From 897c36b12cc4b706bcb730a47181d829d7ab9729 Mon Sep 17 00:00:00 2001 From: Brian Ashworth Date: Sun, 5 Jan 2020 16:50:48 -0500 Subject: [PATCH] input/cursor: handle image surface destroy This adds a listener for the destroy event of the cursor image surface. This prevents a use-after-free when the last visible image surface is freed, there has not been a new cursor set, and the cursor is reshown. --- include/sway/input/cursor.h | 1 + sway/input/cursor.c | 18 ++++++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/include/sway/input/cursor.h b/include/sway/input/cursor.h index 0bcd262fa..5b6f9a9f0 100644 --- a/include/sway/input/cursor.h +++ b/include/sway/input/cursor.h @@ -58,6 +58,7 @@ struct sway_cursor { uint32_t tool_buttons; struct wl_listener request_set_cursor; + struct wl_listener image_surface_destroy; struct wl_listener constraint_commit; diff --git a/sway/input/cursor.c b/sway/input/cursor.c index 680fe39e3..215dc7672 100644 --- a/sway/input/cursor.c +++ b/sway/input/cursor.c @@ -789,6 +789,15 @@ static void handle_pointer_swipe_end(struct wl_listener *listener, void *data) { cursor->pointer_gestures, cursor->seat->wlr_seat, event->time_msec, event->cancelled); } + +static void handle_image_surface_destroy(struct wl_listener *listener, + void *data) { + struct sway_cursor *cursor = + wl_container_of(listener, cursor, image_surface_destroy); + cursor_set_image(cursor, NULL, cursor->image_client); + cursor_rebase(cursor); +} + void cursor_set_image(struct sway_cursor *cursor, const char *image, struct wl_client *client) { if (!(cursor->seat->wlr_seat->capabilities & WL_SEAT_CAPABILITY_POINTER)) { @@ -797,7 +806,9 @@ void cursor_set_image(struct sway_cursor *cursor, const char *image, const char *current_image = cursor->image; cursor->image = image; + wl_list_remove(&cursor->image_surface_destroy.link); cursor->image_surface = NULL; + wl_list_init(&cursor->image_surface_destroy.link); cursor->hotspot_x = cursor->hotspot_y = 0; cursor->image_client = client; @@ -821,7 +832,10 @@ void cursor_set_image_surface(struct sway_cursor *cursor, } cursor->image = NULL; + wl_list_remove(&cursor->image_surface_destroy.link); cursor->image_surface = surface; + wl_signal_add(&cursor->image_surface->events.destroy, + &cursor->image_surface_destroy); cursor->hotspot_x = hotspot_x; cursor->hotspot_y = hotspot_y; cursor->image_client = client; @@ -840,6 +854,7 @@ void sway_cursor_destroy(struct sway_cursor *cursor) { wl_event_source_remove(cursor->hide_source); + wl_list_remove(&cursor->image_surface_destroy.link); wl_list_remove(&cursor->pinch_begin.link); wl_list_remove(&cursor->pinch_update.link); wl_list_remove(&cursor->pinch_end.link); @@ -885,6 +900,9 @@ struct sway_cursor *sway_cursor_create(struct sway_seat *seat) { cursor->hide_source = wl_event_loop_add_timer(server.wl_event_loop, hide_notify, cursor); + wl_list_init(&cursor->image_surface_destroy.link); + cursor->image_surface_destroy.notify = handle_image_surface_destroy; + cursor->pointer_gestures = wlr_pointer_gestures_v1_create(server.wl_display); cursor->pinch_begin.notify = handle_pointer_pinch_begin; wl_signal_add(&wlr_cursor->events.pinch_begin, &cursor->pinch_begin);