frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xwayland/present: Destroy sync_callback in xwl_present_cleanup 

xwl_present_cleanup frees the struct xwl_present_window memory,
so if there's a pending callback, we have to destroy it to prevent
use-after-free in xwl_present_sync_callback.

Should fix issue #645.

Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
This commit is contained in:
Michel Dänzer 2019-03-08 18:49:04 +01:00 committed by Michel Dänzer
parent f665a9c9e6
commit 2e18eec6f0
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
hw/xwayland/xwayland-present.c
View File

@ -123,6 +123,11 @@ xwl_present_cleanup(WindowPtr window)
xwl_present_window->frame_callback = NULL; xwl_present_window->frame_callback = NULL;
} }
if (xwl_present_window->sync_callback) {
wl_callback_destroy(xwl_present_window->sync_callback);
xwl_present_window->sync_callback = NULL;
}
/* Clear remaining events */ /* Clear remaining events */
xorg_list_for_each_entry_safe(event, tmp, &xwl_present_window->event_list, list) { xorg_list_for_each_entry_safe(event, tmp, &xwl_present_window->event_list, list) {
xorg_list_del(&event->list); xorg_list_del(&event->list);