diff options
| author | Tony Crisci <tony@dubstepdish.com> | 2018-06-25 11:03:07 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-06-25 11:03:07 -0400 |
| commit | e51829ff7c25215cdf002f9947665b68a27a6275 (patch) | |
| tree | b9e889484beabe50022a2bd7f100786f8e228817 | |
| parent | 253a88f03065763f2f9238d0389da382e3e09090 (diff) | |
| parent | ffd37b664f6fbb01d6be44411b3117c88ee61fe2 (diff) | |
| download | wlroots-e51829ff7c25215cdf002f9947665b68a27a6275.tar.xz | |
Merge pull request #1084 from martinetd/use-after-free
use-after-free fixes (xdg_shell popups, primary selection source, xwm parents)
| -rw-r--r-- | types/wlr_primary_selection.c | 2 | ||||
| -rw-r--r-- | types/xdg_shell/wlr_xdg_surface.c | 6 | ||||
| -rw-r--r-- | types/xdg_shell_v6/wlr_xdg_surface_v6.c | 6 | ||||
| -rw-r--r-- | xwayland/xwm.c | 6 |
4 files changed, 19 insertions, 1 deletions
diff --git a/types/wlr_primary_selection.c b/types/wlr_primary_selection.c index b8f3094b..15452071 100644 --- a/types/wlr_primary_selection.c +++ b/types/wlr_primary_selection.c @@ -229,9 +229,9 @@ void wlr_seat_set_primary_selection(struct wlr_seat *seat, } if (seat->primary_selection_source) { + wl_list_remove(&seat->primary_selection_source_destroy.link); seat->primary_selection_source->cancel(seat->primary_selection_source); seat->primary_selection_source = NULL; - wl_list_remove(&seat->primary_selection_source_destroy.link); } seat->primary_selection_source = source; diff --git a/types/xdg_shell/wlr_xdg_surface.c b/types/xdg_shell/wlr_xdg_surface.c index c5d177b2..6931b92f 100644 --- a/types/xdg_shell/wlr_xdg_surface.c +++ b/types/xdg_shell/wlr_xdg_surface.c @@ -415,6 +415,12 @@ void destroy_xdg_surface(struct wlr_xdg_surface *surface) { wlr_signal_emit_safe(&surface->events.destroy, surface); + struct wlr_xdg_popup *popup_state, *next; + wl_list_for_each_safe(popup_state, next, &surface->popups, link) { + xdg_popup_send_popup_done(popup_state->resource); + destroy_xdg_popup(popup_state->base); + } + switch (surface->role) { case WLR_XDG_SURFACE_ROLE_TOPLEVEL: destroy_xdg_toplevel(surface); diff --git a/types/xdg_shell_v6/wlr_xdg_surface_v6.c b/types/xdg_shell_v6/wlr_xdg_surface_v6.c index e111adad..7343906f 100644 --- a/types/xdg_shell_v6/wlr_xdg_surface_v6.c +++ b/types/xdg_shell_v6/wlr_xdg_surface_v6.c @@ -100,6 +100,12 @@ void destroy_xdg_surface_v6(struct wlr_xdg_surface_v6 *surface) { wlr_signal_emit_safe(&surface->events.destroy, surface); + struct wlr_xdg_popup_v6 *popup_state, *next; + wl_list_for_each_safe(popup_state, next, &surface->popups, link) { + zxdg_popup_v6_send_popup_done(popup_state->resource); + destroy_xdg_popup_v6(popup_state->base); + } + switch (surface->role) { case WLR_XDG_SURFACE_V6_ROLE_TOPLEVEL: destroy_xdg_toplevel_v6(surface); diff --git a/xwayland/xwm.c b/xwayland/xwm.c index b397b1e8..66a85d05 100644 --- a/xwayland/xwm.c +++ b/xwayland/xwm.c @@ -294,6 +294,12 @@ static void xwayland_surface_destroy( wl_list_remove(&xsurface->link); wl_list_remove(&xsurface->parent_link); + struct wlr_xwayland_surface *child, *next; + wl_list_for_each_safe(child, next, &xsurface->children, parent_link) { + wl_list_remove(&child->parent_link); + wl_list_init(&child->parent_link); + } + if (xsurface->surface_id) { wl_list_remove(&xsurface->unpaired_link); } |