diff options
| author | Simon Ser <contact@emersion.fr> | 2019-12-05 16:35:55 +0100 |
|---|---|---|
| committer | Drew DeVault <sir@cmpwn.com> | 2019-12-05 10:49:04 -0500 |
| commit | 6ca82087b1cbc3940e20df8fc14a73cf1e1eddc9 (patch) | |
| tree | 3ac5e4433289b654009295436ad37003b2465897 | |
| parent | 8681e4ab8a2d4c95abd34abf0e0eed3351d11bf0 (diff) | |
backend/drm: fix segfault in init_drm_surface
When surf->gbm was previously set, we destroy it without setting it to
NULL. Later on, we only create the GBM surface if surf->gbm is NULL.
This result in a use-after-free when we start using surf->gbm.
Closes: https://github.com/swaywm/wlroots/issues/1868
Closes: https://github.com/swaywm/wlroots/issues/1874
Closes: https://github.com/swaywm/sway/issues/4785
Closes: https://github.com/swaywm/sway/issues/4717
Closes: https://github.com/swaywm/sway/issues/4730
Fixes: 2bdd1d0896cc ("backend/drm: use modifiers for our GBM buffers")
| -rw-r--r-- | backend/drm/renderer.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/backend/drm/renderer.c b/backend/drm/renderer.c index a3bcc943..9edf7632 100644 --- a/backend/drm/renderer.c +++ b/backend/drm/renderer.c @@ -81,6 +81,7 @@ bool init_drm_surface(struct wlr_drm_surface *surf, surf->back = NULL; } gbm_surface_destroy(surf->gbm); + surf->gbm = NULL; } wlr_egl_destroy_surface(&surf->renderer->egl, surf->egl); |