diff options
| author | emersion <contact@emersion.fr> | 2018-07-01 13:23:50 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-07-01 13:23:50 +0100 |
| commit | 55dba13c6ec2ebd7359b1c9164e5e15646030008 (patch) | |
| tree | e569f6008ac49d886d6396dc51b783d8d56f047e | |
| parent | 07209d062c919225af70df2caa75fffe5921cb97 (diff) | |
| parent | 9ddc2f39d0e6b59cb4f5f8ed8b4961a40172bbc1 (diff) | |
Merge pull request #1106 from martinetd/seat-destroy-uaf
wlr_seat destroy: fix use-after-free after primary selection source cancel
| -rw-r--r-- | types/seat/wlr_seat.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/types/seat/wlr_seat.c b/types/seat/wlr_seat.c index ead4b0e7..c9eecef6 100644 --- a/types/seat/wlr_seat.c +++ b/types/seat/wlr_seat.c @@ -168,9 +168,9 @@ void wlr_seat_destroy(struct wlr_seat *seat) { seat->selection_source = NULL; } if (seat->primary_selection_source) { + wl_list_remove(&seat->primary_selection_source_destroy.link); seat->primary_selection_source->cancel(seat->primary_selection_source); seat->primary_selection_source = NULL; - wl_list_remove(&seat->primary_selection_source_destroy.link); } struct wlr_seat_client *client, *tmp; |