destroy); + wl_list_insert(&output->layers[layer_surface->layer], &sway_layer->link); // Temporarily set the layer's current state to client_pending diff --git a/sway/desktop/output.c b/sway/desktop/output.c index d4115be8..f0f1603a 100644 --- a/sway/desktop/output.c +++ b/sway/desktop/output.c @@ -1199,6 +1199,8 @@ static void damage_handle_destroy(struct wl_listener *listener, void *data) { static void handle_destroy(struct wl_listener *listener, void *data) { struct sway_output *output = wl_container_of(listener, output, destroy); + wl_signal_emit(&output->events.destroy, output); + if (output->swayc) { container_destroy(output->swayc); } @@ -1277,6 +1279,7 @@ void output_enable(struct sway_output *output) { for (size_t i = 0; i < len; ++i) { wl_list_init(&output->layers[i]); } + wl_signal_init(&output->events.destroy); input_manager_configure_xcursor(input_manager); |