diff options
| author | Simon Ser <contact@emersion.fr> | 2023-06-22 16:28:43 +0200 |
|---|---|---|
| committer | Simon Ser <contact@emersion.fr> | 2023-06-22 16:28:43 +0200 |
| commit | 8714657d7bc6850a9d9c0591767bf13e80a55186 (patch) | |
| tree | e32405c97ed5d0748254cad46bf1f1e67e541d7d | |
| parent | d59749aa44d2c69aa90cd0055214f4a9dfcddeea (diff) | |
xwayland: unset wlr_xwayland.server on destroy
This fixes a use-after-free in the Sway patch to filter the Xwayland
shell [1].
The server is destroyed first, then the shell. The Xwayland process
might still be using the shell while running.
When the shell is destroyed, libwayland will invoke the global
filter (to figure out whether to send a wl_registry.global_remove
to clients). Then Sway will compare the client with
wlr_xwayland_server.client. However, at that point, the server is
gone.
Reset the server to NULL so that Sway can check whether the server
is still running.
[1]: https://github.com/swaywm/sway/pull/7647
| -rw-r--r-- | xwayland/xwayland.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/xwayland/xwayland.c b/xwayland/xwayland.c index 75c09f31..7f3a6eae 100644 --- a/xwayland/xwayland.c +++ b/xwayland/xwayland.c @@ -75,6 +75,7 @@ void wlr_xwayland_destroy(struct wlr_xwayland *xwayland) { wlr_xwayland_set_seat(xwayland, NULL); wlr_xwayland_server_destroy(xwayland->server); + xwayland->server = NULL; wlr_xwayland_shell_v1_destroy(xwayland->shell_v1); free(xwayland); } |