mirrors/sway
1
0
Fork 0
mirror of https://github.com/swaywm/sway.git synced 2024-11-25 09:21:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

input/seat: Reset command handler context in seat_destroy()

Browse source 
This fixes a dangling reference which causes a use-after-free.
This commit is contained in:
Andri Yngvason 2020-12-28 21:36:12 +00:00 committed by Simon Ser
parent e11bc058ac
commit 9ef5cc03f1
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
sway/input/seat.c
View file

@ -15,6 +15,7 @@
#include "config.h" #include "config.h"
#include "list.h" #include "list.h"
#include "log.h" #include "log.h"
#include "sway/config.h"
#include "sway/desktop.h" #include "sway/desktop.h"
#include "sway/input/cursor.h" #include "sway/input/cursor.h"
#include "sway/input/input-manager.h" #include "sway/input/input-manager.h"
@ -53,6 +54,9 @@ static void seat_node_destroy(struct sway_seat_node *seat_node) {
} }
void seat_destroy(struct sway_seat *seat) { void seat_destroy(struct sway_seat *seat) {
if (seat == config->handler_context.seat) {
config->handler_context.seat = input_manager_get_default_seat();
}
struct sway_seat_device *seat_device, *next; struct sway_seat_device *seat_device, *next;
wl_list_for_each_safe(seat_device, next, &seat->devices, link) { wl_list_for_each_safe(seat_device, next, &seat->devices, link) {
seat_device_destroy(seat_device); seat_device_destroy(seat_device);