diff options
| author | emersion <contact@emersion.fr> | 2018-01-30 19:45:57 +0100 |
|---|---|---|
| committer | emersion <contact@emersion.fr> | 2018-01-30 19:45:57 +0100 |
| commit | babdd6ccf757f18ef15b50d9f16c55031a7c1944 (patch) | |
| tree | 4e1d065ea0b710c44d362b07cc941cd290d5ac46 /backend/headless | |
| parent | 704130cc1164604c5b805adf186999269e14c5a5 (diff) | |
backend: fix use-after-free when destroying backends
The backend destroy signal is emitted before the output_remove
signal is. When the destroy signal is emitted listeners remove
their output_remove listener, so the output_remove signal is never
received and listeners have an invalid output pointer.
The correct way to solve this would be to remove the output_remove
signal completely and use the wlr_output.events.destroy signal
instead. This isn't yet possible because wl_signal_emit is unsafe
and listeners cannot be removed in listeners.
Diffstat (limited to 'backend/headless')
| -rw-r--r-- | backend/headless/backend.c | 2 | ||||
| -rw-r--r-- | backend/headless/output.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/backend/headless/backend.c b/backend/headless/backend.c index 61409d41..0bf5ec28 100644 --- a/backend/headless/backend.c +++ b/backend/headless/backend.c @@ -51,6 +51,8 @@ static void backend_destroy(struct wlr_backend *wlr_backend) { wlr_input_device_destroy(&input_device->wlr_input_device); } + wl_signal_emit(&wlr_backend->events.destroy, backend); + wlr_egl_finish(&backend->egl); free(backend); } diff --git a/backend/headless/output.c b/backend/headless/output.c index 46f9d212..aac7cc20 100644 --- a/backend/headless/output.c +++ b/backend/headless/output.c @@ -62,8 +62,6 @@ static bool output_swap_buffers(struct wlr_output *wlr_output) { static void output_destroy(struct wlr_output *wlr_output) { struct wlr_headless_output *output = (struct wlr_headless_output *)wlr_output; - wl_signal_emit(&output->backend->backend.events.output_remove, - &output->wlr_output); wl_list_remove(&output->link); |