diff options
| author | Simon Ser <contact@emersion.fr> | 2023-06-01 17:36:28 +0200 |
|---|---|---|
| committer | Alexander Orzechowski <alex@ozal.ski> | 2023-06-02 16:27:54 +0000 |
| commit | 6668c822b3bf58ca5af5d370ef03b075be3e4d27 (patch) | |
| tree | eedbdbd8eb2736afbb00c92d958de3884931c1e2 | |
| parent | 9c9e3f626350fa67405317d60b5dfdb828486b63 (diff) | |
cursor: unset wlr_output_cursor.texture on surface destroy
When the surface is destroyed, its current wlr_texture is about to
get destroyed as well. Reset wlr_output_cursor.texture to prevent
use-after-free.
Closes: https://gitlab.freedesktop.org/wlroots/wlroots/-/issues/3652
| -rw-r--r-- | types/wlr_cursor.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/types/wlr_cursor.c b/types/wlr_cursor.c index 867e7d90..fdb40a72 100644 --- a/types/wlr_cursor.c +++ b/types/wlr_cursor.c @@ -424,6 +424,7 @@ static void output_cursor_output_handle_surface_destroy( struct wlr_cursor_output_cursor *output_cursor = wl_container_of(listener, output_cursor, surface_destroy); assert(output_cursor->surface != NULL); + wlr_output_cursor_set_buffer(output_cursor->output_cursor, NULL, 0, 0); cursor_output_cursor_reset_image(output_cursor); } |