During a VT-Switch a raw pointer to the shared cursor object is saved which is then freed (in case of low refcount) by a call to xf86CursorSetCursor with argument pCurs = NullCursor. This leads to a dangling pointer which can follow in a use after free. This fix ensures that there is a shared handle saved for the VT-Switch cycle. Reviewed-by: Michel Dänzer <mdaenzer@redhat.com> |
||
---|---|---|
.. | ||
dmx | ||
kdrive | ||
vfb | ||
xfree86 | ||
xnest | ||
xquartz | ||
xwayland | ||
xwin | ||
Makefile.am | ||
meson.build |