mirrors
/
sway
mirror of https://github.com/swaywm/sway.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

container: Fix crash when view unmaps + maps quickly 

Followup on 4e4898e90f.

If a view quickly maps and unmaps repeatedly, there will be multiple
destroyed containers with same view in a single transaction. Each of
these containers will then try to destroy this view, resulting in use
after free.
The container should only destroy the view if the view still belongs
to the container.

Simple reproducer: couple XMapWindow + XUnmapWindow in a loop followed
by XDestroyWindow.

See #6605

(cherry picked from commit f92329701b)
This commit is contained in:
David Rosca 2021-10-19 07:54:36 +02:00 committed by Simon Ser
parent 44bb0aa3ee
commit 828a9a3cfb
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sway/tree/container.c
View File

@ -80,10 +80,8 @@ void container_destroy(struct sway_container *con) {
wlr_texture_destroy(con->marks_urgent);
wlr_texture_destroy(con->marks_focused_tab_title);
if (con->view) {
if (con->view->container == con) {
con->view->container = NULL;
}
if (con->view && con->view->container == con) {
con->view->container = NULL;
if (con->view->destroying) {
view_destroy(con->view);
}