mirrors/sway
1
0
Fork 0
mirror of https://github.com/swaywm/sway.git synced 2024-11-23 08:21:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2163 from martinetd/use-after-free

Browse source 
layer shell: fix some use after free on destroy
This commit is contained in:
Ryan Dwyer 2018-06-26 22:51:38 +10:00 committed by GitHub
parent 59086fabbf 6856866a61
commit af0f0375ef
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 12 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
include/sway/output.h
View file

@ -32,6 +32,10 @@ struct sway_output {
struct wl_list link; struct wl_list link;
pid_t bg_pid; pid_t bg_pid;
struct {
struct wl_signal destroy;
} events;
}; };
void output_damage_whole(struct sway_output *output); void output_damage_whole(struct sway_output *output);

9
sway/desktop/layer_shell.c
View file

@ -219,6 +219,8 @@ static void handle_output_destroy(struct wl_listener *listener, void *data) {
struct sway_layer_surface *sway_layer = struct sway_layer_surface *sway_layer =
wl_container_of(listener, sway_layer, output_destroy); wl_container_of(listener, sway_layer, output_destroy);
wl_list_remove(&sway_layer->output_destroy.link); wl_list_remove(&sway_layer->output_destroy.link);
wl_list_remove(&sway_layer->link);
wl_list_init(&sway_layer->link);
sway_layer->layer_surface->output = NULL; sway_layer->layer_surface->output = NULL;
wlr_layer_surface_close(sway_layer->layer_surface); wlr_layer_surface_close(sway_layer->layer_surface);
} }
@ -350,10 +352,6 @@ void handle_layer_shell_surface(struct wl_listener *listener, void *data) {
wl_signal_add(&layer_surface->surface->events.commit, wl_signal_add(&layer_surface->surface->events.commit,
&sway_layer->surface_commit); &sway_layer->surface_commit);
sway_layer->output_destroy.notify = handle_output_destroy;
wl_signal_add(&layer_surface->output->events.destroy,
&sway_layer->output_destroy);
sway_layer->destroy.notify = handle_destroy; sway_layer->destroy.notify = handle_destroy;
wl_signal_add(&layer_surface->events.destroy, &sway_layer->destroy); wl_signal_add(&layer_surface->events.destroy, &sway_layer->destroy);
sway_layer->map.notify = handle_map; sway_layer->map.notify = handle_map;
@ -366,6 +364,9 @@ void handle_layer_shell_surface(struct wl_listener *listener, void *data) {
layer_surface->data = sway_layer; layer_surface->data = sway_layer;
struct sway_output *output = layer_surface->output->data; struct sway_output *output = layer_surface->output->data;
sway_layer->output_destroy.notify = handle_output_destroy;
wl_signal_add(&output->events.destroy, &sway_layer->output_destroy);
wl_list_insert(&output->layers[layer_surface->layer], &sway_layer->link); wl_list_insert(&output->layers[layer_surface->layer], &sway_layer->link);
// Temporarily set the layer's current state to client_pending // Temporarily set the layer's current state to client_pending

3
sway/desktop/output.c
View file

@ -1199,6 +1199,8 @@ static void damage_handle_destroy(struct wl_listener *listener, void *data) {
static void handle_destroy(struct wl_listener *listener, void *data) { static void handle_destroy(struct wl_listener *listener, void *data) {
struct sway_output *output = wl_container_of(listener, output, destroy); struct sway_output *output = wl_container_of(listener, output, destroy);
wl_signal_emit(&output->events.destroy, output);
if (output->swayc) { if (output->swayc) {
container_destroy(output->swayc); container_destroy(output->swayc);
} }
@ -1277,6 +1279,7 @@ void output_enable(struct sway_output *output) {
for (size_t i = 0; i < len; ++i) { for (size_t i = 0; i < len; ++i) {
wl_list_init(&output->layers[i]); wl_list_init(&output->layers[i]);
} }
wl_signal_init(&output->events.destroy);
input_manager_configure_xcursor(input_manager); input_manager_configure_xcursor(input_manager);