diff options
| author | Isaac Freund <ifreund@ifreund.xyz> | 2021-08-09 16:40:45 +0200 |
|---|---|---|
| committer | Isaac Freund <ifreund@ifreund.xyz> | 2021-08-09 16:40:45 +0200 |
| commit | 7013bc3b69850ae3ae4e187d775193b8b1dba0ed (patch) | |
| tree | d6a554d7b8a4311bdfe2bd0f9be04a3a5d6ac491 | |
| parent | 556d7906940e68f74e970dbf8eac3aa0f1aea87a (diff) | |
| download | river-7013bc3b69850ae3ae4e187d775193b8b1dba0ed.tar.gz river-7013bc3b69850ae3ae4e187d775193b8b1dba0ed.tar.xz | |
Xwayland: fix possible use-after-free on unmap
The view.unmap() call may synchronously destroy the view, which makes
the the code removing listeners which is currently run after
view.unmap() access free'd memory.
To fix this, simply change the order of the calls to match that of
XdgToplevel.handleUnmap().
| -rw-r--r-- | river/XwaylandView.zig | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/river/XwaylandView.zig b/river/XwaylandView.zig index 089aafc..b25e689 100644 --- a/river/XwaylandView.zig +++ b/river/XwaylandView.zig @@ -214,12 +214,12 @@ fn handleMap(listener: *wl.Listener(*wlr.XwaylandSurface), xwayland_surface: *wl fn handleUnmap(listener: *wl.Listener(*wlr.XwaylandSurface), xwayland_surface: *wlr.XwaylandSurface) void { const self = @fieldParentPtr(Self, "unmap", listener); - self.view.unmap(); - // Remove listeners that are only active while mapped self.commit.link.remove(); self.set_title.link.remove(); self.set_class.link.remove(); + + self.view.unmap(); } fn handleRequestConfigure( |