diff options
| author | Brian Ashworth <RedSoxFan@users.noreply.github.com> | 2018-07-28 01:31:43 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-07-28 01:31:43 -0400 |
| commit | 92a4bc646a52b1715f4885d7459c07b7a26a2d21 (patch) | |
| tree | 815a384ed1a54f390e46805c1ae0927449b29430 /sway/desktop | |
| parent | 7ad9d743faa485b35ee5d38224736f445db071d2 (diff) | |
| parent | 073ac425d5bf6f6393eb91d9b5f84e3caa68f511 (diff) | |
Merge pull request #2370 from RyanDwyer/transactions-use-after-free
Fix use after free in transactions
Diffstat (limited to 'sway/desktop')
| -rw-r--r-- | sway/desktop/transaction.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/sway/desktop/transaction.c b/sway/desktop/transaction.c index ee7a0704..0a24c4fc 100644 --- a/sway/desktop/transaction.c +++ b/sway/desktop/transaction.c @@ -364,7 +364,13 @@ static void set_instructions_ready(struct sway_view *view, int index) { struct sway_transaction_instruction *instruction = view->swayc->instructions->items[i]; if (!instruction->ready) { + // set_instruction_ready can remove instructions from the list we're + // iterating + size_t length = view->swayc->instructions->length; set_instruction_ready(instruction); + size_t num_removed = length - view->swayc->instructions->length; + i -= num_removed; + index -= num_removed; } } } |