mirrors
/
sway
mirror of https://github.com/swaywm/sway.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

input/cursor: handle image surface destroy 

This adds a listener for the destroy event of the cursor image surface.
This prevents a use-after-free when the last visible image surface is
freed, there has not been a new cursor set, and the cursor is reshown.
This commit is contained in:
Brian Ashworth 2020-01-05 16:50:48 -05:00 committed by Drew DeVault
parent c1cab4bf0e
commit 9d48a3d78d
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/sway/input/cursor.h
View File

@ -58,6 +58,7 @@ struct sway_cursor {
uint32_t tool_buttons;
struct wl_listener request_set_cursor;
struct wl_listener image_surface_destroy;
struct wl_listener constraint_commit;

18
sway/input/cursor.c
View File

@ -789,6 +789,15 @@ static void handle_pointer_swipe_end(struct wl_listener *listener, void *data) {
cursor->pointer_gestures, cursor->seat->wlr_seat,
event->time_msec, event->cancelled);
}
static void handle_image_surface_destroy(struct wl_listener *listener,
void *data) {
struct sway_cursor *cursor =
wl_container_of(listener, cursor, image_surface_destroy);
cursor_set_image(cursor, NULL, cursor->image_client);
cursor_rebase(cursor);
}
void cursor_set_image(struct sway_cursor *cursor, const char *image,
struct wl_client *client) {
if (!(cursor->seat->wlr_seat->capabilities & WL_SEAT_CAPABILITY_POINTER)) {
@ -797,7 +806,9 @@ void cursor_set_image(struct sway_cursor *cursor, const char *image,
const char *current_image = cursor->image;
cursor->image = image;
wl_list_remove(&cursor->image_surface_destroy.link);
cursor->image_surface = NULL;
wl_list_init(&cursor->image_surface_destroy.link);
cursor->hotspot_x = cursor->hotspot_y = 0;
cursor->image_client = client;
@ -821,7 +832,10 @@ void cursor_set_image_surface(struct sway_cursor *cursor,
}
cursor->image = NULL;
wl_list_remove(&cursor->image_surface_destroy.link);
cursor->image_surface = surface;
wl_signal_add(&cursor->image_surface->events.destroy,
&cursor->image_surface_destroy);
cursor->hotspot_x = hotspot_x;
cursor->hotspot_y = hotspot_y;
cursor->image_client = client;
@ -840,6 +854,7 @@ void sway_cursor_destroy(struct sway_cursor *cursor) {
wl_event_source_remove(cursor->hide_source);
wl_list_remove(&cursor->image_surface_destroy.link);
wl_list_remove(&cursor->pinch_begin.link);
wl_list_remove(&cursor->pinch_update.link);
wl_list_remove(&cursor->pinch_end.link);
@ -885,6 +900,9 @@ struct sway_cursor *sway_cursor_create(struct sway_seat *seat) {
cursor->hide_source = wl_event_loop_add_timer(server.wl_event_loop,
hide_notify, cursor);
wl_list_init(&cursor->image_surface_destroy.link);
cursor->image_surface_destroy.notify = handle_image_surface_destroy;
cursor->pointer_gestures = wlr_pointer_gestures_v1_create(server.wl_display);
cursor->pinch_begin.notify = handle_pointer_pinch_begin;
wl_signal_add(&wlr_cursor->events.pinch_begin, &cursor->pinch_begin);