diff options
| author | Drew DeVault <sir@cmpwn.com> | 2017-09-08 23:11:36 +0900 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-09-08 23:11:36 +0900 |
| commit | f4faa731f0610156f325cb89ca5c56ba51e55387 (patch) | |
| tree | 5369476aa44d1c8048213ef895edc9be4b83a746 | |
| parent | c59ccbde518ac173fffe8aba16ad9c5b703f7e2a (diff) | |
| parent | 935b6d871e8e384c52c1c0077def06bd767d4361 (diff) | |
Merge pull request #143 from Ongy/signal_remove
fixes use after free caused by signal lists
| -rw-r--r-- | types/wlr_input_device.c | 3 | ||||
| -rw-r--r-- | types/wlr_keyboard.c | 1 | ||||
| -rw-r--r-- | types/wlr_pointer.c | 4 |
3 files changed, 7 insertions, 1 deletions
diff --git a/types/wlr_input_device.c b/types/wlr_input_device.c index 002c2b54..7015dcba 100644 --- a/types/wlr_input_device.c +++ b/types/wlr_input_device.c @@ -30,7 +30,7 @@ void wlr_input_device_destroy(struct wlr_input_device *dev) { } wl_signal_emit(&dev->events.destroy, dev); - + if (dev->_device) { switch (dev->type) { case WLR_INPUT_DEVICE_KEYBOARD: @@ -58,6 +58,7 @@ void wlr_input_device_destroy(struct wlr_input_device *dev) { if (dev->impl && dev->impl->destroy) { dev->impl->destroy(dev); } else { + wl_list_remove(&dev->events.destroy.listener_list); free(dev); } } diff --git a/types/wlr_keyboard.c b/types/wlr_keyboard.c index 02b3842d..f20d2a73 100644 --- a/types/wlr_keyboard.c +++ b/types/wlr_keyboard.c @@ -14,6 +14,7 @@ void wlr_keyboard_destroy(struct wlr_keyboard *kb) { if (kb && kb->impl && kb->impl->destroy) { kb->impl->destroy(kb); } else { + wl_list_remove(&kb->events.key.listener_list); free(kb); } } diff --git a/types/wlr_pointer.c b/types/wlr_pointer.c index 74856762..04100e56 100644 --- a/types/wlr_pointer.c +++ b/types/wlr_pointer.c @@ -17,6 +17,10 @@ void wlr_pointer_destroy(struct wlr_pointer *pointer) { if (pointer && pointer->impl && pointer->impl->destroy) { pointer->impl->destroy(pointer); } else { + wl_list_remove(&pointer->events.motion.listener_list); + wl_list_remove(&pointer->events.motion_absolute.listener_list); + wl_list_remove(&pointer->events.button.listener_list); + wl_list_remove(&pointer->events.axis.listener_list); free(pointer); } } |